You forget the subscriptions.
They never forget you.

The bank login is the industry default. Refusing it is the whole product.

Every popular subscription tracker works the same way: connect it to your bank through a data aggregator, let it read every transaction, and let it charge you — often 30–60% of the money it "saves" you. That model is powerful, but it asks you to trust a third party with the keys to your entire financial life, and it quietly reads every purchase you make, not just the subscriptions.

That teardown is the research. I went through the popular trackers, and the pattern was unanimous: every one starts by asking for a bank connection and takes a cut. There was no privacy-first option on the shelf. That gap, not a feature wish, is the decision the whole product is built on: refuse the bank entirely and see how much value survives. Most of it does.

Catchly's bet is that most of the value comes without any of that risk. It never sees your bank. Instead it watches only a narrow, fixed list of 24 subscription sites — the streaming, AI, productivity, news, design and storage services people actually pay for — and detects the subscription right where it happens: at the sign-up or renewal page. The tracking, the reminders and the spend math all run on your device. This isn't a privacy footnote; it is the product.

Nine things Catchly catches for you.

Each one is a specific moment where money slips away silently. Catchly's job is to make that moment visible before the charge lands — in plain language, with a way to act on it.

Detect locally, remember locally, remind locally.

There's no server in the loop. A small script runs only on the 24 allowlisted sites, spots a subscription, and hands it to a background worker that stores it on your device and schedules the reminders. Here's the whole path, start to finish:

Four permissions, each with one honest reason.

Catchly asks for the minimum it needs and nothing more. There is no <all_urls> — the browser itself blocks it from running anywhere outside the allowlist. Here's exactly what each permission is for:

Same goal, opposite data path.

Both a bank-linked tracker and Catchly want to answer "what am I paying for?" The difference is where your data goes to get the answer. On the left, the model everyone else uses; on the right, Catchly's:

The trade-off, stated honestly: because Catchly never reads your bank, it only knows about services it can see you use in the browser — that's why the supported list is explicit and grows over time. In exchange, you never share a banking credential, your subscription list never leaves your device, and there's no percentage-of-savings fee. That's the deal, and it's the point.

The same on-device approach powers every screen in the popup. These are the real listing shots:

The interesting decisions were about restraint.

Anyone can build a subscription list. The decisions that make Catchly trustworthy were mostly about what to not do — and being honest about the limits. Four real ones:

• A 24-domain allowlist, not <all_urls>. Catchly could technically request access to every site and detect more. It deliberately doesn't. The narrow allowlist means the browser itself guarantees the extension cannot run on your bank, brokerage, healthcare portal or any login page — a promise enforced by Chrome, not by trust. The Web Store even rejected an early listing for naming brands like SEO keywords, so the public description now uses category descriptors while the reviewer-only fields carry the exhaustive 24-domain list.
• Guide the cancellation — never fake-automate it. Catchly deep-links to each service's real cancel page and spells out the dark-pattern steps in plain English. It does not auto-click cancel buttons. Per-service automation breaks every week when sites redesign; the honest product is a reliable guide, not a brittle robot that charges a percentage of "savings" for humans doing the clicking behind the scenes.
• The Gmail scan is a waitlist, not a bait-and-switch. Reading receipt emails would catch far more, but it needs Gmail OAuth and a restricted-scope Google review — a v1.0 milestone. Rather than ship it half-done, the current build offers an opt-in waitlist. Clicking "Notify me" is the single outbound call the extension ever makes, it sends only your email, and it's disclosed in the privacy policy.
• Bundle the brand logos; don't phone a CDN. Icons used to load from a third-party CDN. They're now committed SVGs in logos/, so even rendering a Netflix logo doesn't reach the network. When the claim is "zero outbound calls," it has to be literally true.

A Manifest V3 extension, built to be audited.

No framework, no build-time magic to hide behind — plain modules that a reviewer can read top to bottom. Every file has one job:

Load it unpacked, load the sample data, done.

No login, no account, no setup. The fastest way to see everything working:

Shipping, verifiable, and honest about scope.

Catchly v0.1.0 is submitted to the Chrome Web Store with a live preview on getcatchly.com. Everything in the feature list is working code, not placeholder — the smoke suite exercises the critical paths on every run, and because the whole thing is source-available under MIT, every privacy claim can be checked line by line.

The version I didn't build — and what I'd change.

The obvious build is the one every rival ships: connect to the bank through an aggregator, read every transaction, take a cut of the "savings." I followed that path to its end and killed it — it means holding someone's financial keys and reading purchases that have nothing to do with subscriptions. Refusing it is the product, but I'm honest that it costs real coverage: Catchly only sees the 24 sites on its allowlist, so a subscription bought somewhere off-list is invisible. I took a smaller, honest scope over a broader, creepier one.

What I'd do differently: I hand-curated the 24-domain allowlist, which doesn't scale — every new service is a code change by me. I'd invest earlier in a community-editable detection-rule format so coverage can grow without me in the loop.

Ordered by value, not novelty.

• Web Store approval — in review now; the listing link goes live once it clears.
• Grow the merchant catalogue — the content moat. Each new service is about five minutes of work and directly widens what Catchly can catch.
• Gmail auto-scan (v1.0) — opt-in, on-device parsing of receipt emails to catch subscriptions outside the allowlist. Gated on Gmail OAuth and a restricted-scope Google review, which is why it's a waitlist today.
• Cancellation copilot — guided, one-click cancellation for the top services, still without ever charging a cut of "savings."
• Family-plan splitting — track which subscriptions are shared and whose card they hit.

The things people probe for.