SubZero: Privacy-First Subscription Detector (Open Source Alternative to Rocket Money)

I’m 14 and I built an open-source tool that finds every subscription in your bank statement — without Plaid, without storing your data, and without selling your financial history.

SubZero is a Next.js web app where you upload a PDF or CSV bank statement. It scans everything in memory and returns a detailed report of recurring charges, price hikes, and cancellation options.

The Problem

People waste hundreds of dollars every year on forgotten subscriptions. Commercial tools like Rocket Money and Trim solve this by connecting directly to your bank via Plaid — which means giving a third party your login credentials and full financial data.

That’s a privacy nightmare.

SubZero’s Approach

Upload → Scan in memory → Delete. No accounts. No persistent storage. Your data never leaves the server except in the response.

It uses 8 detection methods running in parallel for high accuracy:

Keyword + fuzzy matching (Fuse.js)
Time-delta and amount clustering
500+ vendor database (including local services like JazzCash, Daraz, Foodpanda)
Trigram index + Double Metaphone phonetic matching
Business/SaaS usage-based detection
Cross-report comparison for price hikes and cancellations

Key Features

Privacy by design — Zero data persistence. PII scrubbing (SSNs, account numbers, etc.).
Multi-format support — CSV + PDF (using mupdf).
Smart heuristics — Detects truncated vendor names, variable SaaS charges, and single-occurrence subscriptions.
Optional LLM — Only anonymized hints sent. Cancel URLs restricted to safe whitelist.
5-layer upload security — Validation, sanitization, magic bytes, size limits.
Multi-upload mode — Compare statements across months automatically.
One-click Vercel deploy — No database required.

Architecture Deep Dive

The core is a 10-stage pipeline:

Rate limiting + Upload validation (5 layers)
Parsing (CSV via Papaparse, PDF via mupdf)
PII scrubbing + bank detection
Heuristics Engine (8 parallel methods)
Confidence scoring (0-100 based on 8 signals)
Merge + deduplication
Enrichment (actions, health score A-F)
Optional LLM normalization
Report generation
Response (JSON + optional PDF export)

The entire engine lives in lib/audit/. It’s designed to be easy to extend with new heuristics or vendor patterns.

Security Model

Per-IP rate limiting
Zod schema validation at every boundary
Strict PII regex scrubbing
CSP, HSTS, and other security headers
Body size limits (max 11MB)

Competitor Comparison

Tool	Bank Login	Cost	Open Source	Privacy
SubZero	No	Free	Yes	Zero persistence
Rocket Money	Yes (Plaid)	$6–12/month	No	Full data shared
Trim	Yes (Plaid)	% of savings	No	Full data shared
SubFind	No	One-time	No	Closed source