1-Click Pay Comes to SubGrab: Why We Save Your Card (and How You Stay in Control)

Starting this week, SubGrab supports 1-click repurchase. Save your card when you buy a credit pack, and your next purchase takes a single tap — no Stripe redirect, no card re-entry.

Update, 28 October 2026: saving your card is now your choice. Stripe's checkout page shows an unticked "Save my payment information for future purchases" box; 1-click is turned on only if you tick it, and nothing is saved if you don't. Every purchase is still a one-time payment.

This is a transparency post. We want you to know exactly what changed, what we store, and how you stay in control.

What Changed

Before: Every credit purchase took you through Stripe Checkout — paste card, click pay, redirect back to SubGrab.

Now:

• First purchase: Same as before — Stripe Checkout, you enter your card. Tick "Save my payment information" on that page and the card is saved with Stripe (not with us).
• Every purchase after that, with a saved card: A single tap in the app. The "Buy" button charges your saved card immediately and adds credits to your account in under a second.

What SubGrab Stores About Your Card

We store up to five things, none of which can be used to charge your card directly:

1. Stripe Customer ID — a long opaque string like cus_NeGfWQyqOlk8eY. Identifies you to Stripe, so your receipts stay together.

2. Stripe PaymentMethod ID — a string like pm_1NlIa1JQ3HrUPGDP9zk2hSGn. Refers to your saved card inside Stripe's vault. Only if you saved the card.

3. Card brand — "Visa", "Mastercard", etc. Used to display "Visa •••• 4242" in your dashboard. Only if you saved the card.

4. Last 4 digits — for the same display purpose. Only if you saved the card.

5. Card fingerprint — Stripe's one-way identifier for a card number. It cannot be turned back into the number; it is used only to refuse an invite reward when both accounts pay with the same card (Terms §7), so it is kept for the card that paid, saved or not.

We never see, store, or process your full card number, CVV, or expiry. Those go straight from your browser to Stripe (PCI Level 1 certified) and stay there.

How 1-Click Charging Works Under the Hood

When you click "Buy" with a saved card:

1. Your browser POSTs the pack you want to /api/stripe/repurchase on SubGrab.

2. SubGrab tells Stripe: "charge this customer's saved card for this amount — they just pressed Buy."

3. Stripe runs the charge through the same fraud protection (Radar) and authentication (3-D Secure) systems as the original purchase.

4. If Stripe approves: credits land in your account in ~300ms, and Stripe emails you a receipt.

5. If Stripe declines, or your bank asks you to confirm the payment: nothing is charged, and you're sent to Stripe Checkout to finish the purchase there.

The card is saved with Stripe's save-during-payment feature, and only if you tick "Save my payment information" at checkout. Each 1-click charge is made while you are on the page and have just pressed Buy, which is how Stripe and the card networks record it.

How to Remove Your Saved Card

We made this exactly as easy as adding it:

1. Sign in.

2. Go to your Dashboard.

3. Below your credit count, you'll see "1-click enabled with Visa •••• 4242".

4. Click Remove.

When you remove the card:

• We tell Stripe to detach the PaymentMethod from your customer record.
• We clear the brand + last-4 from our database.
• We keep your Stripe Customer ID. This is intentional — if you ever buy again, we re-use the same customer record (so your payment history and receipts stay together).

If you want your Stripe Customer record fully deleted, email help@subgrab.com and we'll forward the request to Stripe.

What If My Card Gets Compromised?

Two safety nets:

1. You can remove the saved card any time from your dashboard (see above). Once removed, future purchases require re-entering card details.

2. Stripe's fraud protection still runs on every 1-click charge. If Stripe Radar flags the transaction, the charge fails and you get redirected to Checkout for re-authentication. We never override Stripe's risk decisions.

Why We Built This

SubGrab's pricing model is "credit packs" — you buy a pack when you need credits, no subscription. The downside of that model is that the second purchase has more friction than the first (you've already entered card details once; doing it again feels redundant).

1-click pay removes that friction. Save your card once, and every subsequent purchase respects your time.

What This Doesn't Change

• No auto-renewal. SubGrab still has zero subscriptions and zero recurring charges. We will never charge your saved card without you clicking "Buy" first.
• No price changes from 1-click pay launch. Credit packs: $3.99 / $5.99 / $11.99 / $22.99 / $44.99 (prices last updated 2026-09-17).
• No new data collection. We added 4 columns to our database (customer ID, PM ID, card brand, last 4); a fifth, the card fingerprint, followed in October 2026 for the invite program's same-card rule. We did not add tracking, analytics, or any other "telemetry."

FAQ

Is my card really secure?

Yes. Stripe is PCI Level 1 (the highest standard). Your card data never touches SubGrab's servers — your browser sends it directly to Stripe's vault, and we only get back opaque tokens.

Can I have multiple saved cards?

Not yet. The current implementation saves one card as your default. If you'd like multi-card support, let us know at help@subgrab.com.

What happens if my card expires?

The next 1-click purchase will fail with a "card declined" message and redirect you to Stripe Checkout, where you can update the card on file.

Does this work for the first purchase too?

The very first purchase always goes through Stripe Checkout (so you can enter the card). After that, 1-click is on if you ticked "Save my payment information" there.

Why didn't you launch with this from day one?

Honesty answer: we didn't have it built. 1-click pay requires schema changes, a new payment-intent flow, off-session error handling for 3-D Secure, and webhook idempotency for the race between the synchronous DB write and the webhook fallback. Building it right took a focused sprint.

Where can I see all my past purchases?

Dashboard → Payment History. Every purchase has a Stripe-hosted receipt link.

Want 1-click? Tick "Save my payment information" at your next checkout, and the purchase after that will be a single tap.

If you have questions about any of this, reply to any SubGrab email or write to help@subgrab.com.

Top up with 1-click — credit packs from $3.99.