Signing up is one tap because they want your money now. Canceling has extra pages because they want your money later. That isn’t a philosophy of careful decisions. That’s a hose with a valve only they control.
Accident is a tiny problem. They already know how to solve it.
One confirm screen — “Cancel plan? You keep access until the 20th.” — stops almost every misclick. That is equal-easy plus a seatbelt. What he wants is the maze: call this number, wait on hold, “talk to a specialist,” ignore the first button, offer 50% off if you stay. That does not prevent accidents. It prevents exits.
If friction is so wise, put it on the way in.
Make signup a 20-minute call. Make people read the full price including the year-two jump. Make them wait for a “retention specialist” before the card is charged. He will never argue for that, because impulse is profitable and reflection is not. The second friction is only sacred when you try to leave, you know it isn’t about mistakes.
“They might still want it” is the company appointing itself your parent.
People cancel on purpose: broke, unused, switching, got billed twice. The seller does not get a veto because maybe you’ll miss the app. You can resubscribe in the same one click it took to join. Easy in and easy out is how you know the product is actually wanted, not just hard to bury.
Hard cancel is not a safety feature. It is a dark pattern.
Hide the link, split the flow, use guilt copy, make the button say “pause” when you meant “stop charging me.” That is designed confusion. Designed confusion is not prudence.
So his rule is: joining should be a reflex, leaving should be a project. That’s not protecting subscribers. That’s protecting the charge that hits when they forget.
Cancel should be the same door you walked in — same place in the account, same number of steps, same device, no human hostage-taker. A single “are you sure?” is fine. A gauntlet is a confession.