Your privacy matters. This Privacy Policy explains what personal information TheCashFox collects, how we use it, how we protect it, and the choices you have. It applies to our website and all services operated under TheCashFox (the "Service").
1. Information we collect
Information you provide
Account information — name, email address, and password (stored as a cryptographic hash, never in plain text). If you sign in with Google, we receive your name, email address, and Google account ID from Google.
Business and financial data — business names, book titles, entry amounts, categories, descriptions, receipts, comments, and attachments you upload
Team and collaboration data — invitations you send, team member emails, and role assignments
Payment information — if you subscribe on our website, billing details are collected and stored directly by Stripe. If you subscribe inside our iOS or Android app, the purchase is handled by Apple or Google and we receive only an anonymous purchase identifier and your subscription status through RevenueCat, our subscription management provider. In every case we receive only a customer identifier and whether the subscription is active. We never see or store your card number.
Support correspondence — messages you send us
Information collected automatically
Usage data — pages visited, features used, device type, browser, operating system, referring URL, timestamps
Log data — IP address, access times, and errors encountered (used for security, debugging, and abuse prevention)
Cookies and similar technologies — used to keep you signed in, remember preferences (e.g. theme), and measure usage. You can disable cookies in your browser but some features may stop working.
Mobile app permissions
Our iOS and Android apps ask for permissions only when you use the related feature, and you can turn them off at any time in your device settings:
Camera — to photograph a receipt so it can be attached to an entry or scanned to fill in the entry for you
Photo library — to choose an existing receipt image to attach or scan
Face ID / fingerprint — to unlock the app. Biometric checks are performed entirely by your device's operating system; we never receive or store your biometric data.
The app stores your sign-in token in your device's secure storage (iOS Keychain / Android Keystore). We do not use advertising identifiers or track you across other apps.
2. How we use your information
To provide, operate, and maintain the Service
To authenticate you and protect your account
To process payments and manage subscriptions (via Stripe on the web, and Apple or Google with RevenueCat in the apps)
To send transactional emails — account verification, password reset, team invitations, report emails you have opted into
To improve the Service, fix bugs, and add features
To detect and prevent fraud, abuse, and security incidents
To comply with legal obligations
We do not sell your personal information, and we do not use your financial data to train AI models.
3. AI features and third-party processing
Some features use our AI provider, Anthropic, to process data on your behalf. We send only what each feature needs, and only when you use it:
Receipt scanning — the receipt image or PDF you choose to scan
Category suggestions — the description of the entry you are typing, plus your list of category names
Describe-a-transaction entry — the sentence you type (for example "Paid 5000 for rent yesterday")
Cash flow insights — totals, counts, and category and book names for the book you are viewing. Individual entry descriptions are not sent.
Anthropic processes this data under its commercial terms, does not use it to train its models, and may keep it for a limited period for safety and abuse monitoring before deleting it. We do not sell your data or use your financial data to train AI models.
4. Sharing and disclosure
We share your information only with:
Service providers who help us operate TheCashFox — hosting (Railway), payments (Stripe on the web; Apple and Google for in-app purchases, with RevenueCat managing subscription status), email delivery (Resend), error monitoring (Sentry), AI processing (Anthropic), sign-in with Google and website analytics (Google), and bot protection on sign-up (Cloudflare Turnstile). Each is bound by contract to protect your data and use it only for the services they provide us.
Team members you invite — if you invite another user to a business, they will see the business data you share access to, scoped by their role.
Legal requests — if required by valid law, court order, or subpoena, or to protect rights, property, or safety.
Successors — in a merger, acquisition, or sale of assets, your data may transfer to the successor entity, subject to this Policy.
5. Data retention
We retain your account and business data for as long as your account is active. If you close your account, we will delete or anonymise your personal data within a reasonable period, unless we are required to retain it to comply with legal, tax, or accounting obligations or to resolve disputes.
6. Security
We use industry-standard measures to protect your information, including HTTPS encryption in transit, encrypted passwords, access controls, and regular security review. No system is perfectly secure, but we work hard to keep your data safe and will notify affected users promptly of any confirmed data breach as required by law.
7. Your rights
Depending on where you live, you may have the right to:
Access the personal information we hold about you
Correct inaccurate information
Delete your account and associated personal data
Receive a copy of your data in a portable format
Object to or restrict certain processing
Withdraw consent where processing is based on consent
You can update your profile and delete your account directly inside the Service, on the web and in the mobile app — see how to delete your account for the steps and for exactly what is removed and what we must keep. Pro users can also export any book as PDF or CSV. For a full copy of your data, or anything else, email us.
8. Children
TheCashFox is not directed at children under 16 and we do not knowingly collect personal information from them. If you believe a child has given us information, contact us and we will delete it.
9. International data transfers
Your information may be processed in countries other than the one you live in. By using the Service you consent to the transfer of your information to those countries, subject to appropriate safeguards.
10. Cookies
We use strictly necessary cookies (session, authentication, theme preference, CSRF protection) and Google Analytics cookies, which help us understand which pages and features are used. Google Analytics collects usage data such as pages visited, approximate location, and device type; it does not receive your financial data. We do not use advertising or cross-site tracking cookies. You can block analytics cookies with your browser settings or Google's opt-out add-on without affecting how the Service works.
11. Changes to this Policy
We may update this Policy from time to time. When we make material changes we will notify users by email or through the Service. The "last updated" date at the top of this page reflects the most recent revision.
12. Contact
Questions about this Policy, or want to exercise your rights? Email [email protected].