Privacy Policy

Last updated: June 8, 2026

This Privacy Policy explains how CashInk ("we", "us", "our") collects, uses, and protects your personal information when you use the CashInk mobile app (the "App"). By using the App, you agree to the practices described here.

1. Information we collect

• Account information. When you sign in with Apple or Google, we receive your email address, full name (if you choose to share it), and a stable unique identifier. We never receive your Apple or Google password.
• Financial data you enter. Accounts, transactions, categories, budgets, and related metadata that you create inside the App. This data is only used to provide the App's features to you.
• Diagnostics. Crash reports, error telemetry, and performance traces via Sentry, and structured application logs via Axiom. We use these strictly to detect and fix problems. When the App crashes, Sentry may capture a short recording of the screen at the moment of the crash to help us reproduce the issue; these recordings are accessible only to our engineering team and are subject to the retention limits below.
• Device information. Device model, operating system version, app version, and IP address, submitted alongside diagnostic events.
• Subscription information. If you purchase a paid plan, our payments partner RevenueCat records your subscription status and purchase events, linked to your CashInk user identifier. Your payment is processed by Apple; we never receive your card or payment-method details.

2. How we use your information

• Provide and maintain the App and its core features.
• Authenticate your account and keep it secure.
• Sync your data across your devices.
• Diagnose crashes, errors, and performance issues.
• Process in-app purchases and manage your subscription.

We do not use your information for advertising, profiling, or to train machine-learning models. We do not sell or rent your personal information to anyone.

3. How we share your information

We share data only with the following sub-processors, strictly as needed to operate the App. None of them are authorized to use your data for their own purposes.

• Apple — Sign in with Apple authentication.
• Google — Google OAuth authentication.
• Google Cloud Platform (European Union) — hosting for our API servers, managed PostgreSQL database, and self-hosted sync engine; stores your account and financial data.
• MongoDB Atlas (European Union) — sync data store for cloud-sync (paid) accounts.
• RevenueCat (United States) — subscription and in-app-purchase management.
• Cloudflare — DNS and hosting for this website (cashink.app).
• Sentry — crash, error, and performance telemetry, including short on-error screen recordings.
• Axiom (European Union) — application log aggregation.

4. Data retention

Your account data is retained while your account is active. If you delete your account from within the App (Settings → Account → Delete Account), your data is soft-deleted immediately and permanently removed from our database within 30 days.

Diagnostic data held by Sentry and Axiom (crash reports, logs, on-error screen recordings) is automatically purged in line with each provider's retention policy — currently no more than 90 days for Sentry and 30 days for Axiom — after which it cannot be linked back to your account. Our managed database (Google Cloud SQL) keeps point-in-time recovery snapshots for up to 7 days; deleted records are unrecoverable once that window elapses.

5. Your rights

• Access: request a copy of your data at support@cashink.app.
• Correct: update profile and financial records directly in the App.
• Delete: remove your account from within the App at any time.
• Object or restrict: stop using the App at any time.
• GDPR / CCPA: if you are located in the EEA, UK, or California, you have additional rights under applicable law. Email support@cashink.app to exercise them.

6. Security

All traffic between the App and our servers is encrypted in transit (TLS 1.2+). Your data is encrypted at rest in our managed PostgreSQL database, and on your device the local database is encrypted at rest with SQLCipher (AES-256). Authentication credentials are never stored on our servers — we rely entirely on Apple and Google to authenticate you. Access to production systems is limited to the minimum personnel required and protected by hardware-key two-factor authentication.

7. Children

CashInk is not directed to children under 13 and we do not knowingly collect personal information from them. If you believe a child has provided us information, email support@cashink.app and we will remove it.

8. Changes to this policy

We may update this policy from time to time. Material changes will be announced in the App before they take effect.

9. Contact

Questions? Email support@cashink.app.