WHO WE ARE
Subscription Compass is operated by StoneWealth Technologies LLC. This policy applies to the Subscription Compass Android application, related services and product-specific web pages. Contact admin@stonewealthtechnologies.com for privacy questions or requests.
INFORMATION WE PROCESS
Depending on the features you use, we process account and authentication information, subscription names, amounts and billing frequencies, renewal dates, categories, reminders, trial details, settings, and information you choose to enter. We also process limited device, security, diagnostic and service records needed to operate, protect and troubleshoot the service. Some information remains on your device, while account-linked service information is processed on our backend.
OPTIONAL FINANCIAL ACCOUNT CONNECTION
Connecting a financial account is optional. You can use manual tracking without connecting a bank. Subscription Compass uses Plaid to connect supported financial institutions. With your authorization, Plaid provides permitted account and transaction information, including transaction descriptions, amounts, dates, identifiers, pending status and categories. Our backend collects, processes and stores this information to identify and monitor possible recurring charges for you to review. It stores encrypted Plaid access credentials while a connection is maintained.
Subscription Compass does not ask you to enter your bank password into Compass and does not store your bank password. Authentication occurs through Plaid and your financial institution. Plaid and your institution handle information under their own terms and privacy practices. We protect financial records and connection credentials with encryption and account access controls. Automated classifications can be incomplete or inaccurate; you decide what to track.
HOW WE USE INFORMATION
We use information to provide and maintain Compass features; identify possible recurring charges and help you review them; provide renewal reminders, subscription insights and eligible notifications; authenticate accounts and maintain authorized device access; verify Google Play purchases and entitlements; protect against abuse; troubleshoot problems; and respond to support and privacy requests.
SERVICE PROVIDERS AND DISCLOSURES
We use providers needed to operate the service, including Plaid for financial connectivity, Google Play for Android distribution and billing, Google Firebase for eligible push-notification delivery, Railway for backend infrastructure, and Amazon Web Services for encrypted recovery storage. Providers may process information under their own terms and privacy practices. We may disclose information when required by law, to protect users or the security and rights of the service, or with your direction or consent. We do not sell bank transaction data to advertisers.
NOTIFICATIONS
If you allow notifications, Compass may send reminders and service updates. Notification content is designed to avoid unnecessary financial detail on a device lock screen. Control applicable permissions and settings through Compass and Android.
SECURITY
We use technical and organizational safeguards designed to protect information, including encrypted network transport, encryption for sensitive financial records and connection credentials, restricted service access, and encrypted disaster-recovery copies. No online service can guarantee absolute security. We review safeguards and data-handling practices as the service develops.
RETENTION AND CUSTOMER-REQUESTED REMOVAL
We retain account and cloud-synchronized information while needed to provide your account's service, subject to your deletion request and applicable preservation requirements. Connected-bank credentials and imported financial records are retained while needed for the authorized connection and recurring-charge monitoring. The scanner's analysis window is not an automatic deletion period. Saved subscriptions and Watching decisions are separate from imported bank transactions.
The installed Android action is Disconnect Bank & Delete Imported Data. It requests removal of the bank connection, imported transaction records and bank-derived tracking from our active systems. It does not close your bank account, cancel subscriptions with other businesses, cancel Google Play billing or delete Vault notes as part of bank-only disconnection.
Important: When you use the compatible Disconnect Bank & Delete Imported Data workflow in Subscription Compass 1.0.24 (SC114), our deployed backend preserves manually created tracking and bank-origin tracking that you explicitly edited, saved and synchronized. It keeps these as independent tracking records, with the deleted bank evidence removed. The deletion request still covers imported transactions, unedited bank-derived tracking and bank scan findings. Synchronize saved changes on all your devices before requesting deletion. Older Android clients may require an update before this workflow is available.
Account deletion closes Compass account access once our server accepts the request. Ordinary account and cloud data are removed after required connected-bank removal and authenticated recovery-journal work succeed. Temporary provider or recovery-journal outages may delay completion. Requests remain durably queued for retry, and encrypted information needed to complete pending removal is retained until that work succeeds. We do not promise immediate deletion from every system.
We retain a minimal keyed purchase-token fingerprint to prevent reuse of an already claimed Google Play purchase; the original purchase token, account identity and payment details are not retained in that replay-prevention fingerprint. Minimal encrypted account-deletion and bank-disconnection evidence is held separately from ordinary database backups to support reconciliation before restored data returns to active service. This does not establish complete historical journal coverage. This evidence identifies the affected account or connection but does not contain transaction amounts, merchant descriptions or Vault notes. These safeguards are excluded from ordinary operational cleanup while necessary for their protective purposes; their necessity is reviewed rather than assigned the operational log periods below.
Tax, accounting, legal, regulatory, dispute and investigation preservation requirements can require selected records to be retained longer. Operational cleanup periods do not override those requirements. Independent provider records have their own retention practices. Contact us about the status of your request and the basis for any retained information. Additional privacy rights may apply depending on where you live.
Automatic cleanup operates for eligible, unprotected stale rate-limit counters after two hours of inactivity and login challenges after expiry. The 365-day administrator-audit and 90-day terminal connection-exchange periods remain deferred targets. Protected evidence, pending requests and preservation obligations are excluded. These operational periods do not automatically delete active customer accounts, saved tracking, consent evidence or records requiring documented preservation.
LOCAL COPIES, ACCOUNT RECOVERY AND BILLING
Vault notes and certain saved or recovery records remain local to your phone. Account deletion on one device does not remotely wipe another device, exported files, or records independently held by banks and other providers. Signing out does not by itself request deletion of your Compass account. Some owner-scoped device data may remain available on that device; sign-in alone is not a guarantee of complete restoration on another device. You control copies you export. Contact us if you need help understanding device-local information or recovery behavior.
Deleting Compass or your Compass account does not cancel a Google Play subscription. Cancel or manage billing separately through Google Play.
ENCRYPTED BACKUPS AND RECOVERY
We keep encrypted disaster-recovery backups in private Amazon S3 storage. Database archives are encrypted before upload, and backups are kept separate from ordinary account access.
Past recovery exercises verified particular backups within their recorded scope. They do not establish that every historical copy can be recovered or that the newest production data can be restored. Historical recovery verification is incomplete, and restoration of the newest production data remains unverified.
Deleting information from active systems does not necessarily remove it immediately from backups or other recovery copies. Some copies are protected against alteration or deletion for a period of time, and automatic expiration of completed backups is currently disabled. Applicable preservation requirements and recovery needs must be reviewed before disposal. We do not promise that every copy will be erased within a fixed period. Infrastructure providers control their own operational copies under applicable terms.
Before restored data may return to active service, our recovery procedure requires reconciliation with available authenticated account-deletion and bank-disconnection records. Historical records are not comprehensive. Ordinary backup jobs do not restore over the live database or reactivate removed accounts or connections.
Legacy encrypted copies, including historical test storage and manual or local archives, are being inventoried for safe retirement. We do not promise a fixed maximum retention period for unverified legacy or independent copies. They must be reviewed for ownership, preservation requirements and recovery needs before disposal.
REVIEWS AND YOUR CHOICES
StoneWealth's owner is responsible for monthly privacy and retention reviews and review of material changes. A dated review has identified outstanding consent-evidence, operational-cleanup, legacy-copy and backup-expiration work. Policy adoption and review documentation do not mean those pending controls are operating.
In the app, open Settings & Tools and choose Delete Account & Data to request account deletion. To disconnect a bank and request deletion of its imported data, choose Disconnect Bank & Delete Imported Data. If you cannot use the app, visit https://stonewealthtechnologies.com/subscription-compass/delete/ for instructions, or email admin@stonewealthtechnologies.com with the subject “Delete my Subscription Compass account.” We verify identity before action. Do not send bank passwords, account numbers or transaction details in an initial request. You may also manage notification settings and choose which detected charges to track.
CHILDREN
Subscription Compass is not directed to children under 13, and we do not knowingly design the service to collect personal information from children under 13.
CHANGES AND CONTACT
We may update this policy as Compass or legal and operational requirements change. We update the effective date when a revised policy is published and provide additional notice when required. Contact StoneWealth Technologies LLC at admin@stonewealthtechnologies.com for privacy questions, requests or concerns.