Privacy Policy

Last updated: August 1, 2026

This policy explains what data we collect when you use Subscription Graveyard (the "Service"), why we collect it, who we share it with, and what choices you have. Throughout this policy, "we," "us," and "our" refer to Jen Built It LLC.

1. What we collect

• Account data. Your email address and a salted PBKDF2 hash of your password (100,000 iterations, per-user random salt, SHA-256). We never store your password in plain text and never see it again after you set it. We also store your selected currency and whether your email has been verified.
• Graveyard data. The cancelled subscriptions you bury (name, monthly cost, category, cancellation date, optional start date, optional reason). This is visible only to you when you are logged in.
• Last Rites data. The subscriptions you are planning to cancel (name, monthly cost, category, optional notes).
• Renewal Watchlist data (Pro). The upcoming renewals you ask us to warn you about (name, monthly cost, category, next renewal date, billing cycle, how many days ahead to warn you, whether the reminder is a cancel or a negotiate reminder, an optional cancel URL, and optional notes).
• Security data. A bounded record of failed login attempts and rate-limit counters, keyed by IP address or email address, used solely to throttle abuse. Password-reset and email-verification tokens are stored as SHA-256 hashes so a database snapshot leak cannot directly compromise a pending reset.
• Cross-app Pro status. If you upgrade to Pro on Jen's App Hub, this Service receives a signed token from App Hub that confirms your Pro status and your email. We do not receive your Stripe payment details. Card numbers, CVV, and other payment data stay with Stripe and App Hub.
• Newsletter consent. Subscription Graveyard does not offer a newsletter sign-up. Your account record carries a newsletter-consent flag that stays off unless you explicitly opt in somewhere that we add one in the future.

We do not run analytics on your subscription data, and we do not read it for any purpose other than showing it back to you and sending the reminders you asked for.

2. Why we collect it

• To create and secure your account (legal basis: contract).
• To store the burials, Last Rites entries, and watchlist items you ask us to store (legal basis: contract).
• To send Pro renewal and negotiation reminder emails on the schedule you set (legal basis: contract).
• To recognize you across the Jen Built It app family when you have a Pro subscription (legal basis: contract).
• To prevent brute-force login, credential stuffing, and abuse (legal basis: legitimate interest).
• To send you transactional emails (email verification, password reset) (legal basis: contract).

3. Who we share it with (processors)

We use a small set of vendors to operate the Service. Each vendor only receives the minimum data they need.

• Cloudflare hosts the Service and our database (Cloudflare Workers + D1).
• Resend sends transactional email: email verification, password reset, and Pro renewal warnings.
• Jen's App Hub issues a signed Pro entitlement token that this Service verifies locally to grant Pro features. App Hub itself uses Stripe for payment processing; Stripe never communicates directly with Subscription Graveyard.
• Our own n8n automation server (self-hosted, operated by Jen Built It LLC) receives two things: server-error beacons, which contain only the request path, HTTP method, status code, and error message and never any account data; and, if you ask us for a savings recap by email, a read-only summary of your burial totals for the period you requested.

We do not sell your personal data. We do not share your data with advertisers. We do not transfer your data to third parties for their own marketing.

4. How long we keep your data

• Account, burials, Last Rites, and watchlist items: as long as your account exists. When you delete your account from the footer, we delete every row tied to your user ID (users, subscriptions, Last Rites, renewal watchlist, reset tokens, email-verification tokens, and your failed-login record) immediately and irrevocably.
• Security data (failed-login counters, rate-limit rows): purged automatically when they expire, which is a matter of minutes for rate-limit windows.

5. Cookies and local storage

We use a token in browser localStorage to keep you logged in, plus a Pro entitlement token if you have Pro. We also store small interface flags in your browser (whether you have seen the onboarding overlay, and which savings milestones you have already been shown). We do not use advertising cookies, third-party tracking pixels, or cross-site analytics.

6. Your rights

Depending on where you live (GDPR, UK GDPR, CCPA/CPRA, and similar laws), you may have the right to:

• Access the personal data we hold about you. Open Account settings in the footer and use Export my data to download every record tied to your account as JSON.
• Correct inaccurate data (edit your burials, Last Rites entries, watchlist items, or email).
• Delete your account and all your data (Account settings → Delete my account). You will be asked for your current password. Deletion is immediate and we cannot undo it.
• Lodge a complaint with your local data protection authority.

For anything that requires our help (CCPA right-to-know, GDPR Article 15 statement, dispute over a deletion), email privacy@jenbuiltit.com from the address tied to your account. We respond within 30 days (45 days for California requests).

7. Security

We protect your data using TLS in transit (HSTS), salted PBKDF2 password hashing, parameterized SQL with per-user row filtering, signed JWT sessions with revocation, throttling after repeated failed logins, request body size caps, per-IP and per-account rate limiting, and a strict Content Security Policy. No system is perfectly secure, but if we detect a breach affecting your data we will notify you and the appropriate authorities as required by law.

8. Affiliate links

The Service shows occasional tips and suggestions, and some of those links are affiliate links, labeled as such where they appear. If you follow one and sign up, Jen Built It LLC may earn a commission at no extra cost to you. Following an affiliate link takes you to a third party's site, where that party's own privacy policy and cookies apply. We do not send your account data to those sites, and we do not receive personal data back from them.

9. Children

The Service is not directed at children under 16 and we do not knowingly collect personal data from them. If you believe a child has created an account, email privacy@jenbuiltit.com and we will delete it.

10. International users

The Service is operated from the United States. By using the Service from outside the US, you consent to the transfer of your data to the US. We rely on Standard Contractual Clauses or equivalent safeguards with our sub-processors where required.

11. California residents

If you are a California resident, you have the rights described in Section 6 above (right to know, delete, correct) under the CCPA/CPRA. You also have the right to opt out of the sale or sharing of your personal information. We do not sell or share personal information for cross-context behavioral advertising; see our Do Not Sell or Share My Personal Information page for the formal statement.

12. Cross-app Pro verification

If you have a Pro subscription on Jen's App Hub, this Service receives a signed JWT containing only your email and your Pro expiration date. We verify the signature locally using a shared secret. No payment details, no profile data beyond email, and no usage data from other Jen Built It apps is shared with this Service.

13. Changes to this policy

If we update this policy in a way that materially changes how we handle your data, we will notify you by email and post a notice on the Service. The "Last updated" date at the top will always reflect the current version.

14. Contact

Questions about this policy or your data:

Jen Built It LLC
10800 S Lloyd Drive
Worth, IL 60482
USA
privacy@jenbuiltit.com

Privacy · Terms of Service · Accessibility · Do Not Sell My Info · Become an affiliate