DEV Community: Dhiraj Kavuri

A "monthly" app plan cost me $300 to leave. Now a local Gemma reads the terms before I click "Start free trial"

Dhiraj Kavuri — Mon, 26 Oct 2026 06:52:19 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady

What I Built

I signed up for an app's free trial, and it turned into a monthly plan. A few weeks later I tried to cancel and found out I couldn't for three months, even though it was billed monthly. Leaving early cost $300. The rule was in the terms I had scrolled past on the way to the "Start free trial" button.

I'm not going to start reading terms of service. So I built Catch, a Chrome extension that reads them for me at that button.

When a sign-up or checkout page has a price and a button, Catch reads the text around the button and the terms page it links to. Gemma 4 E2B, running in Chrome on my own GPU, double-checks the sentences that look like trouble, and Catch pins a card next to the button:

Exit fee: "Leaving early costs $300."
Lock-in: "You're committed for 3 months, even though it's billed monthly."
Trial turns paid: "The trial turns into a paid plan at $29.99."

Every line quotes the sentence it came from. Click it and the page scrolls to that sentence, or the terms page opens with it highlighted.

If I press the button anyway, Catch writes my exit plan: the last day to cancel for free, the day I can leave without the fee, and how cancelling has to be done, as events in my calendar. Then I can stop thinking about it.

It works on real terms too. On Xfinity's subscriber agreement it pulls out "If your Services are subject to a minimum term agreement, and you terminate… before the end of the minimum term, you may be charged an early termination fee." That's the kind of sentence I would never have scrolled to.

Demo

Try it without installing anything: https://kinnuworks.github.io/catch/#try

It's a made-up sign-up page with the same trap I fell for, and the extension's own code runs inside the page. Hover the button, read the card, press "Start free trial" for the exit plan. The demo starts with the rules, which work instantly; switch to Gemma 4 E2B to watch the model double-check them (a 3.4 GB download, once). There's also a box where you can paste the terms from any real sign-up page.

Code

kinnuworks / catch

A Chrome extension where a local Gemma reads the terms at the sign-up button and writes your exit plan.

Catch

Catch is a Chrome extension that reads the terms on a sign-up page at the moment you're about to press "Start free trial". It pins a card next to the button with the catches that cost money: renewals, lock-ins, exit fees, cancellation rules and refunds. Each line quotes the sentence it came from. If you press the button anyway, Catch writes your exit plan, with the last day to cancel for free, as calendar events.

Gemma 4 E2B runs in your browser on your own GPU. The page text never leaves your laptop.

I built it after an app's free trial turned into a "monthly" plan I couldn't cancel for three months. Leaving early cost $300. The rule was in the terms I scrolled past.

Live demo, no install: https://kinnuworks.github.io/catch/

Video (70 s): https://youtu.be/3MkDbNKn8Ng

How it works

sign-up page ──► find the button ──► read the text around it

…

View on GitHub

The repo has the extension, the landing page, 32 tests, and the whole evaluation: the scripts that fetched the terms, the reviewed labels, and every reader's raw output, including each probability Gemma gave.

How I Built It

Code reads, Gemma checks

The obvious version asks a model to read the terms and say what's wrong with them. I trust that version least. A model that writes the warning can also write a warning that isn't in the document.

So Catch splits the job:

Code finds sentences. A splitter that doesn't break on "$29.99", "e.g." or "section 4.2" cuts the terms into sentences and remembers where each one sits on the page.
Rules cast a wide net. Fifteen patterns pick sentences that might be about renewals, trials, minimum terms, exit fees, cancellation rules or refunds, and guess which kind.
Gemma answers yes or no. For each guess it gets one narrow question, such as "Does this sentence say the customer must pay a fee, or the remaining payments, if they cancel early?"
Code writes the card. The line on the card is built from amounts and durations that code pulled out of the quoted sentence. Gemma can't turn $300 into $30, and it can't add a clause that isn't on the page.

The rules alone are fast and catch real things, but they cry wolf. On Peloton's terms they flag "30 days notice, in writing", which turns out to be about rejecting changes to the arbitration clause. On 1Password's, "within thirty (30) calendar days… in writing" is about erasing data after you leave. Gemma 4 E2B gave those two a 0.44 and a 0.29 chance of being a real cancellation rule, so they stay off the card.

Picking the right Gemma size

I started with Gemma 3 1B because it's an 800 MB download. I asked it eight questions where I knew the answer and looked at how likely it thought "yes" was:

Sentence	Should be	Gemma 3 1B	Gemma 4 E2B
"All amounts paid are non-refundable."	yes	1.00	0.96
"You may cancel at any time and receive a prorated refund…"	no	1.00	0.06
"…Spotify shall have no liability to you." (asked: lock-in?)	no	1.00	0.07
"…terminate before the end of the term, you will be charged an early termination fee."	yes	1.00	0.93
"We will provide at least 30 days' notice prior to any new terms…"	no	1.00	0.20
"Subscriptions automatically renew until cancelled…"	yes	1.00	0.95
"Credits are non-refundable, non-transferable…" (asked: lock-in?)	no	0.97	0.01
"…Babbel will provide you with a pro rata refund…" (asked: exit fee?)	no	1.00	0.24

Out of the box, at 4-bit, with my zero-shot prompt, the 1B said yes to almost everything, so on top of the rules it added nothing. Adding worked "no" examples to the prompt didn't change it. Gemma 4 E2B separated the cases without any fine-tuning, so that's what ships. A 1B fine-tuned on these labels might well do this job; that's the next experiment.

Trusting the confidence, not the word

Even with the bigger model, I don't take the single word it writes. Catch runs one forward pass, looks at the model's scores for "yes" and "no" as the next word, and turns them into a probability. That gives a number between 0 and 1 for every question, so the cut-off is a choice I can measure instead of a guess. Tuned for the best balance on half of my labelled services and tested on the other half, it lands between 0.05 and 0.23. For the card I use a stricter 0.5: it shows fewer catches, but most of what it shows is real, and a card that cries wolf teaches you to ignore it.

Dates are arithmetic, not AI

The exit plan never asks the model for a date. Code finds "7-day free trial", "three (3) months" and "at least 14 days before your next billing date", even when they sit in different sentences, and does calendar maths: three months from January 31 is April 30, not "90 days later". The calendar file opens in Apple Calendar, Google Calendar and Outlook, with a reminder two days before each deadline.

27 real terms documents, labelled by hand

I fetched the terms of 50 subscription services; 27 could be read without running their JavaScript. Catch picked up to 8 candidate sentences from each, 136 in total. An AI assistant (not Gemma, and not the rules) suggested a label for each, and I went through all 136 one by one in a review page before any reader's output was scored. I didn't change any of them, which makes the labels only as good as my review, so every file is in the repo to check. The labels, the suggestions and the review page are all in the repo.

Reader	Precision	Recall	F1	Time per document
Rules only	63%	91%	75%	under 1 ms
Gemma 3 1B, threshold tuned per fold	64%	91%	75%	0.6 s
Gemma 4 E2B, asked about every kind (0.5)	90%	65%	76%	1.7 s
Gemma 4 E2B, rules decide lock-ins (0.5, what ships)	85%	72%	78%	1.4 s

Precision: of the catches shown, how many were real. Recall: of the real catches among these sentences, how many were shown.

The rules alone flag almost every real catch, but more than a third of what they show is wrong. With Gemma 4 E2B checking them, false alarms drop from 37% of the card to 15%, and the card keeps nearly three quarters of the real catches. The 1B made no difference at all, which matches the probe table above.

The first Gemma 4 run taught me where it's weak: it rejected all nine real lock-in sentences, such as "payment obligations are non-cancelable" in Zoom's terms. It reads "minimum term" language as neutral. So lock-ins now skip the model and come straight from the rules, which is how the demo card can still show my three-month lock-in, and fine-tuning for lock-ins is the next job. Gemma also accepted Babbel's fee for skipping a booked class as an exit fee (0.92), a fair reading of the words but not what Catch is for.

Problems I hit

The model wouldn't stay cached. Gemma 4 E2B is two weight files of 1.5 and 1.6 GB. In one browser profile with a 3.9 GB storage quota, the browser silently refused to cache them, so every reload downloaded them again. The extension now asks for unlimitedStorage.
Chrome kept unloading the model. Extension service workers are stopped when idle, which dropped the model from the GPU every few minutes. It now lives in an offscreen document.
"twenty-four months" meant four. A reviewer found that my number parser skipped "twenty" and read "four". Compound numbers, European prices like "29,99 €", and a daylight-saving bug that moved a deadline by a day all have regression tests now.
The exit plan vanished on real checkouts. The first version attached its click listener after the model finished, and a real "Start free trial" navigates away. Now it listens from the start, saves the plan the moment you press, and shows it again on the next page.

Where it's still wrong

It only checks what the rules flag. All 136 test sentences were picked by the rules, so the recall numbers above mean "recall among sentences the rules found". A trap written in words my fifteen patterns don't expect is invisible to Catch and to this test.
The test runs the same weights in a different runtime. The numbers come from Gemma 4 E2B at 4-bit through Ollama on my laptop; the extension runs the 4-bit ONNX build of the same model in the browser. Small differences between the two are possible.
Exit fees were rare in my sample. Only two of the 136 sentences were real exit fees, so that row says little on its own. The exit-fee trap I fell for is in the demo, not in the test set.
English only, text only. Terms inside images, PDFs or a payment provider's iframe are skipped.
It's not legal advice. It points at the sentences worth reading yourself.

Why Does Open Innovation Matter?

It reads every sign-up page I visit. A version of Catch that sent page text to a hosted API would be a log of everything I almost bought. With open weights running in the browser through WebGPU, the page text never leaves the laptop. The only requests are the one-time model download and the site's own terms page, fetched without cookies.

I could take the model apart. The yes-bias only showed up because I could read Gemma's next-token scores directly, and calibrating a threshold on them is what made the 2B model usable. With the weights and the runtime in my hands, I can measure, swap models, or fine-tune.

It costs nothing to run. There's no per-page bill, so there's no reason for Catch to have a subscription.

Where a closed model would be better: coverage. A large hosted model reading the whole document would probably catch traps written in words my fifteen rules never look for. Catch only checks what the rules flag, and I'd rather miss a strangely worded clause than send my browsing to a server.

Prize Categories

Best Use of Gemma: Gemma 4 E2B runs in Chrome through Transformers.js and WebGPU. Catch reads its yes/no probabilities from the logits and calibrates the threshold on hand-labelled data.
Best Use of ElevenLabs: the demo video's narration is my own voice, cloned with ElevenLabs and generated line by line from the script.

I built this with help from an AI coding assistant. Every number in this post comes from the evaluation files in the repo.

48,975 Hugging Face models say apache-2.0. Their family trees say otherwise.

Dhiraj Kavuri — Sun, 18 Oct 2026 18:05:57 +0000

A Hugging Face model page shows you one hop of history: the license the uploader typed, and maybe the base model they fine-tuned. The terms that actually travel with a model come from every model above it. If you fine-tune a fine-tune of Llama 3.2, the Llama 3.2 agreement comes along, whatever your card says.

I wanted to know how often the label on a model disagrees with the terms it inherited. Answering that for one model is a few API calls. Answering it for the whole Hub is a graph problem, so I put the whole Hub in a graph.

The data

The public cfahlgren1/hub-stats dataset has a daily snapshot of every model and dataset on the Hub. On October 18 2026 that was 3,161,594 models. I parsed it with DuckDB and loaded it into FalkorDB:

every model as a Model node, with its license, task, size and downloads;
927,431 lineage edges, typed as FINETUNE_OF, ADAPTER_OF, MERGE_OF or QUANTIZED_FROM from the base_model tags;
386,483 TRAINED_ON edges to 66,243 datasets;
47 License nodes, each linked to the clauses it imposes, with the quote and the source URL for every clause.

A license on Hugging Face is often just other. 123,135 models use that form and put the real name in license_name. 43,164 of them are under FLUX.1 [dev], which is non-commercial. If you only read the tag, you miss all of them.

The finding

242,170 models sit below a model under restricted terms: Llama, Gemma, Qwen, FLUX, Mistral, OpenRAIL, DeepSeek, CC BY-NC, and licenses that say non-commercial or research-only in their name.

48,975 of those declare a permissive license, apache-2.0 or MIT or similar. They had 5.88 million downloads in the 30 days before the snapshot. More than half of them (25,627) have at least 10 downloads, so these are models people use. Only 346 ship any license or notice file.

11,442 of the 48,975 say commercial use is fine while an ancestor's license says it isn't.

The count is one Cypher query once every model is marked with what it inherits:

MATCH (m:Model) WHERE size(m.inherits) > 0 AND m.license IN $permissive
RETURN count(m), sum(m.downloads)

The marking is the interesting part. For each restricted license, a JavaScript UDF inside FalkorDB starts from every model under that license and walks down to every descendant. All 73,794 descendants of Qwen Research models take 0.4 seconds.

Where the wrong labels come from

54% of the 48,975 carry one exact set of tags: unsloth, text-generation-inference, license:apache-2.0. That's the model card template in Unsloth's save.py, which writes license: apache-2.0 on every upload whatever the base model's license is. People fine-tune Llama or Qwen with Unsloth, press push, and the card says apache.

Nobody did anything wrong on purpose. It's a default in a template, multiplied across tens of thousands of uploads. I wrote a patch that reads the license from the base model (following Unsloth's own mirrors up to the original) and falls back to other when it can't. It covers both the library and Unsloth Studio, and Unsloth's own card and export tests pass with it.

The graph also finds where a wrong label starts. 38,489 models declare a permissive license directly on top of a restricted parent. Below 2,438 of them sit 9,386 more models that copied the wrong label from their parent rather than writing it.

Why a graph and not the API

The Hugging Face API lists a model's direct children, 1,000 per page. Finding all 21,639 descendants of Llama-3.1-8B that way takes 21,653 calls, about 3.7 hours at the 0.61 seconds per call I measured. FalkorDB returns the same set in 70 ms.

A Python BFS over an edge list in memory would also be fast. What the graph gave me was one store holding lineage, datasets, licenses and clauses together, which serves a single model check and a Hub-wide audit from the same data and takes new edges without a rebuild. The obligations a model inherits come out of one query: walk the ancestors, follow each one's LICENSED_UNDER edge, collect the clauses.

MATCH (m:Model) WHERE m.id = $id
WITH lineage.ancestors(m, 64) AS anc
UNWIND anc AS a
MATCH (x:Model)-[:LICENSED_UNDER]->(l:License)-[:IMPOSES]->(c:Clause)
WHERE x.id = a.id AND l.permissive = false
RETURN l.family, min(a.depth), collect(DISTINCT c.obligation)

algo.SPpaths then gives the three shortest routes by which a license reaches a model, which is the proof shown on screen. PageRank over lineage says the most depended-on model on the whole Hub is black-forest-labs/FLUX.1-dev, which is non-commercial.

One more question I could only ask with a graph: what if Black Forest Labs relicensed FLUX.1-dev as Apache-2.0 tomorrow? FinePrint copies the 43,700-model family with GRAPH.COPY, changes the license on the copy, walks it again and deletes the copy, in about half a second per request. 27,592 models would still be labelled non-commercial, because their own cards copied the FLUX label and each uploader would have to edit theirs.

The tool: FinePrint

All of this became FinePrint. Give it a model id and a use (commercial or not) and it answers ALLOW, CONDITIONS or BLOCK, with every inherited clause, the license text it comes from, and the path through the family tree.

It fails closed. If any part of the chain is unknown, if an ancestor's license isn't one it recognises, or if the card makes a claim it couldn't resolve, it won't say ALLOW.

Some models don't declare their base in tags at all. deepseek-ai/DeepSeek-R1-Distill-Llama-8B says MIT and names no base model, so the tags alone give UNKNOWN. An LLM agent reads the card, quotes "DeepSeek-R1-Distill-Llama-8B is derived from Llama3.1-8B-Base", finds meta-llama/Llama-3.1-8B in the graph, and writes a typed edge marked with its source and quote. The rules then see Llama 3.1 terms. The LLM never writes a query and never decides a verdict. It only adds evidence the rules can check, and every claim must quote the card word for word.

The same decision runs in places where developers already are:

an MCP server, so a coding agent can check a model, find a clean substitute of the same task and size, and draft the notice file;
fineprint.guard(), which stops a from_pretrained download of a blocked model before the weights arrive;
fineprint check, a CLI that fails a CI build when a repo pulls in a model that is blocked for its use.

Does it work?

I built a sealed test set of 120 models across seven groups (restricted terms two or more hops up, one hop up, clean, FLUX derivatives, merges, a random sample and so on). The gold labels came from a separate script that walks lineage through the live Hugging Face API, not through my dump or graph, and the file was hashed before any system ran.

The number I care about is how often a system calls a restricted model clean, because that is the mistake that ships. Reading the declared license alone did it 33 times out of 69. Looking at direct parents, which is what the model page shows, did it 19 times. An LLM reading the model card did it 8 times.

The strongest baseline was an LLM agent with the live Hub API as tools, allowed 10 calls per model, told to follow every base model up and check every license. It was good. It got more models right than FinePrint on one version of the labels (92 against 80), mostly because FinePrint answers UNKNOWN for models that declare no license at all. But it still called a restricted model clean 5 times, and all five were quantized copies of merge trees where the restricted ancestor sat many hops up. It ran out of calls, or hit a gated repo, before it got there. It needed a median 11 seconds and about 4 Hub calls per model.

FinePrint called a restricted model clean 0 times, found the restricted terms in all 19 cases where they sit two or more hops up, and answered in a median 9 ms with no model calls. It says UNKNOWN when it doesn't know, which costs some answers and is the right trade for this kind of tool.

What it isn't

These are differences between a declared license and upstream terms, not legal findings. Some of these models may have permission I can't see. Whether a non-commercial dataset's terms reach the weights trained on it is legally unsettled, and FinePrint marks those as contested and does not treat them as settled. The point is to show the question before you ship, with the evidence attached.

Thanks

FalkorDB for the database and the hackathon, and cfahlgren1/hub-stats for the daily Hub snapshot that made a Hub-wide count possible. Along the way I hit a FalkorDB UDF bug: a types list in graph.traverse follows only its last type. The repro is in the repo.

Every number in this post comes from a script listed in the repo's CLAIMS.md, and the whole thing rebuilds from one reproduce.sh.

Seven in ten could read the label. One in three could take the right dose

Dhiraj Kavuri — Tue, 13 Oct 2026 15:58:23 +0000

In 2006, researchers handed 395 adults a pill bottle. The label said "Take two tablets by mouth twice daily." Then they asked each person to count out the pills they would take in a day.

Among patients with low literacy, 71% could say the instruction back. Only 35% could count out the right number of pills (Davis et al., Annals of Internal Medicine).

I keep coming back to that gap. People could read the words and still take the wrong dose.

A page of labels like that one
A hospital discharge sheet is a page or two of instructions like that label, handed over when a patient is tired, unwell and about to leave. There are about 35.7 million hospital admissions a year in the United States (American Hospital Association). The CDC counts more than 1.5 million emergency visits a year for harm from a medicine (CDC).

Some people are hit harder than others:

61.2 million people in the United States are 65 or older (Census Bureau). They land in an emergency department for a medicine problem more than twice as often as younger people.
28.9 million speak English less than very well (Census Bureau).
28% of adults aged 16 to 65 score at the lowest literacy level (NCES).
Pictures work
This part surprised me most. The evidence for pictures is old and strong.

In one study, people remembered 14% of spoken medical instructions. With pictographs next to the same instructions, they remembered 85% (Houts et al.). In a randomized trial with 245 caregivers, picture instruction sheets cut the share of parents who measured a child's medicine wrong from 47.8% to 5.4% (Yin et al.).

So why doesn't every patient get pictures? Because someone has to draw them, for every medicine, dose and language.

Image models can draw them. They also miscount.
An image model will draw a pictogram for any instruction you give it. I tried it for a hackathon. I asked for one spoonful of medicine and got eight spoons. Across 168 pictures of whole doses, the model drew the wrong number of pills 83 times.

On a medicine card, a picture with three pills for a dose of two is worse than no picture.

Concord: every picture has to pass a reading test
So I built Concord around one rule. A generated picture is shown to a patient only after two other models, from two different companies, have looked at it with no hint and said in their own words what it shows. If they misread it, it is thrown away and drawn again.

The image model is never asked to count. It draws one pill. The check confirms it is exactly one. Code repeats it for the dose, so the number on a card is exact.

The check earns its place. Asked for a swollen foot, the model drew something both readers called "a red sock". That picture never reached a card.

The same card in 70 languages
A picture needs no translation. The words around it do, so they go through the same kind of check. One model writes the label or the medicine's name in the patient's language. A second model, which never saw the English, reads it back.

I ran that on every prescribable medicine with a WHO classification code: 1,830 medicines in 69 languages, 126,270 names. 98% came back as the same medicine. The ones that did not stay in Latin letters on the card.

So a patient who reads Hindi sees "Metformin 500 mg" and, under it, "मेटफॉर्मिन 500 mg".

Try it
Concord is free, needs no account, and the code is open.

Live: https://concord-health.vercel.app
Code: https://github.com/kinnuworks/concord
It is a reading aid. It redraws what the sheet says and adds no medical advice. The next step is a comprehension study with patients and a pharmacist, and if you work in a pharmacy or on a ward I would like to hear from you.