Privacy policy

The short version

Stackcut ("we", "us") runs the website stackcut.io, the results app at stackcut.io/app, the Stackcut Chrome extension, and the MCP server for AI agents at stackcut.io/mcp, with its directory endpoint stackcut.io/mcp/public. This policy covers all four. Stackcut is in public beta.

What we collect

What we receive depends on how you run your stack audit.

From Gmail, with the Chrome extension

• Page mode (shown as Quick scan; no Google sign-in, for everyone): the extension runs searches for receipts, renewals and trials in your own Gmail tab and reads the search result rows. For each row it sends us the sender name and address, the subject, the short preview snippet Gmail shows, and the date. When a row looks like a receipt but shows no price, the extension opens that email in your Gmail tab (up to 150 per scan) and sends us up to 2,000 characters of its visible text so the amount can be read; that text is classified and discarded like receipt text in Deep scan. Opening an email this way marks it as read in Gmail. Page mode does not use Google APIs and never reads attachments. All of this happens in your own browser tab.
• Deep scan (Google sign-in, test users only for now): you sign in with Google OAuth and grant read-only Gmail access (gmail.readonly). The extension then uses the Gmail API. For each matching message it sends us the sender, subject, snippet, date, whether the message has an unsubscribe header, and up to 2,000 characters of the message text. It never reads attachments.
• The extension only looks at messages that match its receipt and billing searches from the last 3 months. It never sends, deletes, moves or labels email.
• We send the subject, snippet and (in Deep scan) receipt text to a third-party AI service, TypeSafe (Jev model), to classify it: is it a bill, which vendor, which plan, what amount. TypeSafe processes it with zero data retention. We discard the text as soon as it is classified and never store email bodies or snippets.

From card statement CSV files

Files you upload on stackcut.io are read in your browser. Payments and transfers are skipped in your browser. For each remaining charge we receive and store only the date, amount and merchant description, plus the account label you type (for example "Amex ••1004"). The file itself is never uploaded.

From Plaid (optional), only if you connect a bank

Connecting a card through Plaid is optional and available only with an invite code. If you use it, Plaid sends us up to 2 years of transactions for the accounts you pick: date, amount, merchant name or description, category, and the last digits of the account number. We never see your bank username or password. We use Plaid's access only for the one import, then remove our access to the account.

From you, in the results app

Your choices for each subscription (Keep, Cancel, Replace, Not mine), the features you tick, and how often you use each tool.

From the "Get updates" form

Your email address. We also record which page you signed up on, a referral code if the link had one, your browser's user agent, and where your visit came from (the source details described in Site analytics, unless your browser sends Global Privacy Control or Do Not Track).

Technical data

• To limit abuse, we count how many audits start from an IP address. We store a one-way hash of the IP address with a salt that changes every day, not the IP address itself.
• Our hosting providers keep standard request logs (such as IP address, time and the page or endpoint requested) for security and operations.
• Our pages load fonts from Google Fonts, so Google receives your IP address when a page loads.
• We don't use advertising cookies. The results app keeps your private audit link and unsaved answers in your browser's session storage, which clears when you close the tab.

Site analytics

To learn where our visitors come from and what they need, our public pages (home, audit, recipes, blog, agents, and the like) use two analytics tools, PostHog and Google Analytics 4. They record:

• Where your visit came from: the page that linked to us, the campaign tags in the link (utm_ parameters), ad click ids (such as gclid or fbclid), a referral code (?ref=), and whether an AI assistant, a search engine, a social site or a directory sent you.
• What you look at and click: the pages you visit, with their query strings, and the links and buttons you click, with their text.
• What you type into the job finder on the home page, the job you open, what you say you pay now, the team size and hourly value you set, and which options you open or expand. Before anything is sent, email addresses, phone numbers, long numbers and the query part of any link you type are removed, so please don't type other personal details there.
• The country, device type and browser the tools derive from your request.

How they keep it:

• Outside the EEA, the UK and Switzerland, PostHog keeps a random first-party id in a cookie and local storage, and we keep one local storage entry with the first source that brought you to us, so later visits and sign-ups can be tied back to it. Google Analytics sets its own first-party cookies (_ga).
• In the EEA, the UK and Switzerland (as your device's time zone tells us), PostHog keeps nothing on your device, and Google Analytics runs in Google's cookieless consent mode.
• Neither tool records your screen or sessions. We never send them a link fragment, or a parameter that looks like a token, key, code, password or email address. Google signals and ad personalization are off, and PostHog doesn't build person profiles.
• The results app (/app/), where your scan and savings plan live, loads no analytics at all. The start page is counted by its path and campaign tags only.
• If your browser sends Global Privacy Control or Do Not Track, neither tool loads.
• You can exclude this browser from site analytics. This stores only your opt-out preference on this device, including in Europe. To remove it, enable site analytics again. Preview and local test sites are excluded by default.
• The Chrome extension sends no analytics and nothing about the pages you browse.

From AI agents using our MCP server

If you explicitly submit an action outcome through report_action_outcome on either endpoint, we retain the service, route, packet revision, action and reported outcome, billing channel, language and market, optional numeric offer or savings amounts and currency, a blocker category, timestamp, and a one-way hash of your opaque deduplication key. Do not submit names, receipts, email messages, account identifiers or other personal information. Reports are unverified evidence; blocked or changed steps create a private review task. Optional offer terms include billing period, duration, renewal amount, commitment, fees and effective date; these remain reported observations. Routine call logs do not duplicate explicit report arguments. These reports are retained for source review and quality improvement.

Explicit report_guide_feedback submissions retain a feedback category, known service and supplied packet revision, optional route and step number, billing channel, language and market if known, handoff categories, timestamp and a one-way hash of an opaque retry key. Missing-vendor feedback may include only a public root vendor domain, without a URL, path, query or account subdomain. Stale references are labeled unverified. We do not automatically visit submitted domains or publish reported changes. Do not submit screenshots, messages, account identifiers or other personal information.

Operational MCP diagnostics retain opaque request/call IDs, environment, endpoint profile, server version, fixed error categories and published-schema field/rule codes. Malformed requests and resource reads are counted separately without request or resource bodies. Capture-delivery records describe analytics acknowledgements, failures and timeouts; they do not verify a subscription action.

When an AI agent calls a tool on stackcut.io/mcp, we store the tool name and the arguments it sent (for example vendor names, prices, seats, features, usage numbers, and a project description), a short summary of our answer, and the name and version of the agent's app. We never store the IP address or user agent: to count repeat callers we keep a one-way hash of them that changes every day. Before storing, the server removes anything that looks like a key, token or email address, and it never stores the read-only plan code an agent sends to get_my_plan. Agents are told not to send personal data or secrets. We use this to improve recommendations and prices, and to count usage (PostHog receives the same hashed id, the tool name, timing and success, but not the arguments).

The directory endpoint, stackcut.io/mcp/public (the one listed in AI app directories), keeps no routine tool arguments and no answers. For each routine call it records only the tool name, whether it worked, how long it took, the agent app's name and version, and the same daily-changing hashed caller id. That endpoint doesn't offer get_my_plan, so no plan code reaches it.

What we store and for how long

How we use it

• To find your subscriptions, match them to known tools, and build your savings plan.
• To run, secure and fix the service, including rate limits against abuse.
• To email you about the Chrome Web Store launch and the Grok plugin, if you signed up for updates. Every email lets you unsubscribe.

We don't sell or rent your data. We don't use it for advertising. We don't use it to train AI models. People at Stackcut don't read your email data, except when you ask us to (for example to fix a problem with your scan), when needed for security, or when the law requires it.

Who processes it

We use these service providers to run Stackcut. They process data only on our instructions.

We may disclose data if the law requires it, or to protect the safety of our users or the service. If Stackcut is sold or merged, we will tell you before your data moves to a new owner, and this policy will still apply to it.

Google user data

Stackcut's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Gmail data only to find subscriptions and build your stack audit, features you can see in the extension and results app.
• We transfer Gmail data to others only as needed to provide those features (the processors above), to comply with the law, or as part of a merger or sale with notice to you.
• We never use Gmail data for advertising, and never sell it.
• We never use Gmail data to train AI or machine learning models.
• People don't read your Gmail data unless you give permission for specific messages, it is needed for security or to comply with the law, or the data is aggregated and anonymized for internal operations.

Deep scan asks Google for read-only Gmail access (gmail.readonly). You can remove it at any time at myaccount.google.com/permissions. Page mode (Quick scan) doesn't use Google APIs or OAuth; it reads Gmail search-result rows, and opens receipts that show no price, in your own browser tab.

Deleting your data

• Delete my scan: on your results page, click Delete my scan. This deletes your subscriptions, email facts, transactions, answers, savings plan and any shared savings card from our database right away. It can't be undone.
• By email: write to support@stackcut.io with your results link. Scans aren't tied to an email address, so we can't find a scan without its link; scans without one are deleted automatically within 90 days. To remove a "Get updates" sign-up, send the address you signed up with. We delete within 30 days and confirm by email.
• The extension keeps scan progress in Chrome's session storage, which clears when Chrome quits. Removing the extension removes it too.
• Get updates: use the unsubscribe link in any email, or write to us.

Copies in our providers' backups and logs are removed on their normal schedules.

Security

• Your results link carries a private token in the part of the URL after #, which browsers don't send to servers. We store only a hash of that token.
• All traffic uses HTTPS. Database rules let only our server read your audit data.
• Anyone with your results link can see your audit. Don't share it if you don't want others to see it.

Other details

• Age: Stackcut is for people 18 and older. We don't knowingly collect data from children.
• Where data is processed: our providers may process data in the United States and other countries.
• Your rights: you can ask for a copy of your data, a correction, or deletion. The results app also lets you download your subscription list as CSV.
• Changes: if we change this policy, we update the date at the top. If a change affects how we use data we already have, we ask first.

Contact

Questions or requests: support@stackcut.io.

See also our terms of use.