Privacy policy

This website is run by one person, with no marketing department. So little data is collected here — but what is collected is described precisely: which fields, on what basis and for how long. If anything below doesn’t match what you actually see, write to us — that’s an error to be fixed.

Who processes your data

The data controller is Tomas Stankevičius, operating as an individual in Lithuania. Contact: tomas@alt-subs.com. No data protection officer has been appointed — the scale of the operation doesn’t create such an obligation, so all questions are answered at the same address.

Price alerts

When you set up a price change alert, we store your email address, the chosen service and plan, the price limit you entered, and dates (when the alert was requested and confirmed, and when the last notification was sent). The codes in the confirmation and unsubscribe links aren’t stored in the database as text — only as a hash salted with a key (HMAC), so someone with access to the database can’t turn them into a working link.

• Why: only to send the email you asked for.
• Legal basis: your consent — you confirm it by clicking the link in the email and the button on the page that opens (double opt-in), so no price alerts are sent without confirmation.
• How long: until you unsubscribe. When you click the unsubscribe link, the email address is deleted from the record immediately; only the record itself remains, marked as unsubscribed, with the date. The address can’t be restored — if you want price alerts again, you need to sign up again. If you don’t click the confirmation link in the email within 30 days, the unconfirmed record is deleted automatically together with the address.

Newsletter

When you sign up for the weekly newsletter, we store your email address, the language of the form you filled in, and dates (when you signed up, when you confirmed and when the last issue was sent). The codes in the confirmation and unsubscribe links are stored, just like for price alerts, only as a hash salted with a key (HMAC).

• Why: only to send an email once a week about changed prices and new articles.
• Legal basis: your consent — you confirm it by clicking the link in the email and the button on the page that opens (double opt-in), so we send no emails without confirmation.
• How long: until you unsubscribe. When you click the unsubscribe link, the email address is deleted from the record immediately, and the link itself stops working; only the record remains, marked as unsubscribed. If you don’t click the confirmation link within 30 days, the unconfirmed record is deleted automatically together with the address.

Error reports

In the “Report an error” form we store your message, the page or plan you’re writing about, and your email address if you entered it — the field is optional, but without it we simply have nowhere to send a reply.

• Why: to fix the error and reply to you if needed.
• Legal basis: legitimate interest in accurate content; for the email address, your consent, since you enter it voluntarily.
• How long: up to 12 months after the issue is resolved; after that, resolved reports are deleted automatically. If you ask, we delete them sooner.

Votes on a service

At the end of a review you can rate the service with stars (1–5). We store the rating, the service, the page language, the time and two hashes: one of the anonymous as_lankytojas cookie (so each reader has one vote and can change it) and one of the IP address (to detect abuse). You can’t be identified from the hashes, and we don’t ask for an email address or name. Votes are used for the average on the same page and in structured data for search engines; they’re kept as long as the service exists. The cookie is described in the cookie policy.

Clicks on partner links

When you click a button that leads to the service provider, we store one row in our database. It contains: the path of the page you came from (without query parameters), the button’s position on the page, campaign tags (utm_*) if they were in the address, the category of the referral source (direct, search, internal, external) and the time.

What’s not in it: no identifier that would link several of your clicks together, no IP address, no browser or device details, no name, no email address, not the full address of the referring page. Nothing is stored on your device. We don’t see what you do on the partner’s website.

• Why: to know which offers and which places on the page are actually useful — in aggregate numbers.
• Legal basis: legitimate interest in understanding what works on the website.
• How long: 12 months, after which the records are deleted automatically.

IP address

We use the IP address for one thing only — limiting how often requests can be made, so forms and redirects can’t be filled with junk automatically. It exists only in the key of a counter and disappears automatically when the time window expires: from one minute for public actions to fifteen minutes for the administrator sign-in. It isn’t written to the database and isn’t linked to the click records. The legal basis is legitimate interest in protecting the service.

Visit statistics

We use Vercel Web Analytics. It sets no cookies and doesn’t store the IP address: the visitor is told apart by a hash calculated from the request itself that expires after 24 hours, so your visits over a week can’t be put together. Along with the page view, the following is recorded: the page address, where you came from, filtered query parameters, approximate location (country, region, city), browser, operating system and device type. The legal basis is legitimate interest in measuring visits in a way that stores nothing on your device.

If you consent in the cookie banner, Google Analytics is also turned on. It sets cookies and therefore runs only with consent; exactly what’s stored and how to withdraw consent is in the cookie policy.

Error monitoring

When something breaks on the website, an error report is sent to Sentry. Sending personal data there is deliberately turned off (sendDefaultPii: false), and performance traces aren’t collected at all. The report contains the place in the code where the error happened, the page address and the browser type. The legal basis is legitimate interest in noticing and fixing a broken spot.

Account (sign-in with email)

An account is optional — the website works without one, and the “My subscriptions” list stays in your browser anyway. It’s useful for two things: finding the list on another device as well, and, if you want, getting an email reminder before a subscription period ends. You sign in through a link in an email; there’s no password, so there’s nothing to lose or leak.

• What we store: your email address (that is the account), the contents of “My subscriptions” — subscription names, plans and prices — and the time of your last sign-in; if you turn on a reminder, also the purchase date of that subscription. Nothing else: no name, no phone number, no payment details, no third-party profile.
• Why: so the “My subscriptions” list is available on every device where you sign in with the same address.
• Legal basis: a service you asked for yourself (contract) — the account exists only because you created it.
• How long: until you delete it. Deleting the account is a single button on the account page, and it takes effect immediately and can’t be undone. If you don’t sign in for 12 months, the account is deleted automatically; the same applies if you never clicked the link in the email within 30 days.
• Reminders: if in the “My subscriptions” list you enter the purchase date for a plan and turn on a reminder, we store that date, the subscription name, the billing period and the language. Why: to send an email to the account’s address before the end of each period (3 days before for monthly plans, 7 days before for longer ones). The reminder disappears when you turn it off (in the list or through the link in the email), when you remove the subscription from the list, or when you delete the account.
• Cookies: when you sign in, session cookies (sb-…) are created in your browser — without them signing in doesn’t work, so they’re strictly necessary cookies. If you don’t sign in, they aren’t set. See the cookie policy.

Administrator account

The person who runs the website signs in at /admin with an email address and password; the sign-in session, role and important actions (e.g. approving a price change) are logged. It has nothing to do with visitors’ data — it’s listed here for completeness.

Who we entrust data to

We don’t sell data, trade it or give it to ad networks. But the website has to run somewhere, so the following providers process data on our behalf:

• Vercel — website hosting and visit statistics.
• Google — visit statistics with Google Analytics; turned on only once you consent in the cookie banner.
• Supabase — database; servers in the European Union (Ireland).
• Resend — sending emails (confirmations, price alerts).
• Upstash — counters for limiting the number of requests.
• Sentry — error reports.

Some of them are US companies, so data may be processed outside the European Economic Area. For such transfers we rely on standard contractual clauses approved by the European Commission or on the EU–U.S. Data Privacy Framework.

What we don’t do

• We don’t require registration — the whole website works without an account.
• We don’t build a profile of you and don’t make automated decisions about you.
• We don’t put personal data in URL parameters.
• We don’t track you on other websites and don’t use advertising cookies.
• The service isn’t aimed at people under 16; we don’t knowingly collect their data.

Your rights

You can ask to access your data, have it corrected or deleted and its processing restricted, object to processing based on legitimate interest, receive the data in a portable format, and withdraw your consent at any time — withdrawal isn’t retroactive, but processing stops from that moment.

The easiest way is to write to tomas@alt-subs.com. We reply within one month. If the request concerns alerts you signed up for by email, we reply to the same address — then you don’t need to prove your identity with any documents. You can also unsubscribe from price alerts directly, through the link at the bottom of every email.

If you believe we process your data unlawfully, you can file a complaint with a supervisory authority. Because the data controller is established in Lithuania, our supervisory authority is the Lithuanian VDAI:

Changes

When the way the website works changes, this page changes too. The text was last checked against the actual code on August 15, 2026.