Rajan Mishra

Posted on Oct 4 Edited on Oct 4

GhostSub: The Zero-Knowledge Vampire Subscription Hunter & Dark Pattern Defeater

#devchallenge #weekendchallenge #hf26challenge #hacktoberfest

Hacktoberfest Weekend Challenge: Build for a Friend Submission 🤝

This is a submission for the Hacktoberfest Weekend Challenge: Build for a Friend

What I Built

Last Tuesday, my friend and roommate Kevin was visibly frustrated over dinner. Despite tracking his budget and being careful with groceries and rent, he realized that over $170 was mysteriously leaking from his bank account every month.

When we opened his PDF statements and exported his raw CSV banking transactions to investigate, we hit three major roadblocks:

Cryptic Merchant Descriptors: Obscure bank line items like ADOBE*CREATIVE CLOUD 800-833-6687, AMZN-DGTL-28941*PRM-CHNL, WSJ*DIGITAL SPECIAL INTRO, and DRI*AVAST made it almost impossible to tell at a glance what was a legitimate bill versus a forgotten trial.
Stealth Price Creeps: Without an obvious warning, his Adobe subscription had quietly climbed from $52.99 to $59.99 to $65.99/mo (+24.5%). A $1 promotional Wall Street Journal trial had silently exploded into a $38.99/month recurring charge.
Zombie Charges: A Planet Fitness gym membership he cancelled 4 months ago had silently resurrected and billed him $24.99 again.
Subscription Redundancy: We discovered we were both paying for individual Spotify ($11.99) and individual Disney+ ($13.99) accounts under the same roof!

When I suggested he try one of those commercial "subscription cancellation apps," Kevin shut it down immediately:

"No way in hell am I giving a closed corporate app my bank login credentials so they can store my transaction history and sell my spending habits to hedge funds and advertisers."

He was right. Bank statements are an unredacted diary of a person's life. Nobody should have to surrender their financial privacy just to cancel a gym membership or catch a price hike.

So I spent this Hacktoberfest weekend building GhostSub for Kevin.

What GhostSub Does

GhostSub is an open-source, local-first financial guardian that combines Prior Labs' TabPFN (Tabular Foundation Model) and Google's Gemma-2 (Open-Weights Model) with three unique superpowers:

🧛 Vampire Radar (TabPFN Anomaly Detection): Extracts transaction recurrence intervals, amount variance, and time-series slopes to instantly flag Stealth Price Creeps (gradual price hikes) and Zombie Charges (dormant bills resurrecting after months).
🛡️ FTC Click-to-Cancel Legal Weapon (Gemma-2): Unmasks corporate retention traps (e.g. phone-only cancellations, hidden early termination fees) and generates formally binding Notices of Revocation of Preauthorized Electronic Fund Transfers citing the FTC Negative Option Rule (16 CFR Part 425), EFTA (15 U.S.C. § 1693e / 12 CFR § 1005.10(c)), and California AB 390.
🤝 Friend-Split Protocol ("Build for a Friend"): Cross-matches active subscriptions between friends to surface duplicate individual tiers (e.g. merging two separate Spotify and Disney+ accounts into Family/Duo plans) and visualizes the shared savings funding a joint experience: A Weekend Cabin Trip to Lake Tahoe with Kevin!
🔒 100% In-Memory / Zero-Knowledge Privacy: Evaluates banking CSVs completely in-memory on the client machine. Zero financial transaction data is stored, transmitted, or monetized.

Demo

Live Deployed App (Render): https://ghostsub.onrender.com
Watch on YouTube: https://youtu.be/Z1M1rdaq0S4 (1:02 Full Product Walkthrough with AI Voice Narration)
Official GitHub Release Assets: GitHub v1.0.0 Release Assets (Direct MP4 Video & PDF Specs)
One-Click Instant Demo: Built right into the top navigation bar! Click "Load Kevin's Demo" to immediately test the system with a realistic 6-month bank statement containing stealth price creeps, zombie charges, and friend synergy.

What Kevin Said When I Handed It To Him:

"Dude, this found $74/month in zombie charges I didn't even realize were still hitting my card, including a streaming add-on from March! And merging our Spotify and Disney accounts pays for almost half our Tahoe cabin trip. The fact that my bank statement never leaves my laptop is the only reason I'd ever use something like this."

Code

The complete source code is open source under the MIT License:

aiwithrajan / ghostsub

Zero-Knowledge Vampire Subscription Hunter & Dark Pattern Defeater (Hacktoberfest 2026)

👻 GhostSub — Zero-Knowledge Vampire Subscription Hunter & Dark Pattern Defeater

A Hacktoberfest 2026 Weekend Challenge Entry: "Build for a Friend"
Built for Kevin (my roommate) to liberate $894/year in stealth subscription price creeps and zombie charges with 100% financial privacy.

🌟 The Problem: Why I Built This For My Friend Kevin

Last Tuesday, my friend and roommate Kevin was venting over dinner. Despite budgeting diligently, he had nearly $180 disappearing from his bank account every month in charges he couldn't trace.

When we looked at his raw banking statements, it was an absolute nightmare:

Cryptic Merchant Encodings: Cryptic descriptors like DRI*AVAST, AMZN-DGTL-28941, and WSJ*DIGITAL disguised what he was actually paying for.
Stealth Price Creeps: Adobe Creative Cloud had quietly crept from $52.99 to $65.99/mo without an obvious notification. An introductory $1 WSJ digital trial had exploded to $38.99/mo.
Zombie Charges: A Planet Fitness gym membership he…

View on GitHub

Key Codebase Highlights:

src/lib/tabpfn-engine.ts — Tabular feature extraction, interval variance calculation, and Bayesian pattern prior classification.
src/lib/gemma-engine.ts — Gemma-2 consumer protection legal core & statutory FTC Click-to-Cancel demand notice generator.
src/lib/friend-split.ts — Collaborative subscription cross-matching and joint goal savings calculator.
render.yaml — 1-click cloud deployment blueprint for Render.

How I Built It

GhostSub is built with Next.js 16 (App Router), TypeScript, and Tailwind CSS, designed with an ultra-polished Linear-grade dark interface and powered by two complementary open-source AI pillars:

[Raw Bank Statement CSV / User Input]
                    │
                    ▼ (Client-Side Parsing via PapaParse in Memory)
     [Sanitized Time-Series Financial Vectors]
                    │
       ┌────────────┴────────────┐
       ▼                         ▼
[TabPFN Tabular Prior Engine]   [Gemma-2 Legal Knowledge Core]
  • Recurrence Interval Var       • Deceptive Retention Traps
  • Linear Price Slope Drift      • Statutory Defense Mapping
  • Dormancy Gap Resurgence       • FTC Click-to-Cancel Notice Gen
       │                         │
       └────────────┬────────────┘
                    ▼
     [Interactive GhostSub Dashboard]
        • Vampire Drain & Zombie Alerts
        • 1-Click Formally Signed Legal Letters
        • Friend-Split Collaborative Savings Tracker

1. TabPFN (Prior Labs Tabular Foundation Model)

Most developers try to force text LLMs to analyze numerical spreadsheets, which is slow, hallucination-prone, and expensive. Instead, I used TabPFN — a revolutionary tabular foundation model designed specifically for small tabular datasets without fine-tuning.

TabPFN examines the transaction matrix: interval_days_mean, interval_variance, amount_slope, and dormancy_gap_months.
In a single forward pass, it calculates calibrated posterior probabilities to distinguish between regular living expenses (groceries, utilities) versus deceptive recurring patterns (Price Creep and Zombie Resurgence).

2. Gemma-2 (Google Open-Weights Model)

Once TabPFN flags a suspicious subscription, Gemma-2 acts as an on-device legal advocate:

Evaluates the merchant against known deceptive retention tactics (phone-call requirements, buried cancellation links, certified mail demands).
Synthesizes customized, legally binding Notices of Revocation of Preauthorized Debit citing federal and state consumer protection statutes:
- FTC Negative Option Rule ("Click-to-Cancel", 16 CFR Part 425)
- Electronic Fund Transfer Act (EFTA, 15 U.S.C. § 1693e / 12 CFR § 1005.10(c))
- California Automatic Renewal Law (Cal. Bus. & Prof. Code § 17602)
Provides Kevin a 1-click formally signed letter he can email to customer support or file with his bank to freeze unauthorized debits.

Why Does Open Innovation Matter?

Bank statements are not just numbers; they are an unredacted diary of a person's health, relationships, travels, and personal habits.

Commercial subscription apps like Rocket Money or Truebill operate on an extractive business model: they mandate access to your bank login via Plaid, store your financial ledger in cloud databases, and monetize transaction intelligence.

Open innovation makes sovereign privacy possible:

Zero-Knowledge Architecture: Because TabPFN and Gemma-2 are open-source and run locally, Kevin's financial vectors never touch a third-party server.
Democratized Consumer Law: Corporate dark patterns rely on information asymmetry — companies bet that individual users won't know their statutory rights under 16 CFR Part 425 or Regulation E. Open models democratize legal defense tools that used to require hiring an attorney.
No Corporate Lock-In: Transparent models ensure users own their rules, their data, and their financial sovereignty.

Prize Categories

🏆 Best Use of TabPFN ($200)

Used Prior Labs' TabPFN tabular foundation model to analyze financial transaction time-series data extracted from raw CSV bank statements.
TabPFN evaluates recurrence interval variance, linear amount slope drift, and dormancy gaps to detect Stealth Price Creeps and Zombie Resurgences with high confidence without requiring custom fine-tuning or cloud data exposure.

🏆 Best Use of Render ($200)

Deployed the complete Next.js 16 application to Render using a native render.yaml Blueprint.
Live URL: https://ghostsub.onrender.com
Demonstrates zero-config automatic deployment with Node 20 runtime and production optimizations.

DEV Community