What we ask, what we keep

A key that can only read

You create a restricted key (it starts with rk_live_) with Read access to these, and nothing else:

• Customers: who each subscription belongs to (names are shown to you, never stored).
• Subscriptions: plans, trials, scheduled cancellations and the reasons people give.
• PaymentMethods: cards that expire before the next charge.
• Products: plan names in your list.
• Prices: how much each plan is worth per month.
• Coupons: discounts, so a 100% coupon doesn't count as a paying customer.
• Events: plan downgrades and new cancellations between syncs.
• Connected accounts: which Stripe account this is, so it can only be connected once. We read your own account, never anyone else's.

It can't charge, refund, cancel, email your customers or change anything. We refuse secret keys (sk_), which can. We don't register webhooks in your account, because that would need write access.

How the key is stored

Encrypted with AES-256-GCM before it touches the database. The encryption key lives in our hosting environment, not in the database, so a copy of the database alone can't read a single Stripe key. Only our server decrypts it, in memory, to call Stripe: to sync, to show you your list and to send your alerts.

What we keep

• Stripe ids of the subscriptions and customers in your private list, with amounts, dates and status.
• A daily summary with no names: MRR, number of customers, churn, cancellation reasons by count.

We never store your customers' names or emails. We ask Stripe for them when you open your list or when we send you an alert, and forget them after.

What's public

Your profile, from the moment you connect: your monthly churn, and the other numbers you choose to show. Never a customer, never a reason for a specific cancellation. Aggregates across all accounts ("the most common reason to leave is price") are anonymous by construction.

Disconnecting

One button in your settings. It deletes the key, the list, the summaries and the profile, right away. You can also revoke the key in Stripe at any moment: we stop reading the second you do.

Found something?

Write to hello@trustchurn.com. We answer security reports first.