Privacy Policy

1. Who we are

Sub-Site is a free, browser-based subscription tracker. It is a static website — there is no server, no database, and no user accounts.

For the purposes of UK data protection law, the data controller is the operator of Sub-Site. To contact us about privacy matters, email: admin@sub-site.com.

Feedback submissions sent via our feedback form are processed by a Cloudflare Worker running on our own Cloudflare account. The Worker validates and forwards your message to our email address and does not store submissions in any database. No third-party companies receive your feedback content. This processing is carried out on the lawful basis of legitimate interests (operating and improving the service).

2. Your data stays on your device

All subscription data you enter — names, costs, renewal dates, notes — is stored using localStorage: a standard browser feature that saves data directly on your device, inside your browser. This is similar to a cookie but holds more structured data.

Your localStorage data never leaves your browser. It is not transmitted to Sub-Site's servers (there are none), nor to any third party. Sub-Site cannot see, access, or read your subscription entries.

To delete your data: use the Clear Data option in the app's Settings view, or clear your browser's site data for this site in your browser settings. This is the exercise of your right to erasure — no request to us is needed.

3. What we do not do

• We do not run invasive analytics, advertising, or cross-site tracking. (We do use a privacy-focused analytics tool — see Section 5 for details.)
• We do not use advertising scripts or build any profile of you.
• We do not operate any server-side forms, databases, or logs.
• We do not sell, share, or trade any data about you.
• We cannot see which subscriptions you track — that information never reaches us.

4. Cloudflare (our hosting provider)

Sub-Site is hosted on Cloudflare Pages. As our infrastructure processor, Cloudflare handles the delivery and security of the site. As part of normal CDN and DDoS-protection operation, Cloudflare processes standard HTTP request data — including IP addresses and browser headers — for each page load.

We do not access, receive, or retain Cloudflare's server logs. This processing is carried out by Cloudflare on the lawful basis of legitimate interests (secure and reliable site delivery). You can review Cloudflare's own privacy practices at cloudflare.com/privacypolicy.

5. Privacy-focused analytics (Umami)

We use a self-hosted, open-source analytics tool called Umami, running on our own server at analytics.sub-site.com. It helps us understand basic usage — for example, which pages are visited most — so we can improve the site. It is designed from the ground up to be privacy-respecting.

What Umami collects (all anonymous):

• Page views and the referring URL
• Browser type, operating system, and device type (e.g. mobile or desktop)
• Country, derived from your IP address — your IP itself is never stored
• The URL of the page you visited on Sub-Site

What Umami does not do:

• Set cookies (disabled by default)
• Collect any personal data or create individual user profiles
• Track you across other websites
• Fingerprint your device
• Share data with any third party

All analytics data is stored on our own server and is never shared with third parties. Because no cookies are used and no personal data is collected, this tool is compliant with UK GDPR and PECR by design and does not require a cookie consent banner.

Lawful basis: This anonymous, aggregate data is processed under legitimate interests (Article 6(1)(f) UK GDPR) to operate and improve Sub-Site. Because no personal data is collected and no cookies are set, this processing does not override your privacy rights.

6. Affiliate links and third-party tracking

Some links on Sub-Site — particularly in the Alternatives section — are affiliate links. If you click one of these links, you will be taken to a third-party merchant or service. Sub-Site may earn a small commission if you make a purchase; this does not affect the price you pay.

Affiliate referrals are tracked by affiliate networks, which may include Impact, Commission Junction (CJ), and Awin. When you click an affiliate link, these networks may set a cookie or load a tracking pixel (a tiny, invisible image) in your browser to record that the click came from Sub-Site. This allows them to attribute any resulting commission.

What a tracking pixel does: it makes a request to the network's server, which may record your IP address, browser type, the time of the click, and the referring URL. The cookie may persist in your browser to link future purchases to the referral.

Under UK PECR (Privacy and Electronic Communications Regulations), non-essential cookies and tracking technologies require your consent before being set. These affiliate tracking technologies are non-essential. If you do not wish to be tracked in this way, you can:

• Avoid clicking affiliate links.
• Use your browser's privacy or incognito mode when following links.
• Opt out via the affiliate networks' own opt-out mechanisms: NAI opt-out or Your Online Choices.
• Block third-party cookies in your browser settings.

Sub-Site does not control how affiliate networks use data collected via their tracking technologies. We encourage you to review their privacy policies: Impact, CJ (Conversant), Awin. These networks may transfer data internationally and rely on standard contractual clauses or adequacy decisions for those transfers.

7. Your rights under UK GDPR

Under UK data protection law, you have the following rights in relation to your personal data:

• Access: see what data is held about you. Because your subscription data never leaves your browser, you already have full access to it within the app.
• Rectification: correct inaccurate data. Edit any entry directly in the app.
• Erasure: delete your data. Use Settings → Clear Data, or clear your browser's site data.
• Restriction & objection: limit or object to processing. Since we process no personal data server-side, these rights apply primarily to Cloudflare's infrastructure processing.
• Portability: export your data in a machine-readable format. Use the Export view in the app.

To make a request regarding any data we may hold, contact us at admin@sub-site.com. We will respond within one calendar month.

You also have the right to lodge a complaint with the UK's supervisory authority: the Information Commissioner's Office (ICO).

8. Data retention

• Your subscription data (localStorage): retained until you clear it yourself, either in the app or via your browser settings. We have no control over this.
• Cloudflare infrastructure logs: retained according to Cloudflare's own retention policy.
• Umami analytics data: anonymous aggregate data retained on our own server indefinitely for trend analysis. No personal data is stored.
• Affiliate tracking cookies: retention varies by network. Refer to Impact, CJ, and Awin's respective policies.

9. Children's privacy

Sub-Site is not directed at children under 13 and we do not knowingly process the personal data of children.

10. Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date at the top of this page. We encourage you to check back periodically. Continued use of Sub-Site after a change constitutes acceptance of the revised policy.

11. Contact

For any questions or requests relating to this privacy policy, please contact us at admin@sub-site.com.