Your data, clearly handled.

KillSwitch is a money guardrail and subscription-management app built to help users understand recurring subscriptions, bills, transactions, budgets, savings goals, shopping plans, net worth, cashflow pressure, alerts, and financial dashboard insights. For privacy questions, account requests, or data questions, contact support@killswitch.world.

We operate from Papua New Guinea. The app may serve users in other countries and may rely on providers in other regions to host the product, process payments, connect financial accounts, deliver notifications, and support secure sign-in.

For this policy, KillSwitch, we, us, and our refer to the operator of the KillSwitch service. If a separate registered legal entity is named as the operator, we will update this page and related terms so users can identify the responsible legal entity.

The service works by organizing information from sources a user chooses to connect or enter, such as bank and card transaction data, account balances, Gmail subscription and billing messages, budget settings, bill details, goal targets, shopping lists, and account preferences. We use that information to show subscription records, renewal patterns, possible waste, cancellation signals, bill reminders, spending categories, budget guardrails, goal progress, net worth summaries, and alerts inside the user account.

We are not a bank, lender, credit bureau, broker, investment adviser, insurance provider, tax adviser, debt adviser, legal adviser, or payment card issuer. The service does not move money, make payments, cancel subscriptions directly with merchants, open financial accounts, verify employment, determine creditworthiness, or make final financial decisions for users. Dashboard insights are informational tools, not professional financial advice.

This summary highlights the main points of the policy. It does not replace the full sections below, but it gives users and reviewers a fast view of the data practices that matter most.

• We use personal data to run subscription detection, bills, transactions, budgets, goals, shopping-list planning, net worth summaries, money guardrails, analytics, alerts, account access, support, billing status, security, and connected-provider features.
• Gmail import, bank connections, push notifications, and paid billing require user action or provider authorization before they are used.
• We do not sell personal data, and we do not use connected bank data, balance data, transaction data, budget data, goal data, shopping-list data, net worth data, or Gmail-derived data for advertising profiles, retargeting, lending, employment, insurance, or housing decisions.
• Payment card details are handled by Paddle, bank authentication is handled through Plaid, and Gmail access is handled through Google OAuth.
• Users can contact support to request access, correction, deletion, or review of account data, subject to lawful retention limits.
• Regional sections such as California and GDPR apply only where those laws apply to the user, the service, or the relevant processing activity.

This Privacy Policy explains how information is collected, used, stored, protected, shared, transferred, and deleted when a user visits the website, creates an account, connects supported providers, uses the dashboard, starts a paid plan, or contacts support.

We use personal data to provide, maintain, secure, bill for, support, and improve the service. This includes account access, subscription detection, subscription analytics, bills, transactions, budgets, goals, shopping lists, net worth summaries, safe-to-spend style guardrails, alerts, Gmail import, connected bank or card signals, Paddle billing status, support requests, security checks, and legal or operational records.

By using the service or submitting information, users agree that information may be collected and used as described in this policy. Some features, such as Gmail import, bank connection, push notifications, or paid billing, require separate user action or provider authorization before they can be used.

Some words in this policy have specific meanings. Singular and plural forms are interpreted consistently unless the context clearly requires something different.

Account

A unique account created for a user to access the service or specific parts of the service.

Affiliate

An entity that controls, is controlled by, or is under common control with another entity. Control generally means ownership of 50% or more of voting shares, equity interests, or similar authority.

Application

The KillSwitch website, dashboard, software, and related money-guardrail and subscription-management experience provided to users.

Business

For CCPA/CPRA purposes, the legal entity that determines the purposes and means of processing California consumer personal information where those laws apply.

CCPA/CPRA

The California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020.

Company, we, us, or our

KillSwitch, the operator of this service. We operate from Papua New Guinea.

Consumer

For CCPA/CPRA purposes, a natural person who is a California resident as defined by applicable California law.

Data Controller

For GDPR purposes, the party that determines the purposes and means of processing personal data. Where GDPR applies, we may act as the controller for account, product, billing-status, support, and connected-provider data described in this policy.

Device

A computer, phone, tablet, browser, or other device that can access the service.

Do Not Track or DNT

A browser setting promoted by U.S. regulators, including the Federal Trade Commission, as a way for internet users to signal tracking preferences across websites.

GDPR

The General Data Protection Regulation, formally Regulation (EU) 2016/679.

Personal Data

Information that identifies, relates to, describes, can reasonably be linked to, or could identify an individual, depending on the privacy law that applies.

Service

The KillSwitch application, website, dashboard, account tools, subscription detection features, bills, transactions, budgets, goals, shopping lists, net worth tools, alerts, billing access, automated insights, and related support services.

Service Provider

A company or person that processes information for us or helps us provide, host, secure, bill for, support, analyze, or maintain the service. For GDPR purposes, some service providers may be data processors.

Third-Party Sign-In Service

A third-party account provider that lets a user create an account or sign in. The service currently supports Google sign-in where available and does not currently offer Facebook, Instagram, Twitter/X, or LinkedIn sign-in.

Usage Data

Information collected automatically from the service or service infrastructure, such as page visits, feature actions, session events, device/browser information, diagnostic logs, sync status, and time spent on pages.

User, you, or data subject

The individual accessing or using the service, or the company or other legal entity on whose behalf that individual uses the service. Under GDPR, this person may be called a data subject.

We may handle the information needed to create an account, run the dashboard, detect subscriptions, organize money guardrails, send alerts, process billing, and support users.

• Account details such as name, email address, login method, support messages, and account preferences.
• Subscription records such as merchant names, amounts, billing dates, renewal patterns, cancellation status, and price-change signals.
• Connected account metadata such as institution name, account type, masked account details, connection status, and refresh status.
• Connected balance data such as current balances, available balances, account type, account nickname, balance refresh status, and balance history where available.
• Transaction signals such as merchant names, dates, amounts, categories, pending or posted status, refunds, deposits, income-like transactions, failed payments, repeated billing patterns, and spending trends.
• Bill, budget, goal, shopping-list, and net worth data such as bill names, due dates, expected payment amounts, budget categories, safe-to-spend calculations, savings targets, saved amounts, planned purchases, account balances, assets, liabilities, and progress estimates.
• Gmail-derived subscription and billing signals such as receipts, invoices, trial reminders, renewal notices, cancellation confirmations, refund notices, and payment-failure emails.
• Derived insights such as recurring charge detection, bill predictions, category estimates, cashflow pressure, goal completion estimates, duplicate or dormant subscription signals, unusual deposit alerts, and other dashboard analytics.
• App usage and technical information such as device/browser type, basic logs, feature actions, notification delivery status, and security events.

The service may collect personal data, usage data, diagnostic data, and information from sign-in or connected-account providers. The exact information depends on how a user visits the website, creates an account, signs in, connects Gmail or bank data, starts billing, changes settings, or contacts support.

We collect or receive personal information from a few source categories, depending on how a user interacts with the service and which features they choose to connect.

• Directly from the user, such as account details, support messages, settings, notification preferences, cancellation notes, budgets, bills, goals, shopping-list entries, and information entered into forms.
• From user activity in the app, such as dashboard actions, sync activity, alert settings, subscription reviews, cancellation tracking, budget changes, bill confirmations, goal updates, shopping-list actions, and basic product events used to keep the service working.
• Automatically through cookies, local storage, device/browser information, security checks, logs, and similar technologies used for sign-in, reliability, preferences, and session protection.
• From connected providers the user authorizes, such as Plaid for bank and card account metadata, balance data, transaction signals, and merchant details; Google for Gmail authorization and Gmail-derived subscription and billing signals; and Paddle for billing status, checkout, invoices, receipts, refunds, and subscription management.
• From service providers that help operate the product, such as hosting, authentication, database, support, notification, security, debugging, and reliability providers.

The service is not built around third-party advertising vendors. If advertising or optional analytics providers are added later, this policy will be updated to explain what they collect and what choices users have.

We use connected bank, card, and Gmail signals to make the dashboard more accurate. For example, a transaction may show that a streaming service charged a user, while Gmail may show a renewal notice, trial reminder, cancellation confirmation, or refund notice from the same merchant. Connected transaction and balance data may also support budgets, bill planning, safe-to-spend style guardrails, goal progress, shopping-list planning, net worth summaries, cashflow insights, and alerts.

Bank authentication is handled through a third-party bank connectivity provider. We do not need to store bank usernames, bank passwords, full card numbers, or full account numbers. Gmail access is authorized through Google OAuth, and users choose whether to connect their Google account.

Connected data is used to power user-facing money guardrails, not to make lending, insurance, employment, housing, or credit decisions. The app looks for recurring billing patterns, subscription merchant names, bill-like charges, deposits, spending categories, account balances, renewal messages, receipts, cancellation confirmations, refund notices, failed-payment messages, unusual activity, and similar signals that support the dashboard.

Gmail import is optional. A user must choose to connect a Google account before the app can scan Gmail for subscription-related signals. Google authorization uses the Gmail API with the read-only scope gmail.readonly, which lets the service read Gmail messages but does not let it send email, delete email, change labels, or edit the mailbox.

When Gmail import is enabled, the service searches for messages that look related to subscriptions, billing, renewals, receipts, invoices, trials, cancellations, refunds, price changes, plan changes, failed payments, and similar account or merchant notices. The sync may read message subjects, sender names, sender email addresses, dates, snippets, and message body text so it can detect those subscription and billing signals.

We store only the Gmail connection details and extracted subscription or billing signals needed to run the dashboard, such as the connected Google email address, encrypted OAuth tokens, Gmail message IDs, thread IDs, sender details, subjects, short snippets, detected merchant names, detected amounts, billing-related signal types, confidence scores, dates, linked alerts, linked bill signals, and linked subscription records.

We do not store Gmail attachments, contact lists, address books, calendar data, sent-mail actions, or full mailbox copies. Full message bodies are processed only to detect subscription, receipt, invoice, renewal, cancellation, refund, payment-failure, and billing-related signals and are not retained as full raw email content after the sync finishes.

Gmail-derived data is not sold, used for advertising, used for retargeting, used to train unrelated models, or shared with third parties for their own marketing. Human access to Gmail-derived data is limited to user-approved support, security review, legal compliance, or operational needs permitted by applicable platform rules.

Users can disconnect Gmail from account settings. Disconnecting removes stored access and refresh tokens so future Gmail scans stop. Users may also delete Gmail-derived email signals from the app and revoke the app's Google access from their Google Account permissions page at https://myaccount.google.com/permissions.

KillSwitch now includes dashboard features beyond subscription detection. These features may use user-entered data, connected bank/card data, Gmail-derived billing signals, and app-generated calculations to help users see what is due, what is protected, what is planned, and what may need attention.

• Transactions: merchant names, transaction dates, amounts, categories, pending or posted status, refunds, failed payments, deposits, recurring patterns, and user edits to transaction categories or notes.
• Bills: bill names, expected amounts, due dates, payment status, recurring schedules, overdue or upcoming signals, bill categories, reminders, and confirmation history.
• Budgets and cashflow: budget categories, spending limits, safe-to-spend style calculations, income or deposit timing, bill reserves, protected amounts, spending trends, and budget pressure alerts.
• Goals: goal names, target amounts, saved amounts, contribution schedules, priorities, expected completion dates, protected savings calculations, and progress history.
• Shopping lists and planned spending: list names, planned purchase amounts, categories, item-level details where provided, due dates, budget impact, and whether planned spending affects protected money.
• Net worth: connected account balances, balance refresh status, assets, liabilities, account groupings, historical balance movement where available, and summary calculations shown to the user.
• Insights and derived signals: recurring charges, subscription status, duplicate charges, dormant subscriptions, unusual deposits, bill predictions, category estimates, goal completion estimates, cashflow pressure, savings estimates, and other dashboard analytics.

These dashboard calculations are meant to help users understand their own money patterns. They may be incomplete, delayed, estimated, or affected by provider availability, merchant naming, pending transactions, user settings, or missing data. Users should verify important financial decisions directly with their bank, card issuer, merchant, accountant, or qualified professional where appropriate.

KillSwitch may use automated rules, pattern detection, categorization logic, and AI-assisted services to generate user-facing insights. Examples include identifying recurring bills, detecting subscriptions, categorizing transactions, estimating safe-to-spend amounts, summarizing money pressure, finding duplicate or dormant subscriptions, predicting renewal dates, and explaining why an alert appeared.

When AI-assisted features are used, we aim to send only the information reasonably needed for the feature, such as merchant names, amounts, dates, categories, subscription context, user-selected records, or diagnostic context. We do not use connected bank data, Gmail-derived data, budget data, goal data, or net worth data to train unrelated models or build advertising profiles.

AI and automated insights can be wrong, incomplete, delayed, or based on limited context. They are informational product features, not professional financial, tax, legal, credit, investment, insurance, employment, housing, or debt advice. Users remain responsible for reviewing the underlying information and making final decisions.

We use data to provide user-facing money guardrail and subscription management features, including:

• Detecting recurring subscriptions that may otherwise be easy to miss.
• Showing upcoming renewals, billing dates, subscription amounts, and merchant details.
• Detecting price increases, failed payments, refunds, trial endings, and unusual subscription activity.
• Matching cancellation confirmations with future charges so users can see if a canceled service continues billing.
• Showing transactions, categories, bills, due dates, account balances, net worth summaries, and budget status.
• Calculating budget pressure, safe-to-spend style amounts, bill reserves, protected goal money, planned shopping impact, and other dashboard guardrails.
• Detecting paycheck-like deposits, unusual deposits, recurring bills, duplicate charges, spending changes, and other financial activity signals.
• Generating automated or AI-assisted explanations, alerts, summaries, and insights for the user's dashboard.
• Sending in-app notifications and alerts based on the user's settings.
• Securing accounts, preventing abuse, debugging technical issues, and responding to support requests.

We use and share personal information only for purposes tied to operating, supporting, securing, billing for, improving, or lawfully protecting the service. The examples below explain the main situations in clearer detail.

• We do not sell personal data.
• We do not knowingly share personal data for cross-context behavioral advertising.
• We do not use Gmail data for advertising, retargeting, or interest-based ads.
• We do not use budget, goal, shopping-list, balance, net worth, or support-ticket data for third-party advertising profiles.
• We do not use connected bank or Gmail data to determine creditworthiness, lending eligibility, insurance eligibility, employment eligibility, or housing eligibility.
• We do not collect Social Security numbers, credit reports, precise device location, employment verification data, insurance information, or property valuation data for the current KillSwitch service.
• We do not ask for or store bank login credentials.
• We do not need full card numbers or full bank account numbers to run the dashboard.
• We do not let humans read Gmail content unless necessary for user-approved support, security, legal compliance, or operations permitted by applicable platform rules.

We use service providers to operate specific parts of the product. These providers may process limited data only as needed for their role, such as authentication, hosting, database storage, notifications, payment processing, bank connectivity, Gmail OAuth, security, AI-assisted insights, and customer support.

Important providers may include Supabase for authentication and database services, Vercel for hosting, Google for Gmail and Google sign-in, Plaid for connected bank and card account metadata, balance data, and transaction data, Paddle for checkout, tax, receipts, invoices, billing status, refunds, and subscription management, OpenAI or similar AI service providers for selected AI-assisted dashboard insights where enabled, and notification providers such as Firebase Cloud Messaging, Apple Push Notification service, or web push services for app alerts.

We do not give providers permission to use user data for their own advertising or unrelated data products. Provider access is limited to what is needed to deliver, secure, support, or bill for the service.

Service providers may collect, store, use, process, or transfer information only as needed for the parts of the service they support. Their processing is also governed by their own privacy policies, terms, security standards, and data-processing commitments.

The sections below explain important provider categories in more detail. They are written to reflect the providers the app actually uses or expects to use, not every provider named in competitor policies.

We use cookies, local storage, and similar technologies when they are needed to keep users signed in, protect sessions, remember basic preferences, support checkout and connected-account flows, understand whether important flows are working, and improve reliability.

These technologies may store session identifiers, authentication state, preference choices, security checks, checkout state, connection-flow state, notification preferences, and basic product events such as whether a sync, alert, or settings update succeeded. We use this information to keep the app stable, secure accounts, and fix broken flows.

The service is not currently built around third-party advertising cookies or cross-site advertising trackers. If optional analytics, advertising, or preference controls are added later, this policy will be updated and the website will provide any consent or opt-out choices required by applicable law.

Some browsers let users limit cookies or clear stored data. If a user disables necessary cookies or browser storage, sign-in, dashboard access, notification settings, checkout state, or connected-account flows may not work as expected.

The service is designed to limit sensitive data exposure. We use encrypted connections, access controls, provider-managed authentication where appropriate, and separation between user-facing app features and backend-only service credentials.

Payment card details are handled by Paddle and bank login credentials are handled by the bank connectivity provider. We store only the billing status, subscription records, connection status, merchant details, transaction-derived signals, balance and net worth summaries, bill, budget, goal, shopping-list, alert, support, and other account data needed to run the app.

No online service can promise perfect security. Users are encouraged to protect their account credentials, use trusted devices, review connected accounts, disconnect services they no longer want linked, and contact support@killswitch.world if they believe their account or data has been affected.

Protecting personal data is important to us. We use reasonable technical, organizational, and provider-based safeguards designed to protect account information, connected-account metadata, billing status, subscription records, transaction-derived signals, balance data, bill, budget, goal, shopping-list, net worth, support, Gmail-derived subscription and billing signals, and other information handled by the service.

Those safeguards may include encrypted connections, encrypted storage for sensitive tokens where supported, access controls, provider-managed authentication, service-role separation, database row-level security, limited internal access, logging for security events, and reliance on trusted providers for highly sensitive workflows such as payments, bank connections, and Google authorization.

Even with these safeguards, internet transmission and electronic storage can never be guaranteed to be completely secure. We cannot promise absolute security, and users are encouraged to use strong account credentials, keep their devices protected, review connected accounts, disconnect integrations they no longer use, and contact support@killswitch.world if they suspect unauthorized access or a security issue.

We keep information for as long as needed to provide the service, maintain the user's account, comply with legal or billing requirements, prevent fraud or abuse, resolve disputes, and improve reliability.

Subscription records, transaction-derived signals, Gmail-derived subscription and billing signals, bill details, budget settings, goal details, shopping-list entries, net worth summaries, preferences, alerts, and connection metadata may remain while the account is active so the dashboard can show history, trends, renewals, cancellations, spending patterns, protected money, goal progress, and savings estimates.

Users may request account deletion or data assistance by contacting support. Some limited records may be retained where necessary for security, fraud prevention, billing, tax, legal compliance, dispute handling, backup integrity, or to prove that a request was completed.

Personal information is kept only for as long as it is reasonably needed for the purposes described in this policy. That may include providing the dashboard, detecting subscriptions, organizing transactions, bills, budgets, goals, shopping lists, net worth summaries, and money guardrails, maintaining account access, sending alerts, processing billing status, supporting users, securing the service, and keeping records needed for business operations.

We may retain and use certain information where necessary to comply with legal obligations, tax or accounting duties, billing requirements, fraud prevention needs, security requirements, dispute resolution, enforcing terms, or other lawful bases that apply to the service.

Usage data and technical logs are generally kept for a shorter period than core account or billing records, unless the information is needed longer to improve service functionality, investigate errors, protect security, prevent abuse, respond to legal requirements, or preserve operational integrity.

When information is no longer needed, we delete it, de-identify it, aggregate it, or limit access to it where reasonable and appropriate for the type of information and the system where it is stored.

Users can manage parts of their privacy experience directly inside the app or by contacting support.

• Connect or disconnect supported data sources where the app provides that control.
• Adjust notification preferences for subscription, bill, budget, goal, money-guardrail, and connection-health alerts.
• Request help reviewing account data, connected data, or privacy questions.
• Request account deletion, subject to limited retention where legally or operationally necessary.
• Choose whether to receive marketing emails where that setting is offered.

Users may have the right to delete personal information or ask for help deleting personal information we have collected about them. Users may also ask to access, update, correct, or amend personal information connected to their account.

Where account settings provide the option, users can manage certain information directly inside the dashboard, such as profile details, notification preferences, connected accounts, Gmail access, Gmail-derived email signals, budgets, bills, goals, shopping lists, and other account settings.

Users can also contact support@killswitch.world to request access, correction, deletion, or help reviewing personal information they provided or personal information associated with their account. Requests need to include the email address connected to the account and enough detail for us to understand what information the user wants reviewed or deleted.

Some information may need to be retained even after a deletion request. Examples include limited records needed for billing, tax, accounting, fraud prevention, security, legal compliance, dispute handling, backup integrity, enforcing terms, completing a transaction requested by the user, or proving that a privacy request was handled.

We may disclose personal information in limited situations where a disclosure is needed for a business change, a valid legal request, safety, security, or protection of legal rights. Any disclosure is limited to what is reasonably necessary for the situation.

Use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Gmail-related data is used to provide and improve visible user-facing subscription and billing features, such as detecting receipts, invoices, renewal notices, trial reminders, cancellation confirmations, refund notices, and payment-failure emails. Gmail data may support related dashboard alerts when those messages indicate a bill, subscription, refund, payment failure, or merchant change. We do not transfer, sell, or use Google user data for advertising, retargeting, personalized ads, creditworthiness, lending, or unrelated third-party data products.

The Gmail import section above explains the requested Gmail scope, the types of Gmail data processed, the limited subscription fields stored, deletion controls, and how users can revoke Google account access.

The website or dashboard may include links that take users to outside pages. These may include links to Paddle checkout or billing pages, Plaid connection screens, Google authorization pages, merchant cancellation pages, app store pages, support resources, financial-account resources, or other websites that help users manage subscriptions, bills, payments, connected accounts, or support requests.

When a user opens an outside link, the third-party website or service may collect information under its own privacy policy, cookie rules, security practices, and account terms. We do not control those outside pages and do not decide how they handle information after the user leaves our service.

Users are encouraged to review the privacy policy and terms of any third-party page before entering personal information, authorizing an account connection, completing a payment, changing billing settings, or submitting a cancellation request.

The service is intended for users who are at least 18 years old, or old enough under the laws where they live to manage their own financial accounts, subscriptions, payment permissions, connected bank data, and Gmail permissions.

It is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If a parent or guardian believes a child under 13 provided personal data, they can contact support@killswitch.world with enough detail for the account or information to be reviewed.

If we learn that personal information from a child under 13 was collected without verified parental consent, we will take reasonable steps to delete that information from active systems where appropriate.

In places where the law requires parental consent before a child or teenager can use an online service, we may require consent from a parent or guardian before collecting or using that person's information.

Depending on where a user lives, privacy laws may provide rights to access, correct, delete, restrict, or receive certain information about personal data. Users can contact support@killswitch.world to make a privacy request.

The regional sections below apply only where the relevant law applies to the user, the service, or the specific processing activity. Including a regional notice does not mean every listed law applies to every user or every feature.

We may need to verify the account holder before completing a request. Some requests may be limited where data must be retained for security, fraud prevention, billing, legal compliance, dispute handling, or operational integrity.

This California privacy notice supplements the rest of this Privacy Policy and applies only to visitors, users, and other consumers who reside in the State of California where California privacy law applies.

California privacy laws, including the California Consumer Privacy Act and California Privacy Rights Act, commonly referred to as CCPA/CPRA, require extra detail about categories of personal information, sources, uses, disclosures, sale or sharing, sensitive personal information, and privacy request rights.

The sections below use CCPA/CPRA category names and legal references where helpful. Those legal categories are broad, so a category marked as collected does not mean every example in that category is collected.

This General Data Protection Regulation (GDPR) notice supplements the rest of this Privacy Policy only for users in the European Union (EU), European Economic Area (EEA), and other places where GDPR applies to the user, the service, or the relevant processing activity.

The GDPR is Regulation (EU) 2016/679. It requires a lawful basis for processing personal data and gives individuals rights over their personal data, including rights to access, correct, erase, object, restrict, transfer, and complain to a supervisory authority in certain situations.

Because we operate from Papua New Guinea and use providers in other countries, personal data may be processed outside the EU or EEA when needed to provide the service. The international processing section explains that cross-border point in more detail.

We operate from Papua New Guinea, but the app is built with online providers that may process or store information in other countries. A user's account data, connected-account metadata, balance and transaction signals, dashboard records, billing status, notification records, support messages, AI-assisted insight requests where enabled, and technical logs may pass through systems outside the user's home country when that is needed to run the service.

This may happen when providers host infrastructure, process payments through Paddle, connect bank transaction or balance data through Plaid, authorize Gmail access through Google, deliver push notifications, maintain security systems, support AI-assisted insight features where enabled, or provide support from different locations. Where data is processed outside the user's location, different privacy and security laws may apply.

Personal information may be transferred to, processed in, or stored in places outside the user's state, province, country, or other local jurisdiction. This can happen because we operate from Papua New Guinea and use service providers, infrastructure, payment systems, bank-connectivity providers, Google services, notification providers, and support tools that may be located in other countries.

The privacy, data protection, government-access, and security laws in those places may differ from the laws where a user lives. By using the service, creating an account, connecting supported data sources, submitting information, or starting a paid plan, users understand that their information may be handled through those cross-border systems where needed to provide the service.

We take reasonable steps designed to keep transferred information handled securely and consistently with this policy. Those steps may include choosing reputable providers, limiting provider access to the purpose of the service, using encrypted connections, applying access controls, relying on provider security commitments, reviewing privacy terms where appropriate, and limiting sensitive data transfers to what is needed for account, dashboard, billing, bank connection, Gmail authorization, notification, AI-assisted insight, support, legal, or security purposes.

We do not knowingly transfer personal information to an organization or country for a purpose outside this policy unless an appropriate legal basis, user authorization, provider control, contract term, or other suitable safeguard applies.

We may update this policy when the product changes, when new providers are added, when privacy practices change, or when legal, security, billing, or platform requirements need clearer wording. Updated versions will be posted on this Privacy Policy page so users can review the current rules in one place.

If an update materially changes how we collect, use, share, store, or protect sensitive data, we will give a clear notice before the change takes effect when reasonably possible. That notice may appear by email, inside the dashboard, on the website, or through another prominent service notice.

Policy changes take effect when posted on this page, unless the notice says a later date applies. Users are encouraged to review this page from time to time, especially after connecting bank data, Gmail data, starting a paid plan, or using a new feature.

Questions, account requests, privacy requests, billing concerns, or security concerns can be sent to support@killswitch.world.