1. Who operates Cashrou
Cashrou is operated by XCAVAR LLC, Miami, Florida, United States. Privacy questions may be sent to hello@cashrou.com.
2. Information Cashrou holds
Cashrou keeps the information below on our servers so that one plan is available on your iPhone, your iPad and the web app, and so it survives losing a device. It is stored in a Postgres database operated for us by Supabase, and it is used to run Cashrou and for nothing else. We do not sell it and we do not use it for advertising.
- Profile information such as first name, last name and email address.
- Account names, balances, ownership percentages and whether an account is shared.
- Income, bills, recurring items, subscriptions and reimbursements.
- Payday schedules, paydays, buffers, allocations and paid or unpaid status.
- Debt balances, annual percentage rates, minimum payments and payoff preferences.
- Goals, emergency-fund targets, business entries and net-worth snapshots.
- Language preferences, onboarding status and app settings.
3. How information is used
Cashrou uses the information above to work out what is left in a payday, how long a debt will take to clear, what your goals and net worth are, and which bills fall in which pay period. Those calculations run on your device and on our servers. Access is restricted to your own account: every record is tied to your user id and the database refuses reads and writes for anybody else.
4. What we receive, and what we never receive
Your financial records are transmitted to us, because that is what keeps the iPhone app, the iPad app and the web app showing the same plan. They travel over an encrypted connection and are stored encrypted at rest.
There are things we never receive:
- Bank credentials. Cashrou has no connection to any bank and no way to read your accounts, so there is no username or password of yours for us to hold. You type your balances in yourself.
- Card numbers. Payment is handled by Apple on the App Store and by Stripe on the web. Neither passes us your card details. We are told only whether a subscription is active, which plan it is, and when the current period ends.
If you contact support by email, you may choose to provide contact details, screenshots, diagnostic information or other content. Support communications are processed only to respond to your request and maintain service records.
5. Bank connections and the companies that help us run Cashrou
Cashrou does not connect to banks, does not store bank credentials and does not use Plaid or any similar service. There is no transaction feed in Cashrou, which is why it can plan what is coming rather than report what went.
We use a small number of service providers to operate the app. They process information only on our instructions and may not use it for their own purposes:
- Supabase hosts the database that holds your Cashrou records, and the authentication service that signs you in and holds your name, email address and session records.
- Apple distributes the iPhone and iPad apps and processes subscription payments made through the App Store. If you opt in through iOS, Apple may share anonymous crash and usage diagnostics with us.
- Vercel hosts cashrou.com and app.cashrou.com and runs the small server functions behind them.
- Stripe processes subscription payments made on the web and holds the payment details you give it directly.
- Resend delivers our email: the link that signs you in, and the payday reminders if you have turned them on.
We may also disclose information where legally required, or to protect our rights or the safety of others.
6. If you use a form on cashrou.com
Two forms on the website collect something before you have an account, and neither of them touches your financial records.
- The early-access form stores your first name, your email address, which phone you use and how you budget now, so we can tell you when the apps are released. It is one email, on the day they are out. There is no newsletter, and the list is not sold or shared.
- The contact form stores your name, your email address and the message you wrote, and emails it to us so we can answer you. Replying goes to you directly.
Both also store a salted, one-way hash of your network address, which we use to stop the same machine submitting a form hundreds of times. It cannot be reversed into an address. Ask us at any time to delete either, and we will.
7. Measurement on the website
The website at cashrou.com uses Google Analytics, loaded through Google Tag Manager, to count visits and see which pages are read. It sets cookies in your browser and tells us things like which page you arrived on and roughly where in the world you are. It is about the website, not about you: it has no way to see anything inside Cashrou, because the app is a different site behind a sign-in.
The apps themselves carry no analytics at all. Nothing you enter into Cashrou, no balance, bill or goal, is measured or sent anywhere for measurement.
Browsers offer a Do Not Track setting and most ad blockers stop this kind of measurement entirely. Neither affects your ability to use Cashrou.
8. Copies on your own devices
Cashrou also keeps a copy of your records on each device you use it on, so the app works when you are offline. Your operating system may include that copy in device backups, depending on your settings. Those backups are controlled by Apple and by your device, not by us.
9. Data retention
Your records stay in your account until you change them or delete them. Delete your account and they go with it. The copy held on a device stays there until you erase it in Cashrou, delete the app, or reset the device.
10. Data deletion
You can erase your financial data from inside Cashrou. Deleting the app removes the copy held on that device but does not delete your account, because the account is what the other devices sign in to.
To delete the account itself, including your name, your email address and every financial record attached to it, email hello@cashrou.com and we will remove it within 30 days. Deleting the account deletes the records: they are attached to it and go when it goes.
Depending on where you live, you may have additional rights over your personal information, including access, correction, deletion and portability. Contact us and we will honour them.
11. Security
Your records travel over an encrypted connection and are stored encrypted at rest. Access is enforced per account in the database itself rather than only in the app, so a request for somebody else’s records is refused by the database. Signing in uses an emailed link or Sign in with Apple, so there is no Cashrou password to be guessed or reused. No system can guarantee absolute security, and protecting the devices and the email account you sign in with remains important.
12. Children
Cashrou is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.
13. Where information is processed
We operate in the United States and your information is processed there, where privacy laws differ from those in other countries. Cashrou may be used from other countries, and using it means you understand that processing happens in the United States.
14. Changes to this policy
We will update this policy when what Cashrou does changes, and before introducing anything material that it does not do today, such as bank connectivity. The date at the top of this page is when it last changed.
15. Contact
XCAVAR LLC, Miami, Florida, United States. hello@cashrou.com