Your inbox is yours.

Data we access

The Trimlane Chrome extension requests read-only access to your Gmail account via Google OAuth2. It searches only for emails whose subject matches billing-related terms (receipt, invoice, renewal, subscription, and their French equivalents). For those candidate emails it reads the sender, subject, headers, and message body to identify subscription billing emails and extract the details listed below.

Email bodies are processed entirely in memory on your device: once the billing details are extracted, the body is discarded — never stored, never transmitted.

Trimlane never modifies, deletes, or sends emails on your behalf.

Data we store on your device

When a subscription is detected, Trimlane saves it to chrome.storage.local on your computer. Each detection holds:

• Service name (e.g. Netflix, Spotify)
• Billing amount and currency
• Billing frequency (monthly, annual, etc.)
• Next billing date and cancellation date, when available
• Plan name, when available
• The sender address and subject line of the email it came from — shown on the review screen so you can check a detection against a real receipt
• The Gmail message id of that email — powers the "open in Gmail" link back to the original message

While a scan runs, the extension also keeps the list of Gmail message ids matching your billing search, so an interrupted scan can resume instead of starting over. It is deleted when you disconnect.

All of this stays on your device. Your Gmail access token is not among it — Chrome holds that in its own credential store.

What we don't collect

"Collect" means leaving your device. Trimlane has no server and no accounts, so nothing you scan is ever sent to us — including the sender addresses, subject lines and message ids saved locally above.

• Emails unrelated to billing — only messages matching billing search terms are ever fetched
• Email content — bodies are read in memory to extract billing details, but never stored and never transmitted
• Email attachments
• Contact lists or address books
• Browsing history or activity outside Gmail
• Analytics, telemetry, crash reports, or tracking of any kind

Where your data goes

Detected subscriptions are stored locally in your browser via chrome.storage.local. This data never leaves your device except when you choose to move it yourself:

• QR code export — subscription data is encoded into a QR code on your screen. You scan it with the Trimlane iOS app to import your finds. The transfer happens locally between your screen and your phone's camera — no server is involved.

The QR code carries only the subscription facts: service, amount, currency, billing frequency, next billing date, plan and cancellation date. The sender address, subject line and Gmail message id are deliberately left out of it, and an automated test enforces that so it cannot regress.

Third-party services

• Supabase — the extension downloads a public service catalog (known subscription names and domains). No email content, message ids, addresses or account identifiers are ever sent there. The request does include a two-letter country code derived from your browser's language setting, so the catalog can return prices and plan names for your country.
• Google Gmail API — used with read-only scope to fetch billing-related emails.
• Google OAuth revocation — when you tap Disconnect in the extension's settings, your access token is sent to Google's revocation endpoint to end Trimlane's access. Nothing else is sent, and only when you tap it.

Data retention

• Settings → Disconnect deletes your stored scan results immediately. Starting a new scan replaces the previous results.
• Uninstalling the extension removes everything it stored.
• Disconnecting deliberately keeps two things that contain no personal data: your extension settings, and the cached public service catalog.
• No user data is stored on any external server, because there is no external server.
• No analytics, telemetry, or tracking data is collected.

Google API Services User Data Policy

Trimlane's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Your control

• Disconnect from the extension itself — Settings → Disconnect revokes Trimlane's access with Google and deletes the scan results on your device, in one action.
• You can also review or remove access from your Google Account permissions anytime.
• Clear all locally stored data by uninstalling the extension.
• Inspect exactly what's stored via Chrome DevTools → Application → Storage.

Changes to this policy

If we update this privacy policy, the revised version will be posted at this URL with an updated "Last updated" date.

Contact

Questions about this privacy policy? Reach us at privacy@trimlane.app.