Privacy Policy

1. Introduction

RecurDash ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our subscription tracking service.

Our core principle: We never require access to your bank accounts or financial institutions. Your subscription data is entered manually and stays under your control.

2. Information We Collect

Account Information: When you create an account with your email address, we collect your name, email address, and password (stored securely using industry-standard hashing). If you sign in with Google, we don't hold a password for you; see "Sign in with Google" below.

Subscription Data: The subscription details you manually enter, including service names, costs, billing cycles, and renewal dates.

Usage Data: Basic analytics about how you interact with RecurDash, such as pages visited and features used. We do not track you across other websites.

Sign in with Google: If you choose "Continue with Google", Google shares your name, email address and profile picture with us, plus a Google account ID and whether Google has verified your email address. We ask Google only for basic sign-in information (the openid, email and profile permissions).

• What we store: your name and email address as your account details, your Google account ID so we recognise you the next time you sign in, and a link to your Google profile picture, which we don't currently display. We don't store the access token Google issues during sign-in.
• How we use it: to create your account, sign you in, and mark your email address as verified. After that, your name and email address are used like any other account's, as described in Section 4.
• Who else receives it: only the sub-processors in Section 6 that need your name or email address to do their job: PostHog (product analytics), Laravel Nightwatch (error monitoring) and our transactional email provider. We never sell Google user data, use it for advertising, or pass it to data brokers.
• What we never receive: your Google password, or anything else in your Google Account, such as Gmail, contacts, calendar or Drive files.
• Removing access: you can stop using Sign in with Google with RecurDash at any time from your Google Account's linked apps page. That stops Google sign-in but doesn't delete your RecurDash account or the data we already hold; to delete those, see Section 8.

3. What We Do NOT Collect

• Bank account credentials or access tokens
• Credit card numbers (payments are processed by our merchant of record, Paddle)
• Financial institution login information
• Transaction history from your bank

4. How We Use Your Information

• To provide and maintain the RecurDash service
• To send you renewal reminders and notifications you've opted into
• To improve our service based on aggregated, anonymised usage patterns
• To communicate important service updates

5. Data Security

Your data is encrypted in transit using HTTPS and stored on encrypted disk volumes. Passwords are hashed using bcrypt. We regularly review and update our security practices to protect your information.

6. Data Sharing and Sub-Processors

We do not sell, trade, or rent your personal information. We share data only with the following service providers ("sub-processors") that help us operate RecurDash:

Each sub-processor is bound by a data processing agreement that requires it to protect your data to a standard at least equivalent to the GDPR. We never share your data with advertisers or data brokers.

PostHog detail: PostHog receives your email, name, plan and sign-up date, and product events such as account creation, waitlist sign-up, subscription added or removed, and the steps of the free spending audit. Events can carry counts, such as how many subscriptions you track or how many services you picked in the audit, but never the costs, names or other details of your subscriptions, and never payment details. With each page view and event, PostHog also receives your IP address, which it uses to estimate your approximate location (such as city and country), your browser and device type, and the site that referred you plus any campaign tags in the link you followed. If your device is set to a European time zone, PostHog's script in your browser stores nothing on your device and does not link your browsing to your account, and PostHog uses your IP address only to compute a one-way hash that changes daily, for counting visits, not to estimate your location. Events our server sends about your account, such as sign-up, are unaffected. Session recording, heatmaps and automatic click capture are switched off. You can request deletion of your PostHog data at any time by emailing us.

7. Legal Basis for Processing (GDPR)

If you are in the EU, EEA, or UK, we process your personal data on the following legal bases under GDPR Article 6:

• Contract (Article 6(1)(b)) — to provide the service you signed up for, including subscription tracking, reminders, and account management.
• Legitimate interest (Article 6(1)(f)) — for product analytics and security monitoring, balanced against your privacy interests.
• Legal obligation (Article 6(1)(c)) — for tax, accounting, and fraud prevention obligations imposed on us or our payment processor.
• Consent (Article 6(1)(a)) — for non-essential cookies and marketing communications, where applicable.

8. Data Retention & Deletion

You can delete your account and all associated data at any time from your account settings. If you signed in with Google, deleting your account also deletes the Google account ID and profile picture link we store. When you delete your account, all your subscription data is permanently removed from our servers within 30 days.

9. Your Rights

You have the following rights regarding your personal data:

• Access — request a copy of all data we hold about you
• Rectification — correct inaccurate data
• Erasure — request deletion of your account and data
• Portability — receive your data in CSV or JSON format
• Objection — object to processing based on legitimate interest, including analytics
• Restriction — limit how we process your data while a dispute is resolved
• Withdraw consent — at any time, where processing is based on consent
• Lodge a complaint — with your local supervisory authority (e.g., ICO in the UK, your national DPA in the EU)

Exercise any of these rights by emailing support@recurdash.com. We respond within 30 days.

10. International Data Transfers

RecurDash is operated from Pakistan, which has not been granted a GDPR adequacy decision by the European Commission. Where personal data of EU/EEA/UK residents is transferred to Pakistan or to sub-processors outside the EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs) as the transfer mechanism. Copies of the relevant SCCs are available on request to support@recurdash.com.

11. Cookies

We use essential cookies to keep you logged in and maintain your session. Outside the EU, EEA, UK and Switzerland we also use a PostHog analytics cookie to understand how the service is used. Visitors in those regions get no analytics cookies: PostHog counts their visits without storing anything on their device. For full details, see our Cookie Policy.

12. California Residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, to request deletion, to opt out of "sale" or "sharing" of personal information, and to non-discrimination for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising. To exercise CCPA rights, email support@recurdash.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through a notice on our service.

14. Contact Us

If you have questions about this Privacy Policy, please contact us at support@recurdash.com. RecurDash is operated by Muhammad Mujahid Abbas, Sole Proprietor, registered with the Federal Board of Revenue of Pakistan and based in Lahore, Pakistan.