Privacy Policy

Who we are

TrialCut is an iOS app published by {{LEGAL_NAME}}, an individual developer trading as TrialCut, at {{POSTAL_ADDRESS}}. For the purposes of the UK and EU General Data Protection Regulation and Thailand's Personal Data Protection Act, we are the data controller for the information described here.

You can reach a person at ckjergu@gmail.com. That address is monitored by the developer named above, not a helpdesk queue.

The short version

This is a summary for orientation. The sections below are the binding detail.

• We ask Google for read-only access to your Gmail so we can find trial signup emails and receipts. We ask for permission to send mail separately, later, and only at the moment you cancel something for the first time.
• We read message bodies during a scan — the dates and amounts are in the bodies, not the subject lines — but we never write one to the database. A body exists in memory for the length of the scan and then it is gone.
• What we keep from your inbox is a short list of facts: a merchant name, a plan name, an amount, a currency, some dates, and message identifiers. Plus, once a merchant confirms a cancellation, a 600-character excerpt of their reply as your proof of cancellation. That excerpt is the only text we keep out of mail you have received, and its length limit is enforced by the database itself. (The cancellation you send is text you wrote and approved, and we keep that too — see below.)
• We do not sell or share your personal information, and we never will. There is no advertising in this app, no analytics SDK, no crash reporter, and no tracking identifier. The app has no third-party libraries at all.
• We never use anything we learn from your mail to train a model, and we do not currently send any of your mail to any AI provider. See section 6.
• You can disconnect your inbox at any time from Settings, which deletes our access token and wipes every stored email excerpt. To delete your whole account, see section 11.

Google user data, and our Limited Use commitment

The permissions we ask for, and when

We ask for permissions in two stages, deliberately. Nothing about sending is requested while you are signing up.

Granting the send permission does not withdraw the read permission, and declining it does not break the rest of the app — you simply cannot send a cancellation from within TrialCut.

What we actually read

A scan does not read your mailbox. It runs one targeted Gmail search and reads only what comes back:

• Messages matching trial vocabulary from the last 90 days, and messages matching receipt vocabulary from the last 400 days.
• Explicitly excluding your Promotions and Social tabs, your spam, and your trash.
• Capped at 4,000 messages per scan.

For each message returned, we fetch the message and read its body, truncated at 20,000 characters. That body exists only in memory for the length of the scan. What survives the scan is the handful of extracted facts listed in section 4.

Afterwards, while we watch for a merchant's confirmation, we read less: only message headers and Gmail's own one-line snippet. No message body is fetched by the confirmation-watching process at all.

The four Limited Use requirements, in our words

• We use Google data only to provide the features you can see. Finding trials, warning you before a charge, sending a cancellation you approved, and recognising the merchant's reply. Nothing else.
• We do not transfer it, except to the infrastructure providers listed in section 7 that are necessary to run the service, and to the merchant you choose to cancel with.
• No human reads your mail. We do not review message content, and our server logs are built so that content cannot end up in them — see section 4.
• We never sell it, to anyone, for any purpose, and we never use it for advertising or to train, fine-tune or improve any model.

What we collect and keep

Your account

Your Google account identifier and your email address. That is the entire account record — there is no name field, and no profile picture, because we never request them.

What we found in your inbox

For each trial: the merchant's name, the plan name if it was stated, the amount and currency you would be charged, whether it bills monthly or annually, the date it started and the date it converts, and how confident we are about that date. Plus the Gmail identifier of the message we read it out of, so the fact can be traced back to its source. We also keep a per-scan summary: how many messages were examined, how many trials were found, and any error text if the scan failed.

Cancellations you send

The exact text of the cancellation you approved, stored verbatim, along with the address it went to and the Gmail thread it lives in. That text contains your own email address, because the merchant needs it to find your account.

Proof of cancellation

When a merchant replies confirming your cancellation, we keep the subject line and Gmail's snippet of that reply, truncated to 600 characters. This is your receipt. It is the only text we keep out of mail you received — the cancellation above is text you approved, not mail we read — and the 600-character ceiling is a constraint in the database, not just a rule in our code.

Your device

If you turn on notifications, the push token Apple issues for your device, so we can send you a warning before a charge lands. Nothing else about your device is collected — no advertising identifier, no device fingerprint.

Technical logs

Our server records the usual request metadata — your IP address, the time, the endpoint, and whether it succeeded — plus internal record identifiers when something goes wrong. Email content cannot reach these logs. We specifically strip the database's own error details before logging, because a failed write would otherwise print the whole row it was trying to save. Authorisation headers and OAuth codes are redacted the same way.

What we never collect

Some of these are worth stating plainly because comparable apps do collect them.

• The body of any message we read. It exists in memory for the length of a scan and is never written to the database.
• Card or bank details. TrialCut never connects to your bank, never issues virtual cards, and never stores payment information. Payment for the app itself is handled entirely by Apple; we never see your card.
• Merchant passwords or logins. We never log in anywhere as you.
• Your name or photograph. Not requested, not received, not stored.
• Analytics, crash reporting, attribution or advertising data. The app contains no third-party SDKs whatsoever. There is nothing in it that reports your behaviour to anyone.
• Contacts, location, calendar, photos, microphone or camera. The app does not ask for any of these permissions.

AI processing

Most trial emails can be read by ordinary pattern matching. A minority cannot, and for those we have built an optional path that would send the subject line and up to 4,000 characters of that one message to a third-party language model to extract the date and amount. Your email address, the sender, and the message identifiers are not included in that request.

We will not switch this on until all four of the following are true, and we will update this page and name the provider in our sub-processor list before we do:

1. A contractual term prohibiting the provider from training or fine-tuning any model on the data — not merely a setting in a dashboard.
2. A zero-data-retention endpoint, so the content is not stored alongside the model even temporarily for abuse monitoring.
3. No human review of the content by the provider.
4. The provider named here as a sub-processor before a single message is sent.

Regardless of that switch: anything a model produces is treated as a suggestion. It is labelled as estimated and can never by itself schedule an alert or send a cancellation — only a fact read deterministically out of your mail, or one you confirmed yourself, can do that.

Who else sees your data

The full, dated list with regions lives on the sub-processor page. In summary, the companies that process data on our behalf are Google (your mailbox, at your instruction), Render (our servers and database, in Oregon, USA) and Apple (push notification delivery, and payment for the subscription). Two further providers are named there as not currently active.

Two disclosures people do not expect

The merchant you cancel with receives real information about you. The cancellation email is sent from your own Gmail address and contains your email address, the merchant's name, your plan name if known, the trial's start and end dates, and the amount you would have been charged. You see this exact text and can edit it before anything is sent. Notably, it does not mention TrialCut: we do not tell the merchant which app you used, and the message carries no product name, signature or branding of ours.

Push notifications contain the merchant's name and the exact amount — that is what makes them useful — and they therefore pass through Apple's servers and can appear on your lock screen where somebody standing next to you could read them. If that matters to you, iOS lets you hide notification previews until unlocked, or you can leave notifications off entirely.

Everyone else

We share your data with nobody else. Specifically: we do not sell it, we do not share it for advertising, we have no marketing partners, no data brokers and no analytics vendors. If we were ever legally compelled to disclose something, we would tell you unless the law forbade it. If the app were ever acquired, you would be told before your data moved, and this policy would continue to apply to it.

Why we are allowed to do this

If you are in the UK, the EU or another jurisdiction that requires a lawful basis:

• To perform our contract with you (GDPR Art. 6(1)(b)) — scanning your inbox, tracking your trials, warning you, sending your cancellations, and running your subscription. This is the app doing what you installed it for.
• Your explicit consent (Art. 6(1)(a), and Art. 9 where a message happens to reveal something sensitive) — access to your Gmail. You grant this on Google's own consent screen, and you can withdraw it at any time from inside the app or at myaccount.google.com. Withdrawing it stops all future processing; it does not make what happened beforehand unlawful.
• Our legitimate interests (Art. 6(1)(f)) — keeping short technical logs to secure the service, debug failures and prevent abuse. We have weighed this against your privacy, which is why those logs carry metadata and never content.

Providing your Gmail access is not a legal requirement, but the app cannot do anything without it.

How long we keep it

Plainly: we keep your records until you remove them. We do not run an automatic purge, because the ledger of what you have cancelled is the thing the product is for — a proof receipt you cannot find later is not proof.

The specifics:

• Trials, cancellations and proof receipts — kept until you delete your account or disconnect your inbox.
• Email excerpts — deleted immediately when you disconnect your inbox, without your trial history going with them.
• Your Google access token — deleted, and revoked at Google, the moment you disconnect.
• Sign-in sessions — expire 90 days after you sign in, and are deleted outright when you sign out.
• Sign-in handshake records — the short-lived state used during the Google redirect stops working after five minutes, and the spent row is cleared out the next time anyone begins a sign-in. It holds no mail content.
• Technical logs — retained by our hosting provider for their standard period.

If your subscription lapses, nothing is deleted. Alerts stop being delivered and the detailed ledger locks, but every record is kept, so resubscribing restores everything without another scan.

One thing does continue after a lapse, and we would rather say so than have you find out: if you sent a cancellation that no merchant has confirmed yet, we keep watching your inbox for that reply — otherwise the answer to a cancellation you paid for would be lost. No new scans run, and nothing else is read. To stop it entirely, disconnect your inbox.

Your rights

Wherever you live, you can ask us to show you what we hold, correct it, or delete it. Write to ckjergu@gmail.com and we will respond within 30 days. We do not charge for this and we will not treat you differently for asking.

If you are in the UK or the EEA

You have the rights of access, rectification, erasure, restriction of processing, data portability, and objection, and the right to withdraw consent at any time. You also have the right to complain to your national supervisory authority — in the UK, the Information Commissioner's Office — though we would rather you gave us the chance to fix it first.

If you are in California

Under the CCPA as amended by the CPRA you may request the categories and specific pieces of personal information we have collected, request deletion, request correction, and know whether we sell or share it. We do not sell your personal information and we do not share it for cross-context behavioural advertising — there is nothing to opt out of, because we have no advertising or analytics partners at all. We collect the categories described in section 4: identifiers, commercial information, internet activity in the form of server logs, and the contents of electronic mail, all for the business purposes stated here and for no other purpose. We do not knowingly collect the personal information of anyone under 16.

If you are in Thailand

Under the Personal Data Protection Act B.E. 2562 you have rights of access, portability, objection, erasure, restriction, rectification and withdrawal of consent, and you may lodge a complaint with the Personal Data Protection Committee.

Disconnecting your inbox, and deleting your account

Disconnecting — available now, in the app

Settings → Disconnect inbox. This takes effect immediately and does three things: it revokes our access at Google, it deletes the stored access token, and it erases every email excerpt we hold for you. Your trial records stay, so your history survives, but we can no longer read anything. You can also revoke our access from Google's side at any time at myaccount.google.com/permissions.

Deleting your account

Deletion removes your account record and everything attached to it: your trials, your scan history, your cancellation attempts and their text, your proof receipts, your stored access token, your sessions and your device push tokens. It cannot be undone, and a deleted proof receipt cannot be recovered — if you may need one later, save it first.

Two honest caveats. Records of your payments are held by Apple under their own policy and their own retention rules, and deleting your TrialCut account does not cancel your subscription — you must cancel that in your Apple subscription settings, or it will keep renewing. And emails already sent from your Gmail account are in your own sent folder and in the recipient's inbox; we cannot reach into either.

Where your data lives

Our server and database run on Render in Oregon, USA. Google processes your mailbox on its own global infrastructure, and Apple delivers push notifications and processes payments on theirs. If you are in the UK or the EEA, this means your data may be transferred outside it; where that happens we rely on the European Commission's Standard Contractual Clauses, or the UK Addendum, as incorporated into our agreements with those providers.

Security

The measures worth naming, because they are specific rather than aspirational:

• Your Google refresh token is encrypted before it is written to the database, using AES-256-GCM, and exactly one module in our codebase is ever allowed to hold it in plain form.
• The app on your phone never holds a Gmail token. All mailbox access happens on our server; what crosses to the app is a single-use handoff code that is worthless once spent.
• Sign-in tokens are stored only as a one-way hash, so our database does not contain anything that could be replayed to sign in as you.
• All traffic runs over TLS, and the service is designed so that no email body can reach a log file or a database column.

No system is perfectly secure. If a breach affected your data we would tell you and the relevant regulator without undue delay, and within 72 hours where the law requires it. If you believe you have found a vulnerability, please write to ckjergu@gmail.com before disclosing it publicly; we will not pursue anyone who reports in good faith.

Children

TrialCut is not for children. It is intended for people aged 16 and over, and you need your own Google account and a payment method to use it. We do not knowingly collect data from children. If you believe a child has given us data, write to us and we will delete it.

Changes to this policy

If we change how we handle your data we will update this page and move the "last updated" date at the top. For anything material — a new sub-processor, a new category of data, or switching on the AI processing in section 6 — we will tell you in the app before the change takes effect, and where the law requires it we will ask for your consent again rather than assume it.

Contact

{{LEGAL_NAME}}
{{POSTAL_ADDRESS}}
ckjergu@gmail.com

For anything about your data — a copy of it, a correction, deletion, or a question about this page — that address is the right one, and a person reads it.