Open source alternative to Rocket Money, Trim, and SubFind. Upload your bank statement. Find every subscription. Zero data stored.
The average American spends $219 a month on subscriptions — across 8.2 different services. But ask them how much they spend, and they'll say $86. That's a 2.5x gap. They have no idea what they're actually paying.
It gets worse:
- 42% of Americans have paid for subscriptions they completely forgot about
- $27.7 billion is drained from US consumers every year on forgotten subscriptions
- The average household wastes $273 a year on services they don't use
- The global subscription economy hit $536 billion in 2025 and is growing fast
Most people turn to apps like Rocket Money or Trim to fix this. But those apps work through a company called Plaid — a data aggregator that logs into your bank account using your actual username and password. Plaid has faced multiple lawsuits over data privacy violations. They've been caught showing fake login screens that look exactly like your bank's page, but are wholly controlled by Plaid. They collect way more data than they need.
That's a bad deal.
SubZero is different. You upload your bank statement as a PDF or CSV file. We scan it in memory. No data is stored. No one logs into your bank account. No Plaid. When you close the page, your data is gone. We find the same subscriptions Rocket Money finds — without sacrificing your privacy.
And it's free. Not a subscription to find your subscriptions.
You.
SubZero is open source because subscription tracking should be private by default, not a business model built on selling your financial data.
Here's how you can help:
- Try it. Upload a statement. See what it finds. Open an issue if something breaks.
- Add a vendor. Our vendor database is the backbone of detection. If your bank has a strange way of writing "Netflix" on your statement, add the pattern.
- Tell a friend. The person paying $30/month for a gym they haven't visited since January.
That's it. That's the whole thing.
# Clone
git clone https://github.com/Sumama-Jameel/subzero.git
cd subzero
# Install
npm install
# Development
npm run dev
# Open http://localhost:3000
# Upload a CSV or PDF bank statement-
8 detection methods running in parallel. Keyword matching, fuzzy name matching (Fuse.js), time-delta clustering, amount clustering, hard vendor match, 500+ vendor database lookup, trigram inverted index, and Double Metaphone phonetic matching. We throw everything at the problem.
-
Offline vendor database. 500+ known subscription services built into the code. Zero API calls. Zero cost. Works without internet. Every Netflix, Spotify, Adobe, AWS, and local Pakistani service like JazzCash, Daraz, and Foodpanda are in there.
-
Privacy-first architecture. No database. No user accounts. No background jobs. No data aggregation. Your statement is processed in server memory and returned in the HTTP response. That's it.
-
Multi-upload comparison. Upload this month's statement, then next month's. SubZero detects price hikes, new subscriptions, and cancelled ones automatically. No manual tracking.
-
Business mode. Usage-based SaaS detection (AWS, DigitalOcean, Twilio — charges that vary month to month). Domain and SSL renewal detection. Bank-pattern matching for truncated vendor names that keyword search misses.
-
LLM optional, off by default. The engine finds subscriptions without any AI. If you choose to enable the LLM, only anonymized vendor name hints are sent — no dollar amounts, no personal data, no bank descriptions. Cancel URLs are restricted to a pre-approved whitelist of 400+ domains.
-
5-layer upload security. Filename sanitization, extension validation, size limits, MIME type checking, and magic byte verification. We don't trust the file until every layer passes.
-
PII scrubbing. SSNs, EINs, ABNs, account numbers, and phone numbers are detected and sanitized before anything leaves the server.
-
Zero-config deployment. Works on Vercel with one click. No database to set up. No environment variables to configure. Just deploy.
┌─────────────────────────────────────┐
│ POST /api/audit │
│ │
│ Rate Limit → Upload Validate → │
│ Zod Schema → Engine Pipeline │
└────────────┬────────────────────────┘
│
┌────────────v────────────────────────┐
│ AUDIT ENGINE │
│ │
│ ┌──────────────────────────────┐ │
│ │ PARSER │ │
│ │ CSV: Papaparse │ │
│ │ PDF: mupdf4llm │ │
│ │ Column detection │ │
│ │ Bank detection │ │
│ │ PII scrubbing │ │
│ └──────────────┬───────────────┘ │
│ │ │
│ ┌──────────────v───────────────┐ │
│ │ HEURISTICS ENGINE │ │
│ │ │ │
│ │ ┌──────┐ ┌─────┐ ┌──────┐ │ │
│ │ │Keyword│ │Fuzzy│ │Time- │ │ │
│ │ │match │ │match│ │delta │ │ │
│ │ └──┬───┘ └──┬──┘ └──┬───┘ │ │
│ │ │ │ │ │ │
│ │ ┌──v────────v───────v───┐ │ │
│ │ │ Amount │ Vendor DB │ │ │
│ │ │ Cluster │ Trigram │ │ │
│ │ │ │ Phonetic │ │ │
│ │ └──────────┴───────────┘ │ │
│ └──────────────┬───────────────┘ │
│ │ │
│ ┌──────────────v───────────────┐ │
│ │ CONFIDENCE SCORER │ │
│ │ 8 signals → 0-100 score │ │
│ │ Merge + dedup candidates │ │
│ └──────────────┬───────────────┘ │
│ │ │
│ ┌──────────────v───────────────┐ │
│ │ ACTIONS + HEALTH SCORE │ │
│ │ Prioritize: keep/negotiate │ │
│ │ /review/cancel_now │ │
│ │ Health grade A-F │ │
│ └──────────────┬───────────────┘ │
└─────────────────│──────────────────┘
│
┌─────────────────v──────────────────┐
│ RESPONSE │
│ { report, debug, processingTime } │
└────────────────────────────────────┘
The 10-stage pipeline: Upload → Validate → Parse → Filter → Detect (8 methods) → Score → Merge → Enrich → Action → Report.
SubZero is the open source alternative to every app on this list.
| App | Bank Login Required | Cost | Open Source | Privacy |
|---|---|---|---|---|
| SubZero | No | Free | Yes | Full — zero persistence, no data stored |
| Rocket Money | Yes (Plaid) | $6–12/month | No | Shares full financial history with Plaid |
| Trim | Yes (Plaid) | Percentage of savings | No | Shares full financial history with Plaid |
| SubFind | No | $12.99 one-time | No | Claims privacy, closed source |
| Subtracker | No | $12.99 one-time | No | Claims privacy, closed source |
| Subpilot | Yes (Plaid or email) | $12/month | No | Full email + bank access |
| Bobby | No | $2.99 one-time | No | Manual entry only — no auto detection |
| YNAB | Yes (Plaid) | $14.99/month | No | Full budgeting platform, needs bank access |
| Skwad | No | Free | No | Email-based transaction syncing |
| TrackMySubs | No | Free/$8.99/yr | No | Manual entry mostly |
The Plaid problem unites all of them. Even the ones that don't require Plaid use similar data aggregators or manual entry that misses subscriptions. Rocket Money dominates the market by being aggressive — but that aggressiveness is why privacy-conscious users are looking for an alternative.
SubZero is that alternative. Same detection power. No data exposure.
| Layer | Mechanism |
|---|---|
| Rate limiting | Per-IP sliding window + global cap. Prevents abuse. |
| Upload validation | 5 layers: filename, extension, size, MIME, magic bytes |
| Input schema validation | Zod schemas at every data boundary (transactions, LLM responses, previous reports) |
| PII scrubbing | Regex detection for SSN, EIN, ABN, account numbers, phone numbers |
| LLM privacy | Only anonymized vendor hints sent — no amounts, no IDs, no descriptions |
| LLM output validation | Cancel URL domain whitelist (400+ approved domains). Rejects injected URLs. |
| Response headers | HSTS, X-Content-Type-Options, X-Frame-Options, CSP, Permissions-Policy |
| Body size limit | 11 MB max — rejects oversized uploads before processing |
src/
├── app/
│ ├── api/
│ │ ├── audit/route.ts # POST /api/audit — the main endpoint
│ │ └── export-pdf/route.ts # POST /api/export-pdf — PDF report generation
│ ├── layout.tsx # Root layout
│ └── page.tsx # Main page
├── components/ # React UI components
│ ├── dashboard/ # Dashboard views (category, savings, actions)
│ ├── landing/ # Landing page sections
│ └── ui/ # Reusable UI primitives
├── hooks/ # React hooks + Zustand state
├── lib/
│ ├── audit/ # Core detection engine
│ │ ├── engine.ts # Pipeline orchestrator
│ │ ├── parser.ts # CSV/PDF statement parser
│ │ ├── heuristics.ts # 8 detection methods (2681 lines)
│ │ ├── detection-index.ts # Trigram + Double Metaphone index
│ │ ├── vendor-db.ts # 500+ vendor database
│ │ ├── confidence-scorer.ts # 8-signal confidence scoring
│ │ ├── behavioral-analysis.ts # Anti-noise statistical module
│ │ ├── schemas.ts # All Zod validation schemas
│ │ ├── pii-guard.ts # PII detection and scrubbing
│ │ ├── upload-guard.ts # 5-layer upload validation
│ │ ├── price-hikes.ts # Cross-report price hike detection
│ │ ├── health-score.ts # Health grade A-F calculation
│ │ ├── single-occurrence.ts # Language-agnostic single-tx detection
│ │ ├── cancel-guidance.ts # Step-by-step cancel instructions
│ │ ├── overlap-utils.ts # Duplicate service detection
│ │ ├── smb-heuristics.ts # Business-mode detection extensions
│ │ ├── llm-normalize.ts # Optional LLM vendor normalization
│ │ └── currency-utils.ts # Multi-currency formatting + conversion
│ ├── extraction/ # PDF text extraction
│ │ └── client.ts # mupdf-based extraction
│ └── middleware/
│ └── rate-limit.ts # In-memory rate limiter
├── types/
│ └── index.ts # Single source of truth for all types
└── views/ # Page layout components
# Run all tests (node:test — zero dependencies)
node --testTests cover the detection pipeline, parser, LLM normalization fix, cancel guidance fix, report history validation, and price hike edge cases.
npm run build # Next.js production build
npm run start # Start production server
npm run lint # ESLint checkDeploys to Vercel with zero configuration needed.
Nexus Engine — One command to set up any dev machine. Detects your OS, installs packages, manages dotfiles, sets up WSL2 in 60 seconds. Go from fresh OS to productive environment without the headache.
This project is licensed under the Apache License 2.0.
Copyright 2026 SubZero Contributors.
Built as the open source, privacy-first alternative to subscription tracking apps that sell your data. No Plaid. No bank login. No excuses.