Privacy Policy

Effective date: July 20, 2026 · Last updated: July 20, 2026

This Privacy Policy explains how Oncancel collects, uses, shares, and protects your personal information when you use the Oncancel mobile application, visit our website at oncancel.com, or interact with us in related ways such as customer support (together, the "Service"). The Service is operated by Endure Labs, Inc., a company incorporated under the laws of the State of Delaware, USA, with its principal place of business at 2228 Ellesworth Avenue, Copper Canyon, TX 75077, USA ("Oncancel", "we", "us", or "our"). Endure Labs, Inc. is the controller of your personal data.

Important context for everything below: Oncancel finds the subscriptions you pay for and cancels the ones you don't want. We analyze your existing bank transactions or email receipts to detect recurring charges. We are not a bank, payment processor, or financial institution, and we never move money or make payments on your behalf.

By using the Service, you agree to the practices described in this Policy. If you do not agree, please do not use the Service. If you connect a Gmail account, the separate Oncancel Google User Data Policy also applies and is incorporated into this Policy by reference.

1. Information we collect

Information you provide

• Account information: your name, email address, and authentication method (email and password, or Apple or Google sign-in).
• Onboarding responses: your answers to questions about your subscription habits, used to personalize your savings estimate.
• Purchase information: payments are processed by the Apple App Store or Google Play, so we never see your full payment card details. We may receive transaction metadata such as plan type, purchase date, and renewal status.
• Support communications: your name, email address, and the contents of any message you send our support team.

Information used to carry out cancellations

When you ask us to cancel a subscription, you authorize Oncancel to act as your limited agent and contact the relevant merchant on your behalf. To verify your account with that merchant, we may share details such as your full name, the email address or phone number associated with the subscription, your service address, an account or customer number, and the last four digits or expiry of the payment method used for that subscription, where the merchant requires them. Where a merchant's process only accepts requests from the account holder, you consent to our agents identifying themselves as acting for the account holder, solely to complete the cancellation you requested. This clause is explained further in Section 5 of our Terms of Use.

Information collected automatically

• Device and usage data: IP address, device model and identifiers, operating system and version, app version, language, time zone, and general (city-level) location.
• Analytics data: session information such as screens viewed, features used, crashes, timestamps, and diagnostic logs, collected through analytics providers listed in Section 5.
• Notifications: if you enable push notifications, the token needed to deliver them, and your notification preferences.
• Cookies and similar technologies: on our website, we use cookies and similar technologies to operate the site, remember preferences, and measure usage and campaign performance.

Bank account data (via Plaid)

If you choose to connect a bank account, the connection is established by Plaid Inc. You provide your banking credentials directly to Plaid, never to Oncancel; we cannot see or store them. Through Plaid we receive, with your explicit consent and on a read-only basis:

• account metadata (institution name, account name, account type);
• transaction history (dates, merchant names, amounts, descriptions);
• recurring payment patterns used to identify subscriptions.

We use this data solely to detect recurring charges, build your subscription list, calculate spending and savings totals, and power renewal, price-increase, and free-trial alerts. We have no ability to initiate payments, transfers, or any changes to your bank account. Plaid's own handling of your data is governed by the Plaid End User Privacy Policy. You can revoke the connection at any time from Settings.

Email data (via Gmail)

If you choose to connect a Gmail account, we request read-only access and use it solely to identify subscription receipts, renewal notices, price-change notices, trial-conversion notices, and cancellation confirmations. We cannot send, delete, modify, or forward your email. We do not store the full content of your emails; we derive and retain only subscription-related data points such as merchant name, amount, currency, and billing cycle. Our access, use, storage, and sharing of Google user data, including our Limited Use commitments and the independent third-party security assessment our Gmail integration undergoes, are described in full in the Oncancel Google User Data Policy.

2. How we use your information

Core service functions

• To create and manage your account and personalize your onboarding.
• To connect your bank or email with your consent and analyze it for recurring charges.
• To build and maintain your subscription list, spending totals, and savings estimates.
• To carry out cancellations you request, keep you updated on their status, and confirm completion.
• To send renewal reminders, price-increase alerts, and free-trial alerts you have enabled.

Business operations

• To manage billing and plan entitlements for purchases made through the app stores.
• To respond to inquiries and provide customer support.
• To send service-related and administrative communications.
• To monitor, debug, secure, and improve the Service, and to prevent fraud and abuse.

Legal compliance

• To comply with applicable legal obligations and respond to lawful requests from authorities.

We do not: process payments or move money, act as a financial institution, provide financial advice, use your financial or email data for advertising, or sell your personal information.

3. Legal bases for processing (EU/EEA and UK users)

Where the GDPR or UK GDPR applies, we process your personal data on the following grounds: consent, when you connect a bank or email account or opt in to marketing communications (you may withdraw consent at any time); performance of a contract, to deliver the subscription detection, tracking, and cancellation services described in our Terms; legitimate interests, to secure and improve the Service and prevent fraud, provided your rights do not override those interests; and legal obligation, where processing is required by law.

4. How we share your information

We do not sell, rent, or trade your personal information, and we do not share your financial or email data for advertising purposes or with data brokers. We share information only in these circumstances:

• Merchants, to carry out cancellations you request: the account verification details described in Section 1, shared only with the specific merchant and only to complete your request.
• Financial data provider: Plaid, to establish and maintain your bank connection.
• Technology providers: vendors that support the Service, such as cloud hosting and infrastructure, app analytics, crash reporting, subscription billing management, push notification delivery, and customer support tooling. Each is bound by contractual confidentiality and data-protection obligations and may process data only on our instructions.
• Legal requirements: where required by law, court order, or governmental request, or where necessary to protect the rights, property, or safety of Oncancel, our users, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to equivalent privacy protections and with notice to you.
• With your consent or at your direction, for example when you use the share feature to share your savings.

We may also share aggregated or de-identified information that cannot reasonably be used to identify you.

5. Data security

• Encryption: all data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256).
• Access controls: role-based access with multi-factor authentication on administrative systems, security logging, and monitoring.
• Credential protection: banking credentials are provided directly to Plaid and are never stored by or visible to Oncancel. Gmail access tokens are stored encrypted and can be revoked by you at any time.
• Assessments: regular vulnerability management, and an annual independent security assessment of our Gmail integration as required by Google for restricted-scope access.
• Data minimization: we collect only the data needed to run the Service and delete or anonymize data per the retention schedule below.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we continuously monitor and improve our practices.

6. International data transfers

Your information may be processed in countries other than your own, including the United States, where our service providers operate. Where data is transferred internationally from the EU/EEA or UK, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, adequacy decisions where available, and contractual data-protection commitments with all service providers.

7. Data retention

• Account data: retained while your account is active. Accounts inactive for 2 years may be archived. When you delete your account, personal data is deleted or anonymized within 30 days of the verified request.
• Financial and subscription data: transaction-derived data is retained while the relevant connection is active and for as long as needed to provide your subscription history. Disconnecting a bank or email account stops further collection from that source.
• Billing records: purchase metadata may be retained for up to 7 years where required for tax and accounting purposes.
• Security and audit logs: retained for up to 3 years for security and compliance purposes.
• Backups: deleted data may persist in encrypted backups for up to 30 days but is not available in the live Service.
• Legal holds: data may be retained longer where necessary for legal proceedings or required by law.

8. Your privacy rights

All users

You can access a copy of your personal data, correct inaccurate information, request deletion of your data, receive your data in a portable format, opt out of marketing communications, and close your account. You also have specific controls over your connected data: disconnect a bank or email account at any time from Settings, choose which accounts to connect, and revoke Google access directly from your Google Account.

EU/EEA and UK residents (GDPR)

You additionally have the rights to restrict or object to certain processing, to withdraw consent where processing is based on consent, and to lodge a complaint with your local data protection authority. Contact support@oncancel.com to exercise these rights.

California residents (CCPA/CPRA)

You have the rights to know the categories and specific pieces of personal information we collect, to delete and to correct personal information, to opt out of sale or sharing (we do not sell or share personal information as defined by the CCPA), and to non-discrimination for exercising your rights. To exercise California rights, email support@oncancel.com with "California Privacy Request" in the subject line. We will verify your request and respond within the timelines required by law.

9. Children's privacy

The Service is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it promptly.

10. Third-party links and services

The Service may contain links to third-party websites or services, including merchant sites. This Policy does not apply to those external services, and we encourage you to review their privacy policies.

11. Do-Not-Track signals

There is currently no accepted standard for Do-Not-Track browser signals, and we do not respond to them. We will update this Policy if a standard is established.

12. Reporting security vulnerabilities

If you believe you have found a security vulnerability in the Service, report it privately to security@oncancel.com with a description, reproduction steps, and any supporting material. We aim to acknowledge reports within 3 business days. We will not pursue legal action against researchers who report in good faith, avoid privacy violations and data destruction, and give us reasonable time to fix the issue before public disclosure.

13. Changes to this policy

We may update this Policy to reflect changes in the Service, our practices, or applicable law. Minor changes are posted with an updated "Last updated" date. For material changes, we will give you advance notice in the app or by email and, where required by law, obtain your consent before the changes apply.

14. Contact us

Endure Labs, Inc. — Data Controller
2228 Ellesworth Avenue, Copper Canyon, TX 75077, USA

Privacy inquiries: support@oncancel.com with the subject line "Privacy Request".
Security reports: security@oncancel.com.