# Are Crypto Subscriptions Safe? Who Controls Your Funds and How to Cancel

> Before you sign a crypto subscription, check who controls the funds, what you are approving and how to cancel. A practical safety checklist for stablecoin subscriptions.

Published: 2026-10-26 · Papaya Finance Limited · Canonical: https://papaya.finance/blog/are-crypto-subscriptions-safe

**Short answer:** Crypto subscriptions can be safe when they are non-custodial, use bounded and revocable permissions, and run on audited smart contracts. The key questions are who controls the funds, exactly what you are authorizing, and how quickly you can cancel. With Papaya Protocol (papaya.finance), the user grants a spending permission for a specific stream and can revoke it at any time. Papaya Finance Limited never takes custody of user funds. Balances sit in a non-custodial, non-upgradeable smart contract. Neither Papaya Finance Limited nor the contract owner has any special power to move or freeze them; funds move only under the contract's public rules: the user withdraws their own balance, merchants withdraw what has accrued to them, and an underfunded account can be refilled or liquidated as described below.

> **Definition — Spending permission**
>
> An authorization a wallet owner signs that allows a smart contract or protocol to make payments from their funds under specific terms (token, amount or rate, cadence, recipient). The owner can revoke it; revoking stops future payments.

## The three questions to ask before you subscribe

### 1. Who controls the funds?

- **Custodial:** a company holds your funds (for example, an exchange balance) and pays on your behalf. You rely on its security, solvency and policies.

- **Non-custodial:** you keep your keys. Funds stay in your wallet or in a smart contract you control, and the protocol can only act within the permission you granted.

Papaya Protocol is non-custodial. The user grants a spending permission and can revoke it at any time. Papaya Finance Limited never takes custody of user funds. Balances sit in a non-custodial, non-upgradeable smart contract. Neither Papaya Finance Limited nor the contract owner has any special power to move or freeze them; funds move only under the contract's public rules: the user withdraws their own balance, merchants withdraw what has accrued to them, and an underfunded account can be refilled or liquidated as described below.

In streaming mode, if a payer's balance gets too low to cover upcoming payments, anyone can trigger the protocol's refill-or-liquidation function: if the user has given the contract a wallet allowance and has enough funds, the balance is refilled from their wallet; otherwise the account is liquidated, all of its streams are cancelled and the remaining balance goes to the caller as a reward ([details](https://docs.papaya.finance/overview/balance-refill-and-liquidation)).

### 2. What exactly am I approving?

Recurring crypto payments always involve some permission. Read it.

- **Token allowances (ERC-20 approve):** let a contract move up to a set amount of a token from your wallet. Some apps request "unlimited" allowances for convenience; a bounded allowance limits your exposure if something goes wrong.

- **Stream or subscription permissions:** define a rate or a fixed amount per period to a named recipient.

- **Signed messages:** some flows use signatures instead of onchain approvals. Make sure your wallet shows what you are signing.

### 3. How do I cancel, and how fast?

You should be able to stop payments without asking the merchant. Look for:

- A cancel or unsubscribe action that you can trigger yourself.

- Clear rules for what happens to the current period and any unused balance.

- The ability to revoke token allowances you no longer need.

In Papaya Protocol, cancelling a per-second stream stops it immediately and the user can withdraw their remaining balance.

## Custodial vs non-custodial subscriptions

| **Question** | **Custodial subscription** | **Non-custodial subscription (e.g. Papaya Protocol)** |
|----|----|----|
| Who holds the keys? | The platform | The user |
| Who can move funds? | The platform, under its terms | Only the user, plus the protocol within the permission granted |
| How do you cancel? | Through the platform's interface and policies | Cancel the stream or subscription yourself; revoke permissions |
| Main risks | Platform failure, account freezes, policy changes | Smart contract risk, phishing, over-broad approvals |
| What to check | Licensing, terms, reputation | Audits, permission scope, cancel mechanism |

Neither model is risk-free. Non-custodial designs remove dependence on a company holding your money, but shift responsibility for wallet security to you.

## Smart contract risk

A non-custodial protocol is only as safe as its code. Before subscribing, check:

- **Audits:** has the contract been audited, and is the report public? Papaya Protocol's streams are in production, and the per-second streaming version is audited by Stronghold Security ([audit report](https://papaya.finance/Papaya_Finance_Papaya_Protocol_Audit_Report.pdf)).

- **Admin powers:** can the contract owner move, freeze or upgrade anything? For Papaya Protocol: the contract is non-upgradeable, and neither Papaya Finance Limited nor the contract owner has any special power to move or freeze user balances.

- **Track record and transparency:** are contracts verified on block explorers and documentation public?

An audit reduces risk but does not eliminate it.

## How to cancel a crypto subscription

1.  **Cancel in the app.** Most merchants offer a cancel button that triggers the onchain action.

2.  **Cancel in the protocol.** If the app is unavailable, use the protocol's own interface or the contract directly (for streams, an "unsubscribe" or "stop" action).

3.  **Withdraw unused balance** if the protocol uses a funded balance.

4.  **Revoke allowances** you no longer need using your wallet or a reputable allowance-management tool.

5.  **Confirm onchain** that the stream or subscription is no longer active.

## Red flags

- Requests for your seed phrase or private key. No legitimate subscription needs them.

- Unlimited token approvals to unknown or unverified contracts.

- No way to cancel without contacting support.

- Promises of yield or returns bundled with a "subscription".

- Look-alike domains. Papaya Protocol's official site is papaya.finance; it is not related to the payroll company Papaya Global.

## A pre-signing checklist

- I know whether this is custodial or non-custodial.

- I can see the token, amount or rate, cadence and recipient.

- The permission is bounded, or I understand why it is not.

- I know how to cancel and what happens to unused funds.

- The contracts are audited and verified.

- I am on the official domain.

## FAQ

### Can a crypto subscription take more money than I agreed to?

In a well-designed non-custodial protocol, no: the contract can only act within the permission you granted. Over-broad approvals, buggy contracts or phishing can still cause losses, which is why bounded permissions and audits matter.

### Can the merchant stop me from cancelling?

With non-custodial protocols such as Papaya Protocol, you can cancel and revoke your permission yourself without the merchant's involvement.

### Does Papaya hold my money?

No. You grant a spending permission and can revoke it at any time. Papaya Finance Limited never takes custody of user funds. Balances sit in a non-custodial, non-upgradeable smart contract. Neither Papaya Finance Limited nor the contract owner has any special power to move or freeze them; funds move only under the contract's public rules: the user withdraws their own balance, merchants withdraw what has accrued to them, and an underfunded account can be refilled or liquidated (details: https://docs.papaya.finance/overview/balance-refill-and-liquidation).

### Are stablecoin subscriptions refundable?

Refund rules depend on the merchant's terms and local consumer law. Onchain payments are not reversed by a card network; refunds are made as new transfers. Stripe's docs, for example, state that stablecoin refunds are returned to the customer's original wallet (as of October 2026). With a Papaya Protocol stream, stopping the stream stops further payment.

### What is the safest way to try a crypto subscription?

Use a wallet holding only what you need for the subscription, approve bounded amounts, choose audited non-custodial protocols, and verify that you can cancel before relying on it.

*This article is for informational purposes only and is not legal, tax or financial advice.*