GLP1Prices - Tracker — Privacy Policy

The short version

GLP1Prices - Tracker keeps your medication record on your own phone. There is no account, no sign-in, and no copy of your entries on our servers. Your entries are not sent to us, with one exception that happens only if you ask for it: from app version 1.1, tapping "Get insight" sends this week’s numbers through our server to an artificial-intelligence service, which writes a short summary. We keep none of those numbers.

• Your doses, schedule, injection sites, weights, side-effect notes, daily check-ins, supply and the prices you pay are stored in an encrypted database on your device. • The app makes six kinds of network request: it downloads public pharmacy prices; it opens a pharmacy or telehealth link you tapped; only if you turn them on, it sends anonymous usage counts and crash reports; it asks Expo, our update provider, whether a newer version of the app is available; from version 1.1 and only when you tap "Get insight", it sends this week’s numbers for a summary; and, from version 1.2, it asks RevenueCat, our subscription provider, whether Premium is active. Only "Get insight" carries information about your health. See section 3. • From version 1.1, you can also let the app read your weight and sleep from Apple Health or Health Connect. What it reads stays on your phone. See section 5. • From version 1.2, price alerts are kept and checked on your phone. The app checks them with the same public price download it already makes, and the notification is created by your phone, not sent by us. See section 17. • From version 1.2, Premium is an optional subscription, sold and billed by Apple or Google, that includes price alerts and "Get insight". We never see your payment card or your Apple or Google account. See section 17. • We never sell your information, and we never use it for advertising. The app contains no advertising, marketing or attribution software. Its only use of artificial intelligence is the optional "Get insight" summary, which is written on our server and Anthropic’s, not on your phone.

This policy covers the mobile app only. The GLP1Prices.ca website has its own privacy policy.

Versions 1.0 and 1.1 of the app are not offered in Quebec, and they collect nothing at all from a phone whose owner tells them they are in Quebec. From version 1.2, the app is offered in Quebec too. See section 1.

1. Who we are

GLP1Prices - Tracker is published by Onset Security Inc, a Canadian corporation, which also operates the website GLP1Prices.ca. In this policy, "we" and "us" mean Onset Security Inc.

The person in charge of the protection of personal information, as required by Quebec's Act respecting the protection of personal information in the private sector (Law 25, s. 3.1), holds the title Privacy Officer and can be reached at privacy@glp1prices.ca.

Versions 1.0 and 1.1 of the app are offered in Canada outside Quebec. The first thing they ask is which province you fill your prescription in, and a Quebec answer ends there with a notice: no consent is recorded, nothing is written to the device, and no price request is ever made for Quebec. From version 1.2, the app is offered everywhere in Canada, Quebec included, and a Quebec answer sets it up like any other province. The GLP1Prices.ca website serves every province, and this policy does not cover it.

2. What the app stores on your phone

Everything you record in the app stays in an encrypted database inside the app on your device:

• the medication you selected, its strength and how you take it • the doses you log, with the date, time and the injection site you chose • your schedule and reminder settings • weight entries, if you record them, including any you import from Apple Health or Health Connect (from version 1.1), marked with where they came from • side effects you record, including names you add yourself, with severity and notes • daily check-ins, if you record them: sleep, mood, energy, bowel movements and notes, and, from version 1.2, stress, hunger, food noise and cravings (each on a scale of 1 to 5, only when you answer it) and whether you tapped "None today" for side effects • the weekly summary the app builds from these entries, on your phone • how much medication you have left and when you expect to run out • what you paid, at which pharmacy, and your province • your app settings and the consents you gave, with the date and version • from version 1.1, if you use them: the random code that "Get insight" uses (section 4), and the time of your last Apple Health or Health Connect import (section 5) • from version 1.2, if you set them: your price alerts, each with the medication and package it is for, your province, the price you chose and whether it is on (section 17) • from version 1.2, which of the check-in questions on stress, hunger, food noise and cravings are asked, a setting you choose in Settings → Daily check-in

The database is encrypted with AES-256 (SQLCipher). Its key is generated on your device and kept in the iOS Keychain or the Android Keystore, marked so that it cannot move to another device. The database directory is excluded from iCloud backup on iOS, and Android automatic backup is turned off for the app, so your entries are not copied into a cloud backup by the operating system.

We have no way to read any of this, and we hold no copy of it. Apart from your province, which the price download in section 3 carries, nothing on this list leaves your phone unless you tap "Get insight", which sends this week’s numbers and the random code described in section 4. From version 1.2, that includes your price alerts: they are checked on your phone, and nothing about them is sent to us or to anyone else. The check-in answers added in version 1.2 (stress, hunger, food noise, cravings and "None today") are not among the numbers "Get insight" sends.

From version 1.2, the weekly summary is the "Your week" view on the Progress screen. The app works it out on your phone from your entries, and nothing is sent to make it.

3. What leaves your phone

The app makes exactly six kinds of network request. They are listed here in full. The fifth exists only from app version 1.1, and the sixth only from version 1.2. Price alerts (from version 1.2) add no request of their own: they use the price download in a).

a) Public price and catalogue data. To show prices, the app downloads published pharmacy prices from our own service at glp1prices.ca/api/v1. The request contains a two-letter province code and nothing else. There are no cookies, no account, no device identifier and no custom identifying header. The medication you take is never part of the request: the app downloads the prices for your province and does the matching on your phone. From version 1.2, if you have set a price alert, the app also makes this same download when you open it and in the background, up to about twice a day, to check your alerts (section 17). It is the same request, with the same two-letter province code and nothing about your alerts.

b) A pharmacy or telehealth link you tap. When you choose to open a partner link, the app opens glp1prices.ca/api/go/ with the identifier of the link and a short context tag (which screen it came from and your province), and our service redirects your browser to the partner. That request does not contain your medication, your doses, your weight or any other entry. We keep a record of the tap — which link, which screen, your province and the time — to count how often each partner is used. The record has no identifier and cannot be linked to you. Once the partner’s website opens, you are on their site and their own privacy policy applies.

c) Anonymous diagnostics — only if you switch them on. Diagnostics are off by default, for everyone. With them on, the app may send: (i) milestone counts, which contain a milestone name, the week you started using the app, the platform and the app version, and no identifier of any kind; and (ii) crash reports, which are stripped before they are sent — no screenshot, no view hierarchy, no user identification, and any number next to kg, lb, mg, mcg or mL is replaced with "[redacted]" so that a weight or a dose cannot travel inside an error message. You can turn diagnostics off again at any time in Settings, and nothing is queued or stored while they are off.

d) Update check. When the app starts, it asks Expo, our app-update provider, whether a newer version of its software is available. An update check carries the app version, the platform and a random identifier for this installation that Expo creates to count installs. It is not linked to you or to anything you record, and it changes if you reinstall the app.

e) "Get insight" — from app version 1.1, and only when you tap it. On the Progress screen, "Get insight" asks for a short summary of your week. Once you have agreed, a single time, to a prompt that names the artificial-intelligence provider, each tap sends this week’s numbers and a random code to our service at glp1prices.ca, which has Claude, an AI made by Anthropic, write the summary and sends it back to your phone. Section 4 lists exactly what is sent and what happens to it. Without a tap, nothing is sent.

f) Premium status — from app version 1.2. When the app starts, and when you come back to it, it asks RevenueCat, our subscription provider, whether Premium is active on this installation and which subscriptions are offered. The request carries a random code that RevenueCat creates for this installation, the app version, the platform, and your phone’s language and store country, and nothing you record. It is made whether or not you subscribe, because that is how the app finds out that you have. When you buy or restore Premium, the purchase itself goes through Apple or Google, and the app passes the store’s record of it to RevenueCat. Section 17 says what RevenueCat keeps.

Reminders are not a network request at all. They are scheduled by your phone’s own operating system, and by default the reminder text does not name your medication. From version 1.2, price-alert notifications are made the same way, on your phone, and their text never names the medication, the pharmacy or the price (section 17). Reading from Apple Health or Health Connect (section 5) is not a network request either: it happens on your phone, between that app and this one.

4. "Get insight": the AI weekly summary (from app version 1.1)

This section applies from version 1.1 of the app. "Get insight" is optional, and the app works the same without it. From version 1.2, it is part of Premium (section 17): without Premium, the button opens the Premium screen, and nothing is asked or sent. The first time you tap it, the app asks whether you agree to send this week’s numbers to our server and to Claude, an AI made by Anthropic. If you choose Cancel, nothing is sent. If you choose Send, the app records your agreement with its date, and from then on a summary is requested only when you tap "Get insight" again. The "Your week" view on the same screen (from version 1.2) is not part of this feature: the app works it out on your phone and sends nothing.

What is sent, each time you tap it:

• the number of doses you logged this week, and, if you saved a dose schedule, the number planned on it • the number of side effects you logged this week, counted by symptom, with each symptom’s name, including the names you typed for symptoms you added yourself • the number of days this week with a daily check-in, and your average sleep hours, mood and energy on those days • your weight over the last 7 days and over the last 30 days: the first and the latest weight in each period, with their dates, the change between them and the number of entries • the first and last day of this week, the app’s language (English or French) and your weight unit (kg or lb) • the random code described below

What is not sent: your notes, your bowel-movement entries, your answers on stress, hunger, food noise and cravings and your "None today" taps (check-in questions added in version 1.2), the previous week’s figures, the identifiers of your entries, the name of your medication, your province, or anything that identifies you, such as a name, an email address or a device identifier. As with any request, our service sees your phone’s IP address (section 6).

How it travels, and who keeps what. Your phone sends the numbers over HTTPS to our service at glp1prices.ca, which is hosted by Vercel behind Cloudflare. Our service writes them out as plain text, sends that text to Anthropic’s API, receives three or four sentences back, checks them and passes them on to your phone. Our service does not store the numbers or the summary, and does not write them to its logs. The random code goes no further than our service.

What Anthropic does with it. Anthropic processes the text on our behalf, as our service provider, to write your summary. Under Anthropic’s commercial terms, it does not use the text to train its models. Anthropic states that it automatically deletes the inputs and outputs of its API within 30 days, except that it keeps them for up to 2 years if a request is flagged as breaking its usage policy, and for longer where the law requires. Anthropic may process the text outside Canada, including in the United States.

The random code. The first time you use "Get insight", the app makes a random code and keeps it in its encrypted database. It is sent with "Get insight" requests and with nothing else, so that our service can limit each installation to one summary every six hours. Our service keeps only a scrambled form of it (a keyed hash), for six hours, with nothing stored alongside it. The code is not a user identifier: it is not tied to your name, your entries or any other request the app makes, it is not included in backups, and "Delete all data" deletes it from your phone. As on the rest of our service, a count of requests from each IP address is also kept, for up to one hour, to stop abuse.

The summary. It is shown on the Progress screen and is not saved, on your phone or on our servers. It is written by an AI from the numbers above. It is not medical advice, it does not interpret your numbers, and we make no promise about what it will say: it can be incomplete or wrong, and your entries in the app remain your record. Questions about your health or your treatment are for your doctor or pharmacist.

Changing your mind. You never have to use "Get insight". Nothing is sent unless you tap it, so you can withdraw your agreement at any time simply by no longer using it. "Delete all data" in Settings removes the record of your agreement along with the random code, and the app will ask again before anything is sent. What was already sent cannot be called back from Anthropic, which deletes it on the schedule above.

5. Apple Health and Health Connect (from app version 1.1)

This section applies from version 1.1 of the app. On an iPhone the app can read from Apple Health (HealthKit), and on Android from Health Connect. It is optional and off until you turn it on in Settings → Health → Connect; your phone then shows its own permission screen, where you choose what the app may read.

What the app reads, and nothing else:

• your weight entries from the last 30 days, which become weight entries in the app, marked with where they came from • last night’s sleep, for the sleep field of today’s check-in when that field is empty. Version 1.1 fills the field in; from version 1.2, the check-in offers the value and uses it only if you tap Use. Either way, you can change or clear it, and it is saved only when you save the check-in

The app reads only when you tap Connect or Sync now in Settings, or open today’s check-in. It never reads in the background, and it never writes anything to Apple Health or Health Connect.

What happens to it. What the app reads is stored in the same encrypted database as your other entries (section 2), kept out of iCloud and Android backups in the same way, and treated like an entry you typed: you can edit or delete an imported weight in the app like any other. Deleting it in the app does not delete it from Apple Health or Health Connect. It goes into a backup file only if you make one yourself (section 10).

What we do not do with it. We do not use information from Apple Health (HealthKit) or Health Connect for advertising, marketing or data mining, we do not sell it, and we do not disclose it to third parties, except in the one case below, which only you can start. The import itself sends nothing off your phone, to us or to anyone else.

The case to know about: "Get insight" (section 4) works out this week’s numbers from all your entries. So if you tap it, a weight you imported, or sleep hours from Apple Health or Health Connect that you kept in a check-in, count like an entry you typed and go with those numbers to our service and to Anthropic, which processes them for us only to write your summary. That happens only when you tap "Get insight", after you have agreed to it.

Turning it off. You can stop the app reading at any time. On iPhone: in the Health app, tap your profile picture, then Apps under Privacy, then GLP1Prices; or go to Settings → Health → Data Access & Devices → GLP1Prices. On Android: open the Health Connect app, then App permissions → GLP1Prices. Weights already imported stay in the app until you delete them, one at a time or with "Delete all data".

6. IP addresses and server logs

Any request to any server on the internet shows that server your IP address, and the requests above are no exception. Our service and the content delivery network in front of it process the IP address of a request in order to deliver the response and to protect the service from abuse.

That IP address is not stored alongside any health information: the price, link, diagnostics, update and Premium requests carry none, and the numbers in a "Get insight" request are not stored at all. We cannot link a price download or a link click to the entries on your phone, and we do not try to.

7. The companies that process data for us

We name our service providers rather than describing them by category, so you can check them yourself:

• Vercel — hosts the website, the public price service that the app downloads prices from and, from version 1.1, the service that handles "Get insight" requests. • Cloudflare — content delivery and security in front of that service; sees the IP address of a request, and passes "Get insight" requests through without keeping them. • Neon — the database holding the published pharmacy prices, the anonymous milestone counts. It holds no entry from your phone. • Upstash — holds the short-lived counters our service uses to limit requests, including the six-hour "Get insight" key described in section 4. • Anthropic — from version 1.1, writes the "Get insight" summary from the weekly numbers sent when you tap it (section 4). It does not use them to train its models. • RevenueCat — from version 1.2, keeps track of whether this installation has Premium, under a random code it creates, and keeps the record of Premium purchases (section 17). It receives nothing you record. • Expo (Expo Application Services) — builds the app and hosts the over-the-air updates it downloads. An update check carries the app version, the platform and a random identifier for this installation that Expo creates to count installs. It is not linked to you or to anything you record, and it changes if you reinstall the app. • Sentry — crash reports, and only while you have diagnostics switched on. • Apple and Google — distribute the app through their stores. What they collect as store operators is governed by their own policies, not ours. Apple Health and Health Connect are part of their phones’ software; the app reads from them on your phone and sends nothing it reads to Apple or Google. From version 1.2, they also sell Premium and take the payment. Price-alert notifications are created on your phone and do not go through their push notification services.

There is no advertising network, no marketing or attribution software and no session-replay tool in the app, and no artificial-intelligence software runs on your phone. The only artificial intelligence involved is "Get insight" (from version 1.1), which runs on our service and Anthropic’s, and only when you tap it. The app is built against a written list of permitted software components, and an automated test fails the build if a component outside that list is added.

8. Where processing happens

Your entries stay on your phone, so they are wherever you are. The public price service and the providers listed above, Anthropic and RevenueCat included, operate on infrastructure that may be located outside Canada, including in the United States, and may therefore be subject to the laws of those countries.

What reaches that infrastructure is: a province code, a link identifier, an IP address, Expo’s random installation identifier, if you opted in, anonymous counts and scrubbed crash reports, if you tap "Get insight", this week’s numbers and that feature’s random code (section 4), and, from version 1.2, RevenueCat’s random code with the record of any Premium purchase (section 17). It does not include information that identifies you, and apart from the "Get insight" numbers, none of it describes your health. Your price alerts are not part of it: they stay on your phone.

9. Consent

Before you can record anything in the app, you are shown a screen that explains what the app is, what it is not, and where your entries are stored, and you are asked to agree that the app may store your health entries on your device. That agreement is recorded with its date and version. Diagnostics are a separate, optional choice on the same screen, switched off unless you switch it on.

From version 1.1, two optional features ask separately, the first time you use them: "Get insight" asks whether you agree to send this week’s numbers to our service and to Anthropic (section 4), and connecting Apple Health or Health Connect shows your phone’s own permission screen (section 5). Saying no to either changes nothing else in the app.

From version 1.2, setting your first price alert shows your phone’s own permission screen for notifications, if you have not already allowed them for reminders. Premium is bought on Apple’s or Google’s own purchase screen. Saying no to either changes nothing else in the app.

You can withdraw consent by deleting your data or removing the app. Some of what the app does is only possible with the entries you provide, so withdrawing consent means the app can no longer keep your record. To withdraw your agreement to "Get insight", stop using it: nothing is sent without a tap, and "Delete all data" removes the record of the agreement. To stop the health import, turn off the app’s access as described in section 5. To stop price alerts, delete them in Settings → Price alerts.

10. Backups and exports you make yourself

The app can write a backup file and a spreadsheet (CSV) export. Both are created by you, in the moment, and handed to your phone’s share sheet so that you can decide where they go. From version 1.2, a backup file does not include your price alerts (section 17).

From version 1.2, both carry the check-in answers added in that version (stress, hunger, food noise, cravings and "None today"): the CSV export as five more columns in its check-ins file, and the backup file together with which of those questions the check-in asks.

A backup file is encrypted with a passphrase you choose (AES-256-GCM, with a scrypt key derivation). If you lose the passphrase, the file cannot be recovered — not by you and not by us. A CSV export is a plain text file and is not encrypted, so treat it the way you would treat a printed copy of your record.

Once you send a file somewhere — email, cloud storage, a messaging app — it is subject to that service, not to this policy.

11. How long things are kept

• Your entries: until you delete them. "Delete all data" in Settings removes them from the device, and uninstalling the app removes them with it. Weights imported from Apple Health or Health Connect are entries like any other; deleting them here does not delete them there. • "Get insight" (from version 1.1): our service keeps neither the numbers nor the summary, and the app does not save the summary. Anthropic deletes what it received within 30 days, unless the request is flagged under its usage policy (then up to 2 years) or the law requires longer. Our service keeps the scrambled form of the random code for 6 hours; the code itself stays on your phone until "Delete all data". • Price alerts (from version 1.2): on your phone, in the same encrypted database as your entries, until you delete them. "Delete all data" removes them, and so does removing the app. They are not included in backup files, and we hold no copy. • Premium (from version 1.2): RevenueCat keeps the record of your purchases for as long as we use its service, unless you ask us to have it deleted (section 17). Apple and Google keep their own records under their own policies. • Crash reports (only if you opted in): kept by Sentry for up to 90 days. • Anonymous milestone counts (only if you opted in): kept as aggregate counts. They contain no identifier, so they cannot be traced back to a person or deleted individually. • Records of partner-link taps: kept to count use; they hold no identifier. • Server logs and request counters holding IP addresses: kept for a short period by our hosting and security providers for operational and security purposes.

To ask us about deleting anything we hold, write to privacy@glp1prices.ca. We hold nothing that identifies you; everything you record is on your phone, and Settings → Export, import, delete → Delete all data removes it, together with the record of your "Get insight" agreement and its random code and, from version 1.2, your price alerts. To have RevenueCat’s record of a Premium purchase deleted, send us the order number from Apple’s or Google’s receipt (section 17).

12. Your rights

Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec’s Law 25 and similar provincial laws, you have the right to access the personal information an organization holds about you, to ask for it to be corrected, and to complain about how it is handled.

In practice, the app gives you those rights directly: your record is on your device, you can read it, correct it, export it and delete it at any time, without asking us. We do not hold a copy to give you. From version 1.2 that includes your price alerts, which are kept on your phone, in Settings → Price alerts.

If you have written to us, we will hold that correspondence. You can ask us about it, or ask us to delete it, at privacy@glp1prices.ca. We answer within 30 days.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, and, if you live in Quebec, to the Commission d’accès à l’information du Québec.

13. Security

The database on your device is encrypted and its key is stored in the platform’s secure hardware-backed store. Network requests use HTTPS. The app asks for no permission it does not need, and it does not request access to your contacts, your photos, your location or your microphone. From version 1.1 it can ask to read your weight and sleep from Apple Health or Health Connect, and only after you tap Connect. From version 1.2, setting your first price alert asks for permission to show notifications, if you have not already given it for reminders.

No security is absolute. The most important protection on a device that holds a health record is the device lock — a passcode or biometric lock on the phone itself.

If a confidentiality incident occurs that presents a risk of serious injury, we will notify the Office of the Privacy Commissioner of Canada and, where Law 25 applies, the Commission d’accès à l’information, and the people affected, as those laws require.

14. Children

The app is not intended for children. It is rated for users aged 13 and over, and it is designed for people who have already been prescribed a medication by a health professional.

15. Changes to this policy

If we change this policy, the date at the top changes with it. If a change is significant — for example, if the app ever begins to send something new from your phone — we will ask for your agreement in the app before it takes effect for you.

16. Contact

Privacy Officer, Onset Security Inc — privacy@glp1prices.ca

For anything else: hello@glp1prices.ca

17. Price alerts, notifications and Premium (from app version 1.2)

This section applies from version 1.2 of the app. Price alerts and Premium are optional, and the rest of the app works the same without them. Premium includes price alerts and "Get insight" (section 4). Apart from the Premium check described in section 3 f), nothing in this section happens until you set a price alert or buy Premium.

Price alerts. A price alert tells you when a pharmacy in your province lists the package you take at or below a price you choose. You set one from the Refill screen, for your own package; there is one alert per package and province, and setting a new one replaces the old one. Your alerts are kept on your phone, in the same encrypted database as your entries (section 2), and the comparison is made on your phone. We do not receive your alerts: nothing about them is sent to us or to anyone else.

What the app keeps on your phone for each alert:

• the package the alert is for (the medication and its strength), and your province • the price you chose, and whether the alert is on • when you set it, and when it last notified you

Alerts are not included in the backup file described in section 10, so a phone restored from a backup starts with no alerts.

How the check works. While you have at least one alert on, the app checks prices up to about twice a day: in the background, and when you open it, at most once every 12 hours. Each check downloads the public prices for your province, the same request described in section 3 a), which carries a two-letter province code and nothing else, and compares them with your alerts on your phone. The background check uses your phone’s own scheduler (Background App Refresh on an iPhone, scheduled background work on Android). Your phone decides when it runs, so a check can be late or skipped, for example in Low Power Mode or when background refresh is off for the app; the app also checks when you open it. When you have no alert left, the background check is switched off.

The notification. When a price at or below yours turns up, the app asks your phone to show a notification, the same way it shows dose reminders. It can do so at the first check, including right after you set the alert if a pharmacy already lists that price. The notification is created on your phone: it is not sent by us, it does not go through Apple’s or Google’s push notification services, and no push token is created or sent. Its text is the same for every alert: "Price alert — A pharmacy dropped below your target price — open GLP1Prices to see details". It never names the medication, the pharmacy or the price, so nothing about your treatment shows on the lock screen. Once an alert has notified you, it switches itself off; set it again if you want another.

Deleting an alert. Settings → Price alerts lists your alerts, and you can delete any of them there. "Delete all data" in Settings deletes them all and stops the background checks, and removing the app deletes them with everything else. Turning off notifications for the app in your phone’s settings stops alerts from reaching you, and if your phone stops the app’s background activity, prices are checked only when you open the app.

Premium. Premium is an optional subscription, bought in the app through the App Store or Google Play. Apple or Google takes the payment, under its own terms and privacy policy. We never see your payment card, your name, your email address or your Apple or Google account.

To know whether this installation has Premium, the app uses RevenueCat, a company that manages subscriptions for app publishers. RevenueCat creates a random code for this installation, which stays on your phone until you remove the app, and the Premium check in section 3 f) uses it. When you buy or restore Premium, the app passes the store’s record of the purchase to RevenueCat, which checks it with Apple or Google. Under that random code, RevenueCat keeps: which subscription it is, its price and currency, the store country, when it started, renews or ended, and the store’s transaction numbers.

We can see that record in RevenueCat’s dashboard, and we use it to run Premium and to count subscriptions. It does not tell us who you are. We give RevenueCat no name, email address or other identifier, and we do not connect its record to your entries or to any other request the app makes. RevenueCat processes it for us as our service provider, and may do so outside Canada, including in the United States.

Cancelling, and deleting the record. You manage the subscription in your Apple or Google account, not in the app: on an iPhone, Settings → your name → Subscriptions; on Android, Google Play → Payments and subscriptions → Subscriptions. Removing the app or using "Delete all data" does not cancel it. To have RevenueCat’s record of your purchases deleted, write to privacy@glp1prices.ca with the order number from Apple’s or Google’s receipt email; we find the record by that number and have RevenueCat delete it. Apple and Google keep their own records of your purchases, under their own policies.