What we store, and who else sees it

Only what the app needs to do its job:

• Your email address, and a password that is hashed by our authentication provider. We never see or store the password itself.
• Your display name and profile picture, if you signed in with Google or typed a name on your account page.
• The currency you chose.
• Every entry you record: amount, date, category, any note, and the name you typed for a person or savings pot. Names of people are free text you chose; nothing is looked up about them.
• Receipt photos and PDFs you upload.
• A short audit row for each extraction attempt, so a failure can be diagnosed.
• Feedback you send: the message, the category, the page you were on, and your browser's user-agent string.

CashFlow is a small project built on other companies' infrastructure. These are all of them, and what each one receives:

• Supabase hosts the database, authentication and the receipt files. It holds everything listed above.
• Vercel hosts the site and serves every page, so it processes requests including your IP address, as any web host does.
• Groq reads your receipts and hears spoken questions. When you upload a receipt, the image or its extracted text is sent to Groq so the amount, date and shop can be read back. When you use CashBot's microphone, the recording is sent to Groq to be turned into text. Neither feature works without it.
• OpenRouter answers CashBot questions. When you ask CashBot something, it looks up what that question needs: your current balances, totals for the period you asked about, and the matching entries, at most 100 per lookup. Your receipts and login details are never sent.
• ExchangeRate-API supplies the daily exchange rates behind the approximate net worth and total figures, shown only when you record in more than one currency. It receives only your base currency code, from our server; none of your figures are sent.
• Your browser's push service (Google for Chrome and Android, Apple for Safari and iPhone, Mozilla for Firefox) carries renewal reminders, only if you turn notifications on. The reminder is encrypted for your device, so the push service cannot read it.
• Resend delivers feedback notifications by email, so a message you send through the feedback form passes through it.
• Google, only if you choose to sign in with Google, which tells us your email address, name and profile picture; and only if you click Add to Google Calendar on a subscription, which opens Google Calendar with that subscription's name, amount and renewal date filled in for you to save.

What those companies then do with what they receive is governed by their own terms, not by this page. We do not claim otherwise, and we would rather say that plainly than imply a guarantee we cannot give.

• Your records are not sold, rented or shared with advertisers.
• There is no advertising on the site, and no third-party advertising or tracking scripts.
• No one is sent marketing email. The only email sent to you is about your own account, such as confirming your address.
• Your entries are not read for any purpose other than making the app work, and are not used to build a profile of you.

Every row and every uploaded file is scoped to your account by the database itself, using row-level security, rather than by the application remembering to filter. That distinction is the whole point: a mistake in the app cannot show you somebody else's data, because the database would refuse the query.

There is also no master key in the system. Every read and write runs with your own permissions, so there is no single credential that could expose everyone's records if it leaked. Receipt files live in a private store, not at a public address.

Supabase stores everything encrypted at rest using AES-256, and every connection to the site and to the database runs over TLS. That is Supabase's doing rather than ours, and it is the same protection their other customers get.

It is worth saying what that covers, because the word is often read as more than it is. Encryption at rest protects the stored copy, so somebody who obtained the physical disks could not read them. It does not hide your records from anything holding valid database credentials, because the database decrypts them automatically for any query it accepts. The part that actually keeps your records yours is the row-level security described above.

Your figures are not separately encrypted with a key only you hold, so we could in principle read them, and so could anyone who compelled us legally. If that matters to you, it should weigh more than the AES-256 line does.

The site measures page views and loading speed through Vercel Analytics and Speed Insights. These set no cookies and use no cross-site identifiers, so they cannot follow you to other websites. They tell us which pages are visited and how quickly they load, not who you are.

Entries and receipts are kept until you delete them, because a money record is only useful as history. A receipt file is deleted once nothing points at it: when you delete the entry that used it, or when an upload is abandoned before it was saved.

• Take everything with you at any time. Any date range exports as a PDF statement or a CSV spreadsheet from the settings page, with no request needed.
• Correct or delete any single entry yourself, whenever you like.
• Delete your whole account by asking. Being straight about this: there is no delete-account button yet, so it is a manual request and a person has to act on it. It is on the list to build.

CashFlow is not intended for children under 13, and accounts are not knowingly created for them.

If what is stored or who receives it changes, this page changes in the same release, and the review date above moves. When a change is significant you will be asked to agree again rather than being assumed to have accepted it.

Use the feedback form inside the app, under your account menu, for anything about your data, including a deletion request. It reaches the person who built this.