Fictional product, illustrative draft. Not legal advice.

Open points¶

Law as of 2026-10-20 (the references' own date). Prepared 2026-10-23. A qualified lawyer must review every draft before it is used; this register does not replace that review.

Missing facts (see reply.md for the full question text and the assumption drafted against)¶

#	Missing fact	Assumption drafted against	What it would change if different
1	VAT ID / Economic ID; phone number or email-only confirmation for Impressum contact duty	VAT ID supplied later; email-only contact	Impressum content (not drafted in this delivery) and the repeated identity block on the checkout page
2	Contracting party for in-app purchases: Example Fitness GmbH or the app store as merchant of record	Example Fitness GmbH is the seller for the web checkout; app-store sales flagged separately	Whether the subscription-terms document itself, or the app store's own terms, carries the contract, withdrawal and cancellation duties for that channel
3	Whether workout/heart-rate/weight data is used only to perform the contract, or also for Stridewell's own purposes (analytics, product improvement)	Used for Stridewell's own purposes beyond bare contract performance	Scope of the "payment in personal data" trigger under CRD Art. 3(1)/DCD Art. 3(1); legitimate-interest balancing; this also feeds the (separately drafted) privacy notice
4	Whether heart-rate/weight data is treated as ordinary personal data or as health/special-category data	Treated as ordinary personal data for this draft	GDPR Art. 9 special-category gating; Washington consumer-health-data triggers if any Washington users exist; none of this is drafted in the current deliverable, which does not include a privacy notice
5	Whether age 16 is your own policy choice or your understanding of Germany's GDPR Art. 8 floor	Treated as your own policy choice, set at or above the Art. 8 band	The children-and-age module's EU text would need a different framing if you intended it as a legal-floor statement; the Germany-specific figure within the 13-16 band is not stated in any reference file available to this skill, so it cannot be confirmed either way (see "Figures and thresholds the references do not state" below)
6	Whether billing information is collected at trial start (card-on-file, auto-charge day 8) or only once the trial ends	Card-on-file collected at trial sign-up, auto-charged on day 8	Timing of the ROSCA/CA/NY pre-billing disclosure; whether the EU withdrawal clause's early-performance consent paragraph is needed
7	Contracting entity for California/New York sales: the German GmbH itself, or a US affiliate	Example Fitness GmbH is the seller of record in both states	Which entity's registered-agent and service-of-process details go in the US module; this does not change the substantive consumer-protection drafting
8	Preference for one combined document vs. three jurisdiction-specific documents	One combined document with labelled modules	Document structure only, not substance

Facts the applicability table could not settle on the message alone¶

Austria and other non-Germany EU member states. The skill's references state the EU directive floor (Consumer Rights Directive, UCTD, DCD) at the directive level, with Germany worked out as the reference member state in full implementing detail (exact wording, button labels, statutory forms). Austria's own transposition of the Consumer Rights Directive (the Austrian equivalent of the Muster-Widerrufsbelehrung, the Austrian FAGG) is not merged into this skill's references. The subscription-terms and withdrawal-information drafts use the directive-level EU text for Austria and flag the Austrian-specific wording and form as something your counsel needs to verify against the current Austrian FAGG text before publication.
Whether California's CCPA applies to Example Fitness GmbH at all. The statute's thresholds are over $25,000,000 in prior-year gross revenue, or buying/selling/sharing personal information of 100,000 or more California consumers or households, or deriving 50% or more of revenue from selling or sharing personal information (references/us-states/ca-ccpa.md). Your stated facts (about EUR 2 million annual revenue company-wide, about 40,000 total users, 3,000 in California) look well under both the revenue and the volume thresholds, but the skill's rules bar estimating a statutory threshold from unit sales, user totals or market-size figures, and "annual revenue about EUR 2 million" is not necessarily the same figure as "gross revenue" under the statute's own definition, nor necessarily in the right base year or currency conversion. This is left undetermined; no CCPA-specific clause was drafted into the delivered documents on the strength of an assumed non-applicability.
Whether CalOPPA, Virginia/Colorado/Connecticut/Texas-style privacy statutes, or New York's own (non-auto-renewal) data law reach you. Out of scope for this delivery (you asked for subscription terms and withdrawal information, not a privacy notice), but flagged here so it is not lost before that document is drafted.
Whether the app-store channel (Apple App Store, Google Play) changes who owes the California/New York same-medium-as-consent cancellation duty, or the German cancellation-button duty. Both references/us-states/ca-arl.md and references/de/bgb-fernabsatz.md raise this without settling it: where billing runs through a third-party platform rather than the seller's own checkout, it is unresolved whether that platform's own cancellation path can stand in for the statutory duty, or whether Example Fitness GmbH needs its own contractual arrangement with Apple/Google to secure it. This is not something the references resolve in the abstract; flagged as a product and legal question together.
Whether a specific jurisdiction's court has tested California's McGill public-injunctive-relief rule, or Illinois BIPA, Washington's MHMDA, or any state beyond California and New York against this specific business. Out of scope: the subscription document drafted does not include a dispute-resolution or arbitration clause, since your message asked only for subscription terms and withdrawal information plus the flow requirements, not a full terms-of-service with dispute resolution.

National law to verify (Germany is the reference state; other markets flagged)¶

Austria. The Austrian FAGG (Fern- und Auswärtsgeschäfte-Gesetz) transposition of the Consumer Rights Directive needs its own check against the directive-level drafting used here, in particular the Austrian wording of the withdrawal model form and information, and any Austrian-specific consumer-protection add-on beyond the directive floor (Konsumentenschutzgesetz). No reference file in this skill covers Austrian national law; this is a genuine gap, not merely a flag.
Germany. Covered in full detail by this skill's references/de/ files; see annotations.md for the applicability table and citations.
California and New York. Covered in full by references/us-states/ca-arl.md and references/us-states/ny-gbl-527a.md; see annotations.md.
Any other US state Stridewell might later sell into. Not covered; references/us-states/state-matrix.md lists other states as flags to check only, and no dedicated auto-renewal file exists for a state beyond California and New York in this skill.

Rules that take effect later than the law-as-of date, or whose outcome is pending¶

BGH ruling on login steps in the German cancellation flow, due 5 November 2026 (I ZR 272/25 and I ZR 275/25). The Kammergericht held that routing the cancellation button through a login (customer number and password), or asking for a password on the confirmation page, breaches § 312k Abs. 2 Satz 3 and 4 BGB. Until the BGH rules, the subscription-terms and implementation-requirements drafts assume no login step in the German cancellation flow (beyond the identification data the statute itself lets the flow collect). Recheck this before your checkout ships, since the ruling is due within two weeks of this delivery.
BGH ruling of 16 July 2026 (I ZR 200/25), already decided and reflected in the drafts: the German cancellation confirmation page may carry no retention offer, pause option or other content beyond the five statutory fields. This is final law as of the law-as-of date, not pending, and is built into both subscription-terms.md and implementation-requirements.md.
16 C.F.R. Part 425 (the federal Negative Option Rule) is in a settled-but-unstable state. The 2024 amendment that would have extended disclosure/consent/cancellation duties to every negative-option pattern (not just prenotification plans) was vacated by the Eighth Circuit on a procedural ground; the FTC restored the pre-2024 text effective 12 February 2026. A 2026 advance notice of proposed rulemaking is asking whether to bring some or all of the vacated rule back; the comment period closed 13 April 2026 and no decision has been announced. Stridewell Plus (a pure digital subscription, no merchandise shipped) sits outside Part 425's prenotification-plan scope either way, so this mainly affects how confidently you can describe "federal compliance" in any marketing or investor-facing material; ROSCA and FTC Act section 5 remain your actual federal floor, and both are drafted into the documents.
FTC's open question on retention offers ("Saves") before honoring a cancellation request is unresolved at the federal level; the 2021 guidance's narrower single-offer-versus-repeated-pitch standard is what the US module drafts to, not a settled Saves-specific rule.

Decisions counsel has to make¶

Whether to accept the recommended module split (one combined subscription-terms document with EU-consumer, Germany and US sub-modules) versus three separate documents. Drafted as one combined document per the stated assumption in open point 8; easy to split later if counsel prefers separate files per market.
Whether Stridewell's 7-day free trial should be restructured so no billing information is collected until the trial actually converts, which would simplify the ROSCA/CA/NY pre-billing timeline considerably (see open point 6). This is a commercial and product decision the drafting cannot make for you.
Whether to drop US pricing in USD entirely and bill every market in EUR, or keep the dual-currency model. Nothing in the references requires one approach over the other, but a dual-currency model raises a question (not resolved here, and not covered by any file in this skill) about whether showing a different net price by detected currency/location could brush against the EU geo-blocking Regulation's non-discrimination rule for electronically supplied services, since Art. 4(1) of Regulation (EU) 2018/302 bars price differentiation tied to a customer's nationality, residence or establishment for that service category. This is flagged, not resolved: the regulation reaches discrimination by customer location, and a single published EUR-or-USD toggle the customer picks themselves is a different fact pattern from geofenced pricing, but the distinction was not tested against your actual checkout design. Treat as a question for counsel before finalising the checkout's currency-selection logic.
Whether the German cancellation-button duty and the EU withdrawal-function duty can, as a commercial matter, be secured from Apple and Google by contract for the in-app-purchase channel, or whether Stridewell needs a parallel compliant path through its own web checkout as the backstop for every EU user regardless of how they originally subscribed.

Figures and thresholds the references do not state¶

Germany's own chosen figure within the GDPR Art. 8 child-consent band (13 to 16) is not stated in any reference file this skill draws on; only the band itself is stated (references/eu/gdpr-legal-bases.md). Your 16-year minimum age sits at the top of that band regardless of Germany's specific figure, so it clears the GDPR floor for every Member State without needing the German-specific number confirmed, but this skill cannot name that number for you if your product team needs it for a different reason.
The EU and CCPA revenue/user thresholds mentioned above are not calculated from your figures in these drafts, per the skill's own rule against estimating a statutory threshold from revenue, unit sales or user totals; only the statutory test itself is quoted.