Security Practices

Cashrou has no connection to any bank and never asks for an online banking username or password. Nothing is imported from your accounts, and there is no stored credential of yours for anyone to lose, which is the single largest thing this app does not carry.

Signing in uses a link sent to your email address, or Sign in with Apple. There is no Cashrou password to be guessed, reused across sites or leaked in somebody else’s breach. Keeping access to your email account is what keeps your Cashrou account secure.

Your records travel between your devices and our database over an encrypted connection, and are stored encrypted at rest by our database provider.

Every record is tied to your user id, and the rule that says only you may read or write it lives in the database rather than only in the app. A request for another person’s records is refused where the data is, not where the buttons are.

The apps carry no session recording and no general-purpose analytics product. We record which steps of the initial setup you reach, so we can see where people get stuck; those events carry a step name and a count and never a figure, so nothing you enter into Cashrou is measured.

The iPhone and iPad app does carry advertising measurement from TikTok and Meta, so that paid advertising can be attributed to the sign-ups it produces. It reports installs, sign-ins, trials and subscriptions, with your name and email hashed on the device before they are sent. It reports none of your money: no account, balance, transaction, bill, income, goal or debt. The Privacy Policy sets out exactly what leaves the phone.

The marketing website at cashrou.com is separate and does use Google Analytics, through Google Tag Manager, to count visits and see which pages people read. That measures the website, never the app.

Asking the assistant a question sends that question, together with a summary of where you currently stand, to Anthropic, the company that provides the model behind it. Your figures reach another company in two places, and you start both. This is one, and the other is reading a screenshot: the picture stays on your phone, which reads the text off it and sends only that, with anything shaped like a full account number stripped out. Neither happens unless you ask for it, and the summary here is rebuilt on your device each time. Anthropic processes it to write the answer and does not use it to train its models, and neither your question nor the answer is stored on our servers. The optional connector for outside AI tools such as Claude, ChatGPT or Cursor works on the same principle and stays off until you switch it on.

Subscriptions are billed by Apple on the App Store and by Stripe on the web. Neither passes us your card number. We are told whether a subscription is active, which plan it is and when the period ends.

Cashrou includes a control to erase your financial data. Deleting your account deletes the records attached to it, because they are attached to it.

No method of storage or transmission is completely secure. Cashrou cannot guarantee that data will never be lost or exposed, particularly if a device or an email account is compromised.

Send a clear description to hello@cashrou.com. Please do not access, alter or retain another person’s data, and please do not publicly disclose an unresolved vulnerability.

This page is updated when what Cashrou does changes, and before it introduces anything material it does not do today, such as bank connectivity.