Security Practices

Cashrou does not receive or store your banking username or password. If you choose an optional US bank connection with Ultra, authorization is handled through Stripe Financial Connections. Cashrou receives the account information you permit and uses it for your financial planning. The connection cannot move money.

Signing in uses a link sent to your email address, or Sign in with Apple. There is no Cashrou password to be guessed, reused across sites or leaked in somebody else’s breach. Keeping access to your email account is what keeps your Cashrou account secure.

Your records travel between your devices and our database over an encrypted connection, and are stored encrypted at rest by our database provider.

Every record is tied to your user id, and the rule that says only you may read or write it lives in the database rather than only in the app. A request for another person’s records is refused where the data is, not where the buttons are.

The apps carry no session recording and no general-purpose analytics product. We record which steps of the initial setup you reach, so we can see where people get stuck, and how long each visit to the app lasts, in seconds; those events carry a step name, a count or a number of seconds and never a figure, so nothing you enter into Cashrou is measured. We also record which screens you open, each as a number, and a few actions such as adding an account, including the screens you see before signing in, which are linked to your account once you sign in.

The iPhone and iPad app does carry advertising measurement from TikTok and Meta, so that paid advertising can be attributed to the sign-ups it produces. It reports installs, sign-ins, trials and subscriptions, with your name and email hashed on the device before they are sent. It reports none of your money: no account, balance, transaction, bill, income, goal or debt. The Privacy Policy sets out exactly what leaves the phone.

The marketing website at cashrou.com is separate and does use Google Analytics, through Google Tag Manager, to count visits and see which pages people read. That measures the website, never the app.

Asking the assistant a question sends that question, together with a summary of where you currently stand, to Anthropic, the company that provides the model behind it. Your figures reach another company in two places, and you start both. This is one, and the other is reading a screenshot: the picture stays on your phone, which reads the text off it and sends only that, with anything shaped like a full account number stripped out. Neither happens unless you ask for it, and the summary here is rebuilt on your device each time. Anthropic processes it to write the answer and does not use it to train its models, and neither your question nor the answer is stored on our servers. The optional connector for outside AI tools such as Claude, ChatGPT or Cursor works on the same principle and stays off until you switch it on.

Subscriptions are billed by Apple on the App Store and by Stripe on the web. Neither passes us your card number. We are told whether a subscription is active, which plan it is and when the period ends.

Cashrou includes a control to erase your financial data. Deleting your account deletes the records attached to it, because they are attached to it.

No method of storage or transmission is completely secure. Cashrou cannot guarantee that data will never be lost or exposed, particularly if a device or an email account is compromised.

Send a clear description to hello@cashrou.com. Please do not access, alter or retain another person’s data, and please do not publicly disclose an unresolved vulnerability.

This page is updated when Cashrou changes its data processing or security practices.