Privacy Policy

Your information, plainly.

Last updated: September 2, 2026

1About Cashly

Cashly is a personal-finance app for tracking what you spend, keeping budgets, and splitting expenses with friends. It’s available on iOS and Android, with a website at cashlyapp.io. Cashly is operated by Ruthran Baskar, an individual based in India (“we”, “us”). When we say “Cashly” we mean the app and the website together.

This policy explains what information Cashly collects, why, where it goes, how long it stays, and what you can do about it, in plain language. If anything is unclear, write to us at help@cashlyapp.io.

2Scope

This one policy covers the Cashly iOS app, the Cashly Android app, and cashlyapp.io. It describes what Cashly does today. When Cashly changes in a way that affects your information, we’ll update this policy first (see section 21).

3Information we collect: the short version

• Account information — your name, the email address from your sign-in provider, and an optional profile photo.
• Your financial entries — the transactions, budgets, goals, and wallets you create. Cashly does not connect to your bank.
• Shared expenses — the groups, splits, and settlements you take part in, which are visible to the other people in them.
• Photos you attach — receipts and your profile photo.
• Technical information — crash reports (heavily stripped, see section 9) and standard website hosting logs.

The Cashly app has no advertising, no ad tracking, and no analytics SDKs; the website uses one privacy-respecting, cookieless analytics service, described in section 8. Cashly does not request or collect your precise device location, and we never sell your information.

4Account information

You sign in with Apple or Google: there’s no Cashly password. When you sign in, your provider shares your email address and name with our authentication system, and Cashly stores them as part of your account. During setup you can adjust your display name and add a profile photo.

One detail we’re proud of: the Cashly app itself is blocked from reading your email address. It’s kept server-side for account and security purposes only, like preventing someone else from claiming your account. Your display name and profile photo are visible to people you share groups or friendships with.

Cashly also stores your chosen base currency and your settings. Some settings, like App Lock, live only on your device and never reach our servers.

5Personal-finance information

Everything you enter (transactions, amounts, descriptions, categories, wallets, budgets, goals, labels) is stored in your account so it can sync between your devices. Your own money data is private to you: it’s protected by database rules that only let your account read your rows, and it’s never shown to other users, never used for advertising, and never sold.

Cashly’s suggestions (like remembering which wallet you used at a payee last time) are computed on your device from your own entries and are not uploaded anywhere.

Cashly does not link to bank accounts. Nothing is imported from a bank, and no bank credentials are collected.

6Split and shared-expense information

Splitting is shared by nature. When you create or join a group, split an expense, or settle up, the other participants can see that activity: the group name, who paid, who owes what, expense names, dates, and any receipts attached to shared expenses.

If you add someone who isn’t on Cashly as a guest, you give us their name, and optionally an email address or phone number, so the group’s records make sense. Please only add details you’re entitled to share. If you’ve been added as a guest and want your details removed, contact us (section 18): we can remove your identifying details while keeping the group’s maths intact for its other members.

Shared records belong to everyone in them. That has one important consequence for deletion, explained in section 17.

7Files and images

Receipts and profile photos are stored in private storage: there are no public links. Receipts on your own transactions are visible only to you; receipts on shared expenses are visible to that group; profile photos are visible to people you interact with in Cashly.

8Device and technical information

The app works offline-first: your own entries are saved on your device and synced to your account when you’re online. Cashly does not request or collect your precise device location, doesn’t collect your contacts or advertising identifiers, and contains no analytics or advertising SDKs.

The website is hosted on Vercel, which, like any web host, processes visitors’ IP addresses in routine server logs. The website sets no tracking cookies. If you join the waitlist, we store the email address you give us for that purpose alone (see section 15 for how long). To keep the signup form from being abused, our server also rate-limits signups using a salted, unreadable code derived from the connection’s IP address; it is kept for at most 48 hours, and the address itself is never stored.

The website also uses a privacy-respecting analytics service (PostHog, hosted in the European Union) to count visits and see which pages and sections matter, how long they’re read, how far pages are scrolled, which buttons and links are used, and how many visitors go on to join the waitlist. It builds anonymous heat maps of where visitors click and scroll. It runs without cookies and stores nothing on your device; events are anonymous; we don’t record what you type, and the measurements travel through our own domain rather than to any third-party address. If you join the waitlist, we count that a signup happened — never the address you entered.

If you turn on notifications about group activity, the app stores a push token and an app-installation identifier for your device so notifications can be delivered through Firebase Cloud Messaging, Google’s notification service, which hands delivery to Apple’s notification service on iOS. Notification text tells you who did what, for example “Alex added an expense in Goa Trip”, and can include the expense amount and your share of it.

9Crash and error diagnostics

Cashly uses a crash-reporting service (Sentry, hosted in the EU) so we can find and fix bugs. We’ve configured it deliberately narrowly: crash reports contain technical stack traces, device model, OS version, and app version. They are configured not to include your name, your email, your IP address, your screen contents, or anything you’ve entered about your money. Log lines attached to crash reports pass through an automatic scrubber that removes emails, tokens, identifiers, and content before anything leaves the app.

10Sign-in providers

Apple and Google handle the sign-in step under their own privacy policies. Apple lets you hide your real email with a private relay address; Cashly works fine with that. We receive the identity token, email, and name your provider shares; we never see your Apple or Google password.

11How we use information

• To run Cashly: sync your entries, compute balances, show shared activity to the right people.
• To keep accounts secure and prevent abuse: authentication, rate limits, block and report features.
• To fix problems: crash diagnostics as described above.
• To answer you when you contact us.
• To send you the launch announcement if you joined the waitlist.

We do not use your information for advertising, we don’t profile you, we don’t make automated decisions with legal effects about you, and we don’t sell or rent personal information to anyone.

12When information is shared

Your information is shared only:

• With people you share with — group members and friends see the shared activity described in section 6.
• With third-party providers that operate parts of Cashly (section 13) — some process information on our behalf, while platform services such as Apple and Google process information under their own terms and privacy policies.
• If the law requires it — we may disclose information where a valid legal obligation compels us to.
• To keep Cashly safe — abuse reports and related records may be reviewed to protect users.

13Service providers

Supabase, Sentry, Vercel and Firebase process information on our behalf and keep routine operational logs and backups under their terms. Apple and Google (as sign-in and store providers) are independent platform providers, not our processors.

14Where your information lives

Your account and financial data are stored in India (AWS Mumbai, via Supabase). Crash diagnostics are stored in the EU (Sentry). Website traffic passes through Vercel’s global network. If we ever move primary storage to a different region, we’ll update this policy first.

15How long we keep information

• Your account data (profile, transactions, budgets, wallets, receipts, settings) — for as long as your account exists. Deleting your account deletes it (section 16).
• Shared records — for as long as the group’s other participants need them (section 17).
• Entries you delete in the app — removed from view immediately; background copies that keep your devices in sync exist only while your account does, and are deleted with it.
• Group and guest invitations — expire after 30 days.
• Your friend code — valid until you rotate or replace it.
• Activity history on shared expenses — kept while the group keeps its records.
• Waitlist emails — used only for the launch announcement and then deleted; unsubscribing removes you earlier.
• Abuse and safety reports — kept as long as reasonably necessary for safety, abuse prevention, investigations, dispute handling, or legal obligations.
• Provider logs and backups — our infrastructure providers keep routine server logs and backups on their own cycles; deleted data leaves those systems on the provider’s schedule rather than instantly.

16Deleting your account

You can delete your account from inside the app: Settings → profile → Delete account. The app first shows you exactly what will happen, including any outstanding balances, and asks you to type a confirmation. An outstanding balance never blocks deletion.

Account deletion starts immediately and cannot be undone: there is no grace period. As part of the deletion process, Cashly’s active systems remove your sign-in account, your profile, all your personal-finance data (transactions, budgets, goals, wallets, labels), your receipts and profile photo, your contacts and friendships, your invitation codes, and your device’s notification registration. Limited residual copies may remain temporarily in infrastructure backups until those backups rotate (section 17).

17Shared records after deletion

Shared expenses are other people’s financial records too. If we erased your side of a split, your friends’ balances would silently change, so shared records are handled differently, and we want to be straightforward about it:

• Expenses, shares, and settlements in groups you were part of remain, so everyone else’s history and balances stay correct.
• Your identifying details on those records are removed: your email and phone are erased and your name is replaced with “Deleted member”. Other members will see, for example, “Deleted member paid” on old expenses.
• If you created a group, its administration passes to its longest-standing member so the group isn’t stranded.

Backup copies held by our infrastructure providers expire on their backup cycles rather than instantly.

18Your choices and rights

Most things you can do yourself, right now, in the app: view everything you’ve entered, correct it, delete individual entries, leave groups, block people, manage notifications, and delete your whole account.

For anything else (a copy of your information, a correction you can’t make in-app, removing guest details someone entered about you, a question, or a complaint), email help@cashlyapp.io. We’ll need to verify you’re the right person before acting on a request, and we’ll respond as quickly as we reasonably can. Applicable law, including India’s data-protection framework, may give you specific statutory rights; we honour requests in line with the law that applies to you.

One honest limitation: Cashly doesn’t yet have a self-serve “download my data” button. Until it does, we handle access requests manually through the address above.

19Security

All traffic between your device and our servers is encrypted in transit (TLS). Data access is controlled by authentication and per-row database rules, so one account cannot read another’s private data. Files live in private storage with short-lived access links. Optional App Lock protects the app on your device with your face, fingerprint, or passcode. No system is perfectly secure, and we don’t claim to be. But we build carefully, and if we ever discover a breach affecting your information, we’ll deal with it responsibly and notify you and the authorities where the law requires.

20Age requirement

Cashly accounts are intended only for people aged 18 or older. If we learn that an account holder is under 18, we will take appropriate steps to close the account and remove their personal information, subject to the shared-record handling described in this policy. (If someone added you to a split as a guest and you want your details removed, whatever your age, see section 18.)

21Changes to this policy

When we add features that change what Cashly collects (for example product analytics or bank connections), we’ll update this policy before the feature goes live, change the date at the top, and for significant changes tell you in the app or by email.

22Contact

Privacy questions, requests, and complaints: help@cashlyapp.io. A person reads it.