Privacy Policy

Who we are

TrialCut is an iOS app published by Pravit Vanadilok, an individual developer trading as TrialCut. A postal address is available on request by email at [email protected]. For the purposes of the UK and EU General Data Protection Regulation and Thailand's Personal Data Protection Act, we are the data controller for the information described here.

You can reach a person at [email protected]. That address is monitored by the developer named above, not a helpdesk queue.

The short version

This is a summary for orientation. The sections below are the binding detail.

• We ask Google for read-only access to your Gmail so we can find trial signup emails and receipts. We ask for permission to send mail separately, later, and only at the moment you cancel something for the first time.
• We read message bodies during a scan — the dates and amounts are in the bodies, not the subject lines — but we never write one to the database. A body exists in memory for the length of the scan and then it is gone.
• What we keep from your inbox is a short list of facts: a merchant name, a plan name, an amount, a currency, some dates, and message identifiers. Plus, once a merchant confirms a cancellation, a 600-character excerpt of their reply as your proof of cancellation. That excerpt is the only text we keep out of mail you have received, and its length limit is enforced by the database itself. (The cancellation you send is text you wrote and approved, and we keep that too — see below.)
• We do not sell or share the personal information you give us as a user of the app, and we never will. There is no advertising in the iOS app, no analytics SDK, no crash reporter, and no tracking identifier; its only third-party library is the one that manages your subscription. Our marketing website is a separate and much smaller matter: it can load an advertising pixel, but only if you say yes, and it never sees anything from your mailbox or your account. It also has a waitlist box; an address you type there goes to the form service that holds it for us, and to nobody else. Section 17 is specific about both.
• We never use anything we learn from your mail to train a model, and we do not currently send any of your mail to any AI provider. See section 6.
• You can disconnect your inbox at any time from Settings, which deletes our access token and wipes every stored email excerpt. To delete your whole account, see section 11.

Google user data, and our Limited Use commitment

The permissions we ask for, and when

We ask for permissions in two stages, deliberately. Nothing about sending is requested while you are signing up.

Granting the send permission does not withdraw the read permission, and declining it does not break the rest of the app — you simply cannot send a cancellation from within TrialCut.

What we actually read

A scan does not read your mailbox. It runs one targeted Gmail search and reads only what comes back:

• Messages matching trial vocabulary from the last 90 days, and messages matching receipt vocabulary from the last 400 days.
• Explicitly excluding your Promotions and Social tabs, your spam, and your trash.
• Capped at 4,000 messages per scan.

For each message returned, we fetch the message and read its body, truncated at 20,000 characters. That body exists only in memory for the length of the scan. What survives the scan is the handful of extracted facts listed in section 4.

Afterwards, while we watch for a merchant's confirmation, we read less: only message headers and Gmail's own one-line snippet. No message body is fetched by the confirmation-watching process at all.

The four Limited Use requirements, in our words

• We use Google data only to provide the features you can see. Finding trials, warning you before a charge, sending a cancellation you approved, and recognising the merchant's reply. Nothing else.
• We do not transfer it, except to the infrastructure providers listed in section 7 that are necessary to run the service, and to the merchant you choose to cancel with.
• No human reads your mail. We do not review message content, and our server logs are built so that content cannot end up in them — see section 4.
• We never sell it, to anyone, for any purpose, and we never use it for advertising or to train, fine-tune or improve any model.

What we collect and keep

Your account

Your Google account identifier and your email address. That is the entire account record — there is no name field, and no profile picture, because we never request them.

What we found in your inbox

For each trial: the merchant's name, the plan name if it was stated, the amount and currency you would be charged, whether it bills monthly or annually, the date it started and the date it converts, and how confident we are about that date. Plus the Gmail identifier of the message we read it out of, so the fact can be traced back to its source. We also keep a per-scan summary: how many messages were examined, how many trials were found, and any error text if the scan failed.

Cancellations you send

The exact text of the cancellation you approved, stored verbatim, along with the address it went to and the Gmail thread it lives in. That text contains your own email address, because the merchant needs it to find your account.

Proof of cancellation

When a merchant replies confirming your cancellation, we keep the subject line and Gmail's snippet of that reply, truncated to 600 characters. This is your receipt. It is the only text we keep out of mail you received — the cancellation above is text you approved, not mail we read — and the 600-character ceiling is a constraint in the database, not just a rule in our code.

Your device

If you turn on notifications, the push token Apple issues for your device, so we can send you a warning before a charge lands. Nothing else about your device is collected — no advertising identifier, no device fingerprint.

Technical logs

Our server records the usual request metadata — your IP address, the time, the endpoint, and whether it succeeded — plus internal record identifiers when something goes wrong. Email content cannot reach these logs. We specifically strip the database's own error details before logging, because a failed write would otherwise print the whole row it was trying to save. Authorisation headers and OAuth codes are redacted the same way.

What we never collect

Some of these are worth stating plainly because comparable apps do collect them.

• The body of any message we read. It exists in memory for the length of a scan and is never written to the database.
• Card or bank details. TrialCut never connects to your bank, never issues virtual cards, and never stores payment information. Payment for the app itself is handled entirely by Apple; we never see your card.
• Merchant passwords or logins. We never log in anywhere as you.
• Your name or photograph. Not requested, not received, not stored.
• Analytics, crash reporting, attribution or advertising data. The app contains no third-party SDKs whatsoever. There is nothing in it that reports your behaviour to anyone.
• Contacts, location, calendar, photos, microphone or camera. The app does not ask for any of these permissions.

AI processing

Most trial emails can be read by ordinary pattern matching. A minority cannot, and for those we have built an optional path that would send the subject line and up to 4,000 characters of that one message to a third-party language model to extract the date and amount. Your email address, the sender, and the message identifiers are not included in that request.

We will not switch this on until all four of the following are true, and we will update this page and name the provider in our sub-processor list before we do:

1. A contractual term prohibiting the provider from training or fine-tuning any model on the data — not merely a setting in a dashboard.
2. A zero-data-retention endpoint, so the content is not stored alongside the model even temporarily for abuse monitoring.
3. No human review of the content by the provider.
4. The provider named here as a sub-processor before a single message is sent.

Regardless of that switch: anything a model produces is treated as a suggestion. It is labelled as estimated and can never by itself schedule an alert or send a cancellation — only a fact read deterministically out of your mail, or one you confirmed yourself, can do that.

Who else sees your data

The full, dated list with regions lives on the sub-processor page. In summary, the companies that process data on our behalf are Google (your mailbox, at your instruction), Render (our servers and database, in Oregon, USA), Apple (push notification delivery, and payment for the subscription) and RevenueCat (which tells our server whether your subscription is active, and receives an internal account identifier and nothing else). One further provider is named there as not currently active.

Two disclosures people do not expect

The merchant you cancel with receives real information about you. The cancellation email is sent from your own Gmail address and contains your email address, the merchant's name, your plan name if known, the trial's start and end dates, and the amount you would have been charged. You see this exact text and can edit it before anything is sent. Notably, it does not mention TrialCut: we do not tell the merchant which app you used, and the message carries no product name, signature or branding of ours.

Push notifications contain the merchant's name and the exact amount — that is what makes them useful — and they therefore pass through Apple's servers and can appear on your lock screen where somebody standing next to you could read them. If that matters to you, iOS lets you hide notification previews until unlocked, or you can leave notifications off entirely.

Everyone else

We share your data with nobody else. Specifically: we do not sell it, we do not share it for advertising, and we have no data brokers. Nothing you give us as a user of the app — your mailbox, your trials, your account — reaches an advertising company, ever. The one exception sits entirely outside the app and is set out in section 17: if you consent on our marketing website, Meta learns that a browser visited a page. That browser is not connected to your account, because at the moment it happens we do not know who you are. The website's waitlist box is the other thing that lives outside the app: an address typed there is held by Formspree, the form service behind it, and is never joined to an account. If we were ever legally compelled to disclose something, we would tell you unless the law forbade it. If the app were ever acquired, you would be told before your data moved, and this policy would continue to apply to it.

Why we are allowed to do this

If you are in the UK, the EU or another jurisdiction that requires a lawful basis:

• To perform our contract with you (GDPR Art. 6(1)(b)) — scanning your inbox, tracking your trials, warning you, sending your cancellations, and running your subscription. This is the app doing what you installed it for.
• Your explicit consent (Art. 6(1)(a), and Art. 9 where a message happens to reveal something sensitive) — access to your Gmail. You grant this on Google's own consent screen, and you can withdraw it at any time from inside the app or at myaccount.google.com. Withdrawing it stops all future processing; it does not make what happened beforehand unlawful.
• Our legitimate interests (Art. 6(1)(f)) — keeping short technical logs to secure the service, debug failures and prevent abuse. We have weighed this against your privacy, which is why those logs carry metadata and never content.

Providing your Gmail access is not a legal requirement, but the app cannot do anything without it.

How long we keep it

Plainly: we keep your records until you remove them. We do not run an automatic purge, because the ledger of what you have cancelled is the thing the product is for — a proof receipt you cannot find later is not proof.

The specifics:

• Trials, cancellations and proof receipts — kept until you delete your account or disconnect your inbox.
• Email excerpts — deleted immediately when you disconnect your inbox, without your trial history going with them.
• Your Google access token — deleted, and revoked at Google, the moment you disconnect.
• Sign-in sessions — expire 90 days after you sign in, and are deleted outright when you sign out.
• Sign-in handshake records — the short-lived state used during the Google redirect stops working after five minutes, and the spent row is cleared out the next time anyone begins a sign-in. It holds no mail content.
• Technical logs — retained by our hosting provider for their standard period.

If your subscription lapses, nothing is deleted. Alerts stop being delivered and the detailed ledger locks, but every record is kept, so resubscribing restores everything without another scan.

One thing does continue after a lapse, and we would rather say so than have you find out: if you sent a cancellation that no merchant has confirmed yet, we keep watching your inbox for that reply — otherwise the answer to a cancellation you paid for would be lost. No new scans run, and nothing else is read. To stop it entirely, disconnect your inbox.

Your rights

Wherever you live, you can ask us to show you what we hold, correct it, or delete it. Write to [email protected] and we will respond within 30 days. We do not charge for this and we will not treat you differently for asking.

If you are in the UK or the EEA

You have the rights of access, rectification, erasure, restriction of processing, data portability, and objection, and the right to withdraw consent at any time. You also have the right to complain to your national supervisory authority — in the UK, the Information Commissioner's Office — though we would rather you gave us the chance to fix it first.

If you are in California

Under the CCPA as amended by the CPRA you may request the categories and specific pieces of personal information we have collected, request deletion, request correction, and know whether we sell or share it. We do not sell your personal information. Nothing from the app is shared for cross-context behavioural advertising. On our marketing website the Meta pixel described in section 17 does count as “sharing” under the CPRA — which is why it stays off until you turn it on, and why the Cookies control in the website footer turns it back off at any time. That control is our Do Not Sell or Share mechanism, and you do not have to ask us for it. We collect the categories described in section 4: identifiers, commercial information, internet activity in the form of server logs, and the contents of electronic mail, all for the business purposes stated here and for no other purpose. We do not knowingly collect the personal information of anyone under 16.

If you are in Thailand

Under the Personal Data Protection Act B.E. 2562 you have rights of access, portability, objection, erasure, restriction, rectification and withdrawal of consent, and you may lodge a complaint with the Personal Data Protection Committee.

Disconnecting your inbox, and deleting your account

Disconnecting — available now, in the app

Settings → Disconnect inbox. This takes effect immediately and does three things: it revokes our access at Google, it deletes the stored access token, and it erases every email excerpt we hold for you. Your trial records stay, so your history survives, but we can no longer read anything. You can also revoke our access from Google's side at any time at myaccount.google.com/permissions.

Deleting your account

Deletion removes your account record and everything attached to it: your trials, your scan history, your cancellation attempts and their text, your proof receipts, your stored access token, your sessions and your device push tokens. It cannot be undone, and a deleted proof receipt cannot be recovered — if you may need one later, save it first.

Two honest caveats. Records of your payments are held by Apple under their own policy and their own retention rules, and deleting your TrialCut account does not cancel your subscription — you must cancel that in your Apple subscription settings, or it will keep renewing. And emails already sent from your Gmail account are in your own sent folder and in the recipient's inbox; we cannot reach into either.

Where your data lives

Our server and database run on Render in Oregon, USA. Google processes your mailbox on its own global infrastructure, and Apple delivers push notifications and processes payments on theirs. Separately, if you consent to the website pixel, Meta receives that website data in the United States and Ireland. If you are in the UK or the EEA, this means your data may be transferred outside it; where that happens we rely on the European Commission's Standard Contractual Clauses, or the UK Addendum, as incorporated into our agreements with those providers.

Security

The measures worth naming, because they are specific rather than aspirational:

• Your Google refresh token is encrypted before it is written to the database, using AES-256-GCM, and exactly one module in our codebase is ever allowed to hold it in plain form.
• The app on your phone never holds a Gmail token. All mailbox access happens on our server; what crosses to the app is a single-use handoff code that is worthless once spent.
• Sign-in tokens are stored only as a one-way hash, so our database does not contain anything that could be replayed to sign in as you.
• All traffic runs over TLS, and the service is designed so that no email body can reach a log file or a database column.

No system is perfectly secure. If a breach affected your data we would tell you and the relevant regulator without undue delay, and within 72 hours where the law requires it. If you believe you have found a vulnerability, please write to [email protected] before disclosing it publicly; we will not pursue anyone who reports in good faith.

Children

TrialCut is not for children. It is intended for people aged 16 and over, and you need your own Google account and a payment method to use it. We do not knowingly collect data from children. If you believe a child has given us data, write to us and we will delete it.

Changes to this policy

If we change how we handle your data we will update this page and move the "last updated" date at the top. For anything material — a new sub-processor, a new category of data, or switching on the AI processing in section 6 — we will tell you in the app before the change takes effect, and where the law requires it we will ask for your consent again rather than assume it.

Contact

Pravit Vanadilok
Postal address available on request
[email protected]

For anything about your data — a copy of it, a correction, deletion, or a question about this page — that address is the right one, and a person reads it.

Cookies & the website

We advertise, and we would like to know which ads bring people here. To find out we use the Meta pixel — a small piece of Meta's code that tells Meta a browser visited one of our pages. It is off by default. Nothing is requested from Meta, and no cookie of theirs is set, unless you press Allow on the banner. Declining is a real decline: the code is never fetched at all, rather than fetched and asked to stay quiet.

What is stored

What Meta receives, if you allow it

Your IP address, your browser's user-agent string, the address of the page you are on, and the _fbp identifier above. It also receives that you clicked a call-to-action, opened an FAQ answer, or scrolled down the page — the ordinary shape of a visit.

What it never receives: your email address, your name, your account identifier, or anything at all from your mailbox. The pixel runs on pages you can read without an account, at a point where we do not know who you are, and we do not pass it anything about you even if you are signed in elsewhere. We have also turned off Meta's automatic advanced matching, which would otherwise try to read identifying details out of the page. Information we receive from Google APIs is never used for advertising, in any form — that commitment is in section 3 and it is unaffected by anything on this page.

Changing your mind

The Cookies control in the footer of every page reopens the banner, and you can switch either way as often as you like. Turning it off deletes Meta's cookies and reloads the page without their code, because a script already running cannot be unloaded any other way. For California residents, that control is also our “Do Not Sell or Share My Personal Information” mechanism — see section 10.

The legal part

Our lawful basis is your consent (GDPR Art. 6(1)(a)), which is also what the ePrivacy Directive and the UK's PECR require before a non-essential cookie is set or a third-party script is loaded. Storing your answer to the banner is strictly necessary to honour it, so that one is exempt. Meta Platforms Ireland Limited is the controller for visitors in the EEA and the UK, and Meta Platforms, Inc. elsewhere; data reaches the United States under the European Commission's Standard Contractual Clauses. Meta is listed on our sub-processor page, with the date it was added.

If you would rather not decide, do nothing: the banner closes with the Escape key without recording an answer, and the pixel stays off.

The waitlist

The website has a box that asks for your email address so we can tell you when TrialCut is on the App Store. Filling it in is the only thing that sends it anywhere. What it sends is the address you typed and which of the two boxes you used, and the form service adds the time and your IP address as every web form does. It goes to Formspree, Inc. in the United States, the company that receives the form for us, because this site is a set of static pages with no server of its own to receive anything. Formspree holds the list; we read it there. It is not joined to an app account, not passed to Meta or anyone else, and not used for anything except that one message.

What you get is one email, on the day the app is available, and nothing else: no newsletter, no reminders, no "still interested?". If a second message ever becomes necessary (for example, if the launch is cancelled) it will say so plainly and be the last.

Our lawful basis is your consent, given by pressing the button. To withdraw it, reply to the launch email or write to [email protected] and the address is deleted from the list within 30 days. Formspree is on our sub-processor page with the date it was added and the date it went live. If the form service is ever disconnected, the box on the page is replaced by a plain email link and nothing is collected at all.