Privacy Policy
Walkaway does one thing: it finds the paid subscriptions you're signed into, goes through each one's cancellation flow on your behalf as far as the loyalty offer a company makes to keep you, and stops there. It is built never to finish a cancellation. This policy explains what data that involves.
What we collect, and why
- Names of websites you're signed into. With your permission, the extension looks at the names of cookies on your device to work out which sites you have an account with, and sends only those site names (for example
hulu.com) to our service to pick out the subscription services. That list says which sites you use, so we use it only for this and don't keep it: our service remembers which domains are subscriptions, not who asked. Cookie values and passwords never leave your browser. - Text of the pages the extension works on. During a scan, and again when it accepts the offers you picked and checks your billing page, the extension sends the visible text and the list of buttons and links on a subscription's account and cancellation pages to our AI service, so it can read your plan and price and decide what to press. Login tokens, card numbers and most street addresses are removed in your browser first. Names and email addresses on those pages are sent, because reading the account needs them. We don't keep this text.
- A record of the steps each walk took. To answer refund requests and complaints, and to check that a walk was done properly, we keep one short record per step: which service, the site and the ordinary path words of the page (such as
netflix.com/cancelplan), which kind of screen (for example "exit survey" or "offer"), what Walkaway did there, and the words on the button it pressed or the answer it chose. Names, email addresses, numbers and any other word that isn't an ordinary button word are removed before the record is saved. It also holds the rules' reason when they stopped an action, an offer's numbers, the time to the minute, and which versions of the extension and the AI were used. It never holds the pages themselves, passwords, card details, the full web address of a page, or anything you or Walkaway typed. Each record carries a random run reference made on your device instead of your name; the extension shows you that reference after each scan. If you go to checkout, Stripe keeps that reference with your card and email, so the record of a run you were charged for can be linked to you; we use that link only to answer a refund request, a complaint or a card dispute. We don't keep these records for any service we recognise as dating, adult, religious, health or recovery related; if you find one we missed, tell us and we'll delete it. - Email address and payment details. If you continue to checkout, Stripe collects your card and email. We receive your email and payment identifiers to charge the fee, email you a receipt and handle refunds; we never see or store card numbers. The receipt lists each service from the run, what Walkaway did there, the prices before and after, the saving and the fee. Stripe keeps those lines with the payment (only the numbers, for a service we don't record; see below), so a receipt can be sent again and a card dispute answered; we keep no copy of our own.
- Results. The outcome of each walk (which service, the price before and after, the offer) is kept in your browser's extension storage.
- Messages you send us. What you write in our contact form, with the email address you give for our reply, reaches us as an email. We keep it as email to answer you and for no other purpose.
- Visits to this website. We count page views, "Add to Chrome" clicks and visits that came from a "Tell a friend" link, per day and per web address of ours, to see which of our pages works better. The counts hold nothing about you: no cookies, no IP address, nothing that tells one visitor from another. A "Tell a friend" message is written in your own email: we never see who you send it to.
- Daily limits. Scans are free, so to keep them affordable and stop abuse we count scans per day for each installation of the extension (by a random code it makes when installed) and for each network address (stored as a one-way code, never the address itself), and we add up what the AI service costs us each day, in total and per network (the same one-way code). If a walk may have cancelled something, we also note which networks reported it (the same one-way code), so a service is paused only when more than one did. The counts and reports per installation and per network are deleted after two days; the day's total says nothing about anyone and is kept 90 days.
How we use it
Only to provide the service described above: finding your subscriptions, going through cancellation flows to reach and accept the offers you pick, checking the new price, charging the fee you agreed to, emailing your receipt, answering refund requests and complaints, and keeping the service safe and within its daily limits. If a walk may have cancelled something, we are alerted with the service and the run reference (never your name, and no reference for a service we don't record), and once more than one network reports it, walks on that service pause for everyone until we have looked. We do not use your data for advertising, do not build profiles, and do not sell or rent data to anyone.
Who else sees it
- Google (the Gemini API) receives the site names and page text to make each decision, and processes them under the Gemini API terms, which allow it to keep requests for a limited time to detect abuse.
- Cloudflare runs our service and website, stores the step records and the visit counts in the United States, delivers our email (your receipt, contact form messages and mail to our addresses), and checks that the contact form is used by a person (Turnstile). Its request logs, which include IP addresses, are kept for up to 7 days.
- Stripe processes payments, holds your card details and the receipt's lines, and sends an invoice if your bank asks to confirm a charge or your card is declined, under its own privacy policy.
We share data with these providers only because it is needed to provide the service, and with no one else except as required by law.
What we never do
- Use or send cookie values, or passwords.
- Open sites you're not signed into, sites on your Never-explore list, or the banking, government, health, insurance and payroll sites on our built-in list; a page that reads like one of those is left alone too.
- Keep the pages Walkaway reads.
- Have a person look at your records, except to answer your request (a refund, a complaint, a deletion), for security, or as the law requires.
How long we keep it
- Step records: 90 days, then deleted automatically. For a run you were charged or invoiced for, 18 months, so a refund request or a card dispute can still be answered.
- Request logs (Cloudflare): up to 7 days.
- Payment records and receipt lines (Stripe): as long as the law requires for accounting. Your receipt email is yours to keep or delete.
- Daily counts per installation and per network: two days. The day's total AI cost (nothing about anyone): 90 days.
- Site names and page text: not kept by us.
- Contact form messages: as email, as long as needed to answer you and keep a record of what we promised.
- Visit counts: kept as daily totals; they hold nothing about any visitor.
Your choices and rights
- The extension asks for site access at your first scan; you can decline. It also asks you to agree to this policy, and asks again if what we keep changes.
- Restricted mode limits scans to sites you list; the Never-explore list names sites it must never touch.
- To see or delete the step records of a run, email us its run reference. We delete them, except for a run you were charged or invoiced for while a refund or card dispute is still possible.
- Uninstalling the extension deletes everything it stored in your browser.
Contact
Walkaway is run by [legal name and mailing address — fill in before publishing]. Questions or requests: privacy@trywalkaway.com or our contact form.