Your data.
Your choices.

What this policy covers

Cancel Subscriptions helps you record recurring services, set reminders, review possible subscriptions and follow cancellation guidance. It does not connect to your bank, cancel every service on your behalf or independently verify that a cancellation succeeded.

This policy covers this app, its optional Gmail discovery feature and howtocancelsubscription.com. It does not describe every feature of the separate Brite planner.

Optional Gmail discovery

Version notice: The workflow below is being developed and tested for a future release. It is not yet included in the current App Store release. Connecting Gmail remains optional.

Permission and purpose

When you start a scan, you authorise read-only Gmail access through Google using https://www.googleapis.com/auth/gmail.readonly. We do not receive your Google password. The app searches billing-related messages across your mailbox history and reads matching message headers, dates and bodies, together with supported invoice attachments. It does not send, change, delete or mark mail.

On-device analysis

The app communicates directly with Gmail. Parsing runs on your device; Gmail data is not uploaded to our servers or an external AI service. PDF invoices are limited to 5 MB and 12 pages, with up to four documents per email. Invoice images and scanned PDFs use on-device text recognition and require amount review. Unsupported, oversized, ambiguous or unauthenticated evidence is marked for review. Searches exclude spam and trash, may miss some services or layouts, and can stop before completion if access or connectivity is lost.

Automatic local records

As the scan progresses, the app automatically adds or updates local service records and stores structured evidence: service name, dates, payment and refund amounts and currencies, billing period, access or renewal dates when available, and the type of evidence. Mailbox, message, subscription and invoice identifiers are hashed for separation and duplicate detection. Raw message text, headers, attachments and access tokens remain temporary and are not saved as a mailbox copy; no refresh token is persisted.

Clear, authenticated payment evidence enters recorded spending; unpaid invoices do not. Refunds reduce recorded spending. Different currencies are kept separate. A receipt is historical evidence, not a live check of a provider account: current status can remain unknown, and absence of mail does not prove cancellation. Totals cover receipts found and manually recorded payments, not necessarily lifetime spending. Multiple plans or conflicting evidence require review. Manual changes to billing settings and recorded payments are preserved on later scans.

Leaving the flow stops scanning and clears temporary data; already saved records remain. You can inspect, correct or delete those records in the app. Structured email history and payment records are included in backups you create; exported files must be managed separately. Revoking Google access prevents future scans but does not delete saved local records.

Earlier app versions

The earlier implementation searches matching messages from the last six months and retrieves subjects and sender headers for up to 30 messages for each of two searches. It also processes matching on the device without fetching message bodies or attachments. It does not have the updated evidence review and draft safeguards described above.

Earlier versions can send additional product-event parameters to Supabase, including subscription counts, spending totals, categories, billing cycles and the service name when you open cancellation guidance. Such values can include information from a record originally suggested by Gmail. The updated implementation removes all these event parameters. Email subjects, sender headers, message bodies and Google access credentials are not included in those analytics events.

You can use manual entry without connecting Gmail. The revised workflow and analytics limits described on this page will apply when you use the updated app; publication of this policy does not itself update an installed version.

Google API Limited Use

Cancel Subscriptions’ use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google data only to provide the visible, user-requested subscription discovery and review feature. In the updated implementation, Gmail data and information derived from it are excluded from analytics. We do not sell Google data or use it for advertising, credit decisions, or training general-purpose AI models. The legacy analytics behaviour is disclosed in Earlier app versions. We do not upload scanned email metadata to our servers or allow our staff to read it through the app.

You can choose to export or back up local subscription records, including saved Gmail-derived service names and evidence notes. That action shares only the file you create with the destination you select. The updated implementation does not otherwise transfer Gmail data from the app to third parties.

Local records and screenshots

Local storage does not mean the app has no network activity. Optional Gmail access, app purchases, product analytics and external links involve network connections. Apple’s device backup settings may also affect whether app data is included in a device backup.

Product analytics and app purchases

To understand use of the app, the updated implementation sends basic product events to a service hosted on Supabase. The event payload contains a randomly generated installation identifier, the event name, app identifier, iOS platform, app version and the free or Pro tier of Cancel Subscriptions itself.

The updated implementation’s payloads do not include your subscription names, amounts, dates, notes, Gmail subject/sender data or other event parameters. The installation identifier is not a Google account identifier. Network providers may also process connection information, such as an IP address, when handling a request.

Purchases for this app are handled by Apple through StoreKit. The app uses purchase status to unlock its own Pro features. We do not receive your full payment card details. Apple handles purchase and account information under its own privacy terms.

Website and support requests

You can browse howtocancelsubscription.com without connecting Gmail. If you submit the guide-request form, we receive the service name and the email address you choose to provide. The site records the request and its submission time on our server and sends it to our support mailbox so we can consider the guide and respond when appropriate. Providing an email address is optional.

Our hosting provider processes connection information such as your IP address, requested page, browser information and access time to deliver and protect the website. Website requests and support correspondence are retained for handling requests and operating the service. Contact hello@britetodo.com to request access or deletion; include enough information to identify your request. Do not send passwords, access tokens or private email contents through the form.

App Store links and provider guides may lead to external websites; their own privacy terms apply. The website does not connect to or scan your Gmail account. The optional Gmail flow takes place inside the iOS app through Google.

Sharing and protection

The app communicates directly with Google for the Gmail feature, with Apple for its own purchases and with Supabase for the limited analytics described above. It uses HTTPS for those network requests.

If you open a provider’s cancellation page, that provider’s site and privacy terms apply. If you share an export, save a backup to a cloud drive or contact support, the information you choose to send is also handled by that destination. Do not include passwords, access tokens or unnecessary email content in support requests.

Local app data is protected by the security of your device and iOS. Keep your device protected and store exported files somewhere you trust. No storage or transmission method can be guaranteed completely secure.

Retention, access and deletion

• Temporary Gmail data: credentials, raw message text, headers and attachments are held in memory for the scan flow, not saved as a mailbox copy. Leaving the flow stops scanning and clears that state.
• Saved records: automatically imported or manually saved entries and structured email evidence stay in the app’s local storage until you delete them or remove the app’s data. Deleting the app does not delete files you previously exported or device backups.
• Your files: delete backups or exports separately from Files, your chosen cloud drive or other destinations. Restoring an older backup can restore the records it contains.
• Google access: revoke the app’s permission in your Google Account connections. Revoking permission stops future authorised access; it does not delete records already saved locally.
• Support and analytics: contact us about access or deletion requests. Basic analytics and support correspondence may be retained for operating and supporting the app; raw Gmail subjects, sender headers, bodies and access credentials are not sent to analytics. Earlier versions may include the event parameters described above.

You can use manual tracking without granting Gmail access, decline or revoke notification permission in iOS Settings, and delete individual subscription records in the app. Depending on your location, you may also have rights to access, correct or delete personal information, object to certain uses, or complain to a data-protection authority. Contact us to exercise applicable rights.

Contact and policy changes

For privacy questions about Cancel Subscriptions, email hello@britetodo.com. Identify the app in your message so we can route your request.

We will update this policy when our data practices change. If a change introduces a new use of Google data, we will disclose it and request consent before using that data for the new purpose.