Privacy Policy

Your account: your name, email address and a password (stored only as a one-way hash), plus optional profile details you add, such as a phone number, country or preferred currency. If you turn on two-factor sign-in we store what it needs to work.

Your content: what you put into a workspace: subscriptions, plans and costs, notes, documents you upload, the people you invite, who you share things with, and the logins, keys and 2FA secrets you store. Secrets are encrypted before they're stored (see below).

Security and activity records: when and from what device and address you sign in, and a log of sensitive actions in a workspace (for example who revealed or copied a login). These exist to protect your account and let workspace admins see who did what.

Emails we send: verification codes, invitations, reminders and notifications you've asked for, and important service messages.

If you ask for updates you give us your first name and work email (required), optionally your company, team size and interests, and the fact and time you agreed to be contacted. We also record how you arrived, if the link carried campaign details or a referral code.

Just visiting the website collects nothing about you beyond what a web server logs for every request (such as your IP address and browser type).

• To run Subment: keep your account and workspaces working, and show your content to the people you chose.
• To keep it secure: detect misuse, protect accounts and investigate problems.
• To email you what you need: codes, invitations, reminders, and service notices.
• To improve the product and, if you asked, to tell you about paid plans and big changes.

We don't sell your data, and we don't use your stored logins, keys or documents for advertising or to train models. Nobody at Subment reads your secrets as part of normal work.

Each workspace has its own encryption key, itself protected by a managed key service. Secrets are encrypted before they're stored, and revealing one needs a recent sign-in and is recorded. Subment is not zero-knowledge: the service can decrypt a secret when an authorized person asks to reveal it. We say this so you can decide what to store.

The app uses cookies to keep you signed in. They're essential to the service, not for advertising or tracking. The website doesn't set advertising or tracking cookies and doesn't use a third-party analytics service. If that changes, this page will say so before it does.

We use service providers to run Subment: cloud hosting, a database, file storage, key management and email delivery. They handle data only to provide those services, under their own confidentiality and security obligations. Your data may be processed in the countries where they operate. We share it with others only where the law requires, or where you tell us to (for example when you share a subscription with a colleague).

While your account is open. When you delete your account, your personal details are erased and your account is anonymised, and workspaces with nobody else in them are permanently deleted. Encrypted backups age out on a normal rotation and can't be restored into the product. Other workspaces' activity history keeps a record that an action happened, without your details.

In the app you can download everything we hold about you and export a workspace's subscriptions (Settings, Data & privacy), correct your details, and delete your account. You can also ask us to show you, correct or delete what we hold, or to stop emailing you. Asking is enough; you don't need to justify it.

A contact address will be published here shortly. Until then, use the feedback option inside the app.

If you believe we've handled your data unlawfully, you also have the right to complain to your local data-protection authority.

Subment is for adults. We don't knowingly collect information from anyone under 18.

If this policy changes in a way that matters, we'll update the date at the top and tell account holders.