Skip to content

Sumama-Jameel/subzero

Repository files navigation

SubZero

License: Apache 2.0 Next.js TypeScript Tests

Open source alternative to Rocket Money, Trim, and SubFind. Upload your bank statement. Find every subscription. Zero data stored.


What This Solves

The average American spends $219 a month on subscriptions — across 8.2 different services. But ask them how much they spend, and they'll say $86. That's a 2.5x gap. They have no idea what they're actually paying.

It gets worse:

  • 42% of Americans have paid for subscriptions they completely forgot about
  • $27.7 billion is drained from US consumers every year on forgotten subscriptions
  • The average household wastes $273 a year on services they don't use
  • The global subscription economy hit $536 billion in 2025 and is growing fast

Most people turn to apps like Rocket Money or Trim to fix this. But those apps work through a company called Plaid — a data aggregator that logs into your bank account using your actual username and password. Plaid has faced multiple lawsuits over data privacy violations. They've been caught showing fake login screens that look exactly like your bank's page, but are wholly controlled by Plaid. They collect way more data than they need.

That's a bad deal.

SubZero is different. You upload your bank statement as a PDF or CSV file. We scan it in memory. No data is stored. No one logs into your bank account. No Plaid. When you close the page, your data is gone. We find the same subscriptions Rocket Money finds — without sacrificing your privacy.

And it's free. Not a subscription to find your subscriptions.


What We Need

You.

SubZero is open source because subscription tracking should be private by default, not a business model built on selling your financial data.

Here's how you can help:

  • Try it. Upload a statement. See what it finds. Open an issue if something breaks.
  • Add a vendor. Our vendor database is the backbone of detection. If your bank has a strange way of writing "Netflix" on your statement, add the pattern.
  • Tell a friend. The person paying $30/month for a gym they haven't visited since January.

That's it. That's the whole thing.


Quick Start

# Clone
git clone https://github.com/Sumama-Jameel/subzero.git
cd subzero

# Install
npm install

# Development
npm run dev

# Open http://localhost:3000
# Upload a CSV or PDF bank statement

Features

  • 8 detection methods running in parallel. Keyword matching, fuzzy name matching (Fuse.js), time-delta clustering, amount clustering, hard vendor match, 500+ vendor database lookup, trigram inverted index, and Double Metaphone phonetic matching. We throw everything at the problem.

  • Offline vendor database. 500+ known subscription services built into the code. Zero API calls. Zero cost. Works without internet. Every Netflix, Spotify, Adobe, AWS, and local Pakistani service like JazzCash, Daraz, and Foodpanda are in there.

  • Privacy-first architecture. No database. No user accounts. No background jobs. No data aggregation. Your statement is processed in server memory and returned in the HTTP response. That's it.

  • Multi-upload comparison. Upload this month's statement, then next month's. SubZero detects price hikes, new subscriptions, and cancelled ones automatically. No manual tracking.

  • Business mode. Usage-based SaaS detection (AWS, DigitalOcean, Twilio — charges that vary month to month). Domain and SSL renewal detection. Bank-pattern matching for truncated vendor names that keyword search misses.

  • LLM optional, off by default. The engine finds subscriptions without any AI. If you choose to enable the LLM, only anonymized vendor name hints are sent — no dollar amounts, no personal data, no bank descriptions. Cancel URLs are restricted to a pre-approved whitelist of 400+ domains.

  • 5-layer upload security. Filename sanitization, extension validation, size limits, MIME type checking, and magic byte verification. We don't trust the file until every layer passes.

  • PII scrubbing. SSNs, EINs, ABNs, account numbers, and phone numbers are detected and sanitized before anything leaves the server.

  • Zero-config deployment. Works on Vercel with one click. No database to set up. No environment variables to configure. Just deploy.


Architecture

                    ┌─────────────────────────────────────┐
                    │         POST /api/audit              │
                    │                                     │
                    │  Rate Limit → Upload Validate →     │
                    │  Zod Schema → Engine Pipeline        │
                    └────────────┬────────────────────────┘
                                 │
                    ┌────────────v────────────────────────┐
                    │         AUDIT ENGINE                 │
                    │                                     │
                    │  ┌──────────────────────────────┐   │
                    │  │       PARSER                  │   │
                    │  │  CSV: Papaparse               │   │
                    │  │  PDF: mupdf4llm               │   │
                    │  │  Column detection             │   │
                    │  │  Bank detection               │   │
                    │  │  PII scrubbing                │   │
                    │  └──────────────┬───────────────┘   │
                    │                 │                    │
                    │  ┌──────────────v───────────────┐   │
                    │  │      HEURISTICS ENGINE       │   │
                    │  │                              │   │
                    │  │  ┌──────┐ ┌─────┐ ┌──────┐ │   │
                    │  │  │Keyword│ │Fuzzy│ │Time- │ │   │
                    │  │  │match  │ │match│ │delta  │ │   │
                    │  │  └──┬───┘ └──┬──┘ └──┬───┘ │   │
                    │  │     │        │       │      │   │
                    │  │  ┌──v────────v───────v───┐ │   │
                    │  │  │ Amount   │ Vendor  DB │ │   │
                    │  │  │ Cluster  │ Trigram    │ │   │
                    │  │  │          │ Phonetic   │ │   │
                    │  │  └──────────┴───────────┘ │   │
                    │  └──────────────┬───────────────┘   │
                    │                 │                    │
                    │  ┌──────────────v───────────────┐   │
                    │  │   CONFIDENCE SCORER          │   │
                    │  │   8 signals → 0-100 score    │   │
                    │  │   Merge + dedup candidates   │   │
                    │  └──────────────┬───────────────┘   │
                    │                 │                    │
                    │  ┌──────────────v───────────────┐   │
                    │  │   ACTIONS + HEALTH SCORE     │   │
                    │  │   Prioritize: keep/negotiate │   │
                    │  │   /review/cancel_now         │   │
                    │  │   Health grade A-F           │   │
                    │  └──────────────┬───────────────┘   │
                    └─────────────────│──────────────────┘
                                      │
                    ┌─────────────────v──────────────────┐
                    │         RESPONSE                    │
                    │   { report, debug, processingTime } │
                    └────────────────────────────────────┘

The 10-stage pipeline: Upload → Validate → Parse → Filter → Detect (8 methods) → Score → Merge → Enrich → Action → Report.


Competitor Comparison

SubZero is the open source alternative to every app on this list.

App Bank Login Required Cost Open Source Privacy
SubZero No Free Yes Full — zero persistence, no data stored
Rocket Money Yes (Plaid) $6–12/month No Shares full financial history with Plaid
Trim Yes (Plaid) Percentage of savings No Shares full financial history with Plaid
SubFind No $12.99 one-time No Claims privacy, closed source
Subtracker No $12.99 one-time No Claims privacy, closed source
Subpilot Yes (Plaid or email) $12/month No Full email + bank access
Bobby No $2.99 one-time No Manual entry only — no auto detection
YNAB Yes (Plaid) $14.99/month No Full budgeting platform, needs bank access
Skwad No Free No Email-based transaction syncing
TrackMySubs No Free/$8.99/yr No Manual entry mostly

The Plaid problem unites all of them. Even the ones that don't require Plaid use similar data aggregators or manual entry that misses subscriptions. Rocket Money dominates the market by being aggressive — but that aggressiveness is why privacy-conscious users are looking for an alternative.

SubZero is that alternative. Same detection power. No data exposure.


Security Model

Layer Mechanism
Rate limiting Per-IP sliding window + global cap. Prevents abuse.
Upload validation 5 layers: filename, extension, size, MIME, magic bytes
Input schema validation Zod schemas at every data boundary (transactions, LLM responses, previous reports)
PII scrubbing Regex detection for SSN, EIN, ABN, account numbers, phone numbers
LLM privacy Only anonymized vendor hints sent — no amounts, no IDs, no descriptions
LLM output validation Cancel URL domain whitelist (400+ approved domains). Rejects injected URLs.
Response headers HSTS, X-Content-Type-Options, X-Frame-Options, CSP, Permissions-Policy
Body size limit 11 MB max — rejects oversized uploads before processing

Project Structure

src/
├── app/
│   ├── api/
│   │   ├── audit/route.ts         # POST /api/audit — the main endpoint
│   │   └── export-pdf/route.ts     # POST /api/export-pdf — PDF report generation
│   ├── layout.tsx                  # Root layout
│   └── page.tsx                    # Main page
├── components/                     # React UI components
│   ├── dashboard/                  # Dashboard views (category, savings, actions)
│   ├── landing/                    # Landing page sections
│   └── ui/                         # Reusable UI primitives
├── hooks/                          # React hooks + Zustand state
├── lib/
│   ├── audit/                      # Core detection engine
│   │   ├── engine.ts               # Pipeline orchestrator
│   │   ├── parser.ts               # CSV/PDF statement parser
│   │   ├── heuristics.ts           # 8 detection methods (2681 lines)
│   │   ├── detection-index.ts      # Trigram + Double Metaphone index
│   │   ├── vendor-db.ts            # 500+ vendor database
│   │   ├── confidence-scorer.ts    # 8-signal confidence scoring
│   │   ├── behavioral-analysis.ts  # Anti-noise statistical module
│   │   ├── schemas.ts              # All Zod validation schemas
│   │   ├── pii-guard.ts            # PII detection and scrubbing
│   │   ├── upload-guard.ts         # 5-layer upload validation
│   │   ├── price-hikes.ts          # Cross-report price hike detection
│   │   ├── health-score.ts         # Health grade A-F calculation
│   │   ├── single-occurrence.ts    # Language-agnostic single-tx detection
│   │   ├── cancel-guidance.ts      # Step-by-step cancel instructions
│   │   ├── overlap-utils.ts        # Duplicate service detection
│   │   ├── smb-heuristics.ts       # Business-mode detection extensions
│   │   ├── llm-normalize.ts        # Optional LLM vendor normalization
│   │   └── currency-utils.ts       # Multi-currency formatting + conversion
│   ├── extraction/                 # PDF text extraction
│   │   └── client.ts               # mupdf-based extraction
│   └── middleware/
│       └── rate-limit.ts           # In-memory rate limiter
├── types/
│   └── index.ts                    # Single source of truth for all types
└── views/                          # Page layout components

Test

# Run all tests (node:test — zero dependencies)
node --test

Tests cover the detection pipeline, parser, LLM normalization fix, cancel guidance fix, report history validation, and price hike edge cases.


Building for Production

npm run build       # Next.js production build
npm run start       # Start production server
npm run lint        # ESLint check

Deploys to Vercel with zero configuration needed.


Also Check Out

Nexus Engine — One command to set up any dev machine. Detects your OS, installs packages, manages dotfiles, sets up WSL2 in 60 seconds. Go from fresh OS to productive environment without the headache.


License

This project is licensed under the Apache License 2.0.

Copyright 2026 SubZero Contributors.

Built as the open source, privacy-first alternative to subscription tracking apps that sell your data. No Plaid. No bank login. No excuses.

About

Find every subscription in your bank statement. Privacy first, zero data stored. Open source alternative to Rocket Money/Trim.

Resources

License

Stars

0 stars

Watchers

0 watching

Forks

Releases

No releases published

Packages

 
 
 

Contributors