No bank credentials, ever
Cashrou has no connection to any bank and never asks for an online banking username or password. There is no transaction feed and no stored credential of yours for anyone to lose, which is the single largest thing this app does not carry.
No passwords to steal
Signing in uses a link sent to your email address, or Sign in with Apple. There is no Cashrou password to be guessed, reused across sites or leaked in somebody else’s breach. Keeping access to your email account is what keeps your Cashrou account secure.
Encrypted in transit and at rest
Your records travel between your devices and our database over an encrypted connection, and are stored encrypted at rest by our database provider.
Access enforced by the database
Every record is tied to your user id, and the rule that says only you may read or write it lives in the database rather than only in the app. A request for another person’s records is refused where the data is, not where the buttons are.
No trackers in the app
The apps carry no advertising SDK, no analytics and no session recording. Nothing you enter into Cashrou is measured. The marketing website at cashrou.com is separate and does use Google Analytics, through Google Tag Manager, to count visits and see which pages people read. That measures the website, never the app.
Payment details never reach us
Subscriptions are billed by Apple on the App Store and by Stripe on the web. Neither passes us your card number. We are told whether a subscription is active, which plan it is and when the period ends.
Erase and delete
Cashrou includes a control to erase your financial data. Deleting your account deletes the records attached to it, because they are attached to it.
Your part
- Protect the email account you sign in with, since that is the key to Cashrou.
- Protect your devices with a passcode and biometric lock.
- Keep your devices and Cashrou updated.
- Be careful with screenshots that contain your balances.
- Erase Cashrou data before transferring or disposing of a device.
Limitations
No method of storage or transmission is completely secure. Cashrou cannot guarantee that data will never be lost or exposed, particularly if a device or an email account is compromised.
Reporting a vulnerability
Send a clear description to hello@cashrou.com. Please do not access, alter or retain another person’s data, and please do not publicly disclose an unresolved vulnerability.
Changes
This page is updated when what Cashrou does changes, and before it introduces anything material it does not do today, such as bank connectivity.