Privacy & Architecture

1.0 What is SOVA?

SOVA is a Chrome extension that helps you keep track of your subscriptions. It can detect when you're on a checkout page, let you import subscriptions from your Gmail, remind you before trials end or payments renew, and help you cancel things you don't use anymore.

SOVA stores your subscription data locally on your device. If you sync between devices, an encrypted copy goes to our servers — but the encryption key is derived from your account ID on your device, and we don't store the key separately. That means the data on our servers is ciphertext we can't meaningfully read without your account ID.

1.1 How We Approach Privacy

• Local-first: Your subscription data is stored on your device using Chrome's built-in storage
• Encrypted sync: If you sync between devices, your data is encrypted on your device before upload using AES-256-GCM. The key is derived from your account ID and is not stored on our servers
• No identity required: You don't need an email or name to use SOVA. Your account is a random 24-character string
• Hashed references: When we need to reference a subscription server-side (e.g. to prevent duplicate reminders), we store a keyed HMAC hash. We can't reverse it to get the subscription name
• Short-lived cloud data: Sync snapshots delete after 7 days of inactivity; transfer codes expire after 24 hours
• Blockchain log: Certain actions write a hash to Solana as a timestamped record — no subscription content goes on-chain

2.0 What Stays on Your Device

This stuff never leaves your machine. It's stored using Chrome's built-in storage API, which means it lives in your browser's profile folder, encrypted at rest by your OS.

2.1 What Touches Our Servers

We keep this list as small as possible. Here's every single thing our server (Supabase) stores, and what state it's in:

2.2 What We Never See

Just to be completely explicit about it:

3.0 How Sync Works

When you want your subscriptions on multiple devices, here's the step-by-step of what actually happens:

3.1 Encryption Details

For the technically curious, here's exactly what's going on under the hood:

• Algorithm: AES-256-GCM via the Web Crypto API (the same standard used by banks and governments)
• Encryption key: Derived from your account ID using PBKDF2 (100,000 iterations, SHA-256, fixed salt). The key is never stored — it is re-derived on your device each time it is needed
• IV: A fresh random 12-byte initialization vector for every single encryption operation, so identical data produces different ciphertext each time

3.2 When Data Gets Deleted

We auto-delete cloud data so we're holding onto as little as possible at any given time:

3.3 Solana Transparency

For certain actions — syncing, sending reminders, generating transfer codes — SOVA writes a hash to Solana as a timestamped record. This gives you an external reference point to check that an action happened at a given time.

3.3.1 What Gets a Proof

• Sync to/from cloud — hash of the encrypted sync payload
• Account registration — hash of the registration request
• Sending a reminder — hash of the reminder request
• Transfer codes, email verification, cancellation intents — hash of each request

3.3.2 Transaction Logs

In Settings, you'll find a Transaction Logs section. It shows your recent proofs — each one has a label (like "Sync to cloud" or "Reminder: Netflix"), a Solana signature, and a link to the Explorer so you can verify it yourself. You can filter by category. The log is stored locally (last 100 entries), and sync entries are hidden by default to keep things clean.

3.3.3 What Solana Does and Doesn't Prove

Let's be honest about the limits. Solana proofs are a public audit trail — they prove that a specific payload hash was committed at a specific time. That's genuinely useful for trust and accountability. But they don't prove that we later deleted data on schedule, or that our server handled things correctly beyond matching the commitment. We're transparent about that because we'd rather be upfront than oversell.

4.0 Page Detection Engine

This is the core of SOVA — how it figures out you're on a subscription checkout page. Everything here runs entirely in your browser. No data gets sent anywhere during detection.

4.0.1 How It Works

When you visit any webpage, SOVA's content script runs a multi-layered analysis:

• URL classification: It checks if the URL looks like a checkout, pricing, settings, feed, article, or other page type based on the path and subdomain
• DOM inspection: It looks for payment forms — Stripe elements, card number inputs, PayPal buttons, checkout forms. These are "hard evidence" that a real payment is happening
• Content analysis: It scans the page text for recurring billing language ($X/month, auto-renews, billed annually), subscription CTAs, and price-frequency patterns
• Negative signal detection: It also looks for reasons NOT to trigger — job listings, social feeds, e-commerce carts for physical goods, donation pages, one-time purchases, pricing comparison pages

4.0.2 The Scoring System

Each signal gets a weighted score based on what type of page it appears on. A payment form on a checkout URL is worth a lot. Marketing buzzwords on a blog are worth very little. The total score has to clear a threshold, and then it goes through a series of verification gates:

• Pricing Page Gate: Multiple plan cards or heavy comparison language? That's a pricing page, not a checkout — blocked
• Payment Gate: No actual payment form detected? No detection. A page must have real card inputs, Stripe, or PayPal to trigger
• Recurring Gate: No recurring billing language? Probably a one-time purchase — blocked
• One-Time Purchase Gate: Page explicitly says "does not auto-renew" or "one-time gift"? Not a subscription — blocked
• Donation Gate: Dominated by donation language? Recurring donations aren't subscriptions — blocked
• Ecommerce Gate: Overwhelmingly a physical goods checkout with just a membership ad in the corner? That's not a subscription checkout — blocked
• Payment Confidence Dampening: When a real payment form exists, marketing noise in footers and sidebars carries much less weight. Hard evidence (DOM) outranks soft evidence (text patterns)

4.1 Gmail Import

You can connect your Google account(s) and SOVA will scan your emails to find subscriptions you might have missed. Here's how it works and what we can and can't see:

4.1.1 How Gmail Scanning Works

4.1.2 Multiple Accounts

You can connect as many Google accounts as you want. Each one gets its own OAuth token stored locally on your device. You can scan any of them independently, and disconnect them at any time. When you disconnect an account, its token is deleted from local storage immediately.

4.2 Email Reminders

SOVA can email you a heads-up before a trial ends or a payment renews. Here's how that works — and the one place where we're not fully zero-knowledge:

• Your email address is stored locally only and never saved on our servers
• When it's time to send a reminder, the extension sends the payload (email, subscription name, amount, days until event) to our Supabase Edge Function, which forwards it to SendGrid for delivery
• This is the one step where our server briefly sees your data in transit. It processes the payload to send the email, then discards it. We don't log, store, or retain any of that content
• We're upfront about this because we'd rather be honest than claim something we can't prove

Deduplication

Nobody wants the same reminder email three times. To prevent that, we generate a transaction ID:

Using the event date (not today's date) means you get exactly one email per billing event, no matter how many times you open the extension. Once it's marked "sent," it won't fire again for that event.

4.3 Cancellation Flow

When you hit "Cancel" on a subscription, SOVA tries to take you directly to the right cancellation page. Here's the priority order:

1. Check a local database of 300+ known cancellation URLs (Netflix, Spotify, Adobe, etc.)
2. Try fuzzy matching for typos and variations (so "Netflixx" still works)
3. Check a local AI cache of links discovered in the past 30 days
4. If nothing matches, ask OpenAI for the cancellation page (only the service name is sent — nothing else)
5. Cache that AI result locally for 30 days so we don't have to ask again
6. Fall back to the subscription's source URL as a last resort

After redirecting you, a confirmation overlay asks "Done cancelling?" so SOVA can track whether you actually went through with it.

4.4 Cross-Device Cancellation

Reminder emails include a "Cancel" button. Say you get a reminder on your phone and want to cancel right there — even without the extension installed. Here's what happens:

5.0 Why We Ask for These Permissions

Chrome extensions have to declare their permissions upfront. Here's every permission SOVA requests and exactly why: