privacy.

This Privacy Policy describes how cashbff (the "Service") collects, uses, and safeguards information about its users. cashbff uses your information to operate the Service. cashbff does not sell your information, and cashbff does not share your information with third parties for their own use.

Information We Collect

Depending on how you interact with the Service, cashbff may collect the following categories of information:

• Your phone number, which serves as your sign-in identifier.
• Your name, used to personalize the calendar and any communications cashbff sends to you.
• Transaction data obtained through Plaid, including account balances, account metadata, and transaction history. This access is read-only. cashbff never receives or stores your bank credentials.
• The scheduled expenses that you enter into your calendar.
• The recurring transaction streams that cashbff detects from your activity (for example, a monthly Netflix charge that recurs on the 14th of each month).
• Your email address, which is collected only as part of the /school flow for purposes of parental consent and receipts.
• Your Stripe customer information, which applies only to /school parents who pay for the Service. Stripe holds the payment instrument; cashbff retains only a Stripe customer identifier.

cashbff does not collect Social Security numbers, government-issued identification, contacts, location data, or microphone or camera data.

How We Use Your Information

cashbff uses the information described above to operate the calendar, to keep your scheduled transactions and forecasts current, to detect your recurring expenses, to maintain bank connectivity through Plaid, to send one-time codes by SMS at sign-in, and to send occasional product communications by email if you have opted in. Each category of data collected is tied to a feature of the Service that you actively use.

cashbff does not display advertising and does not operate an advertising business. No portion of your information is sold or licensed to any third party.

Use of Aggregated, Anonymized Data

cashbff may use aggregated and anonymized patterns derived from product usage to improve forecasting and transaction categorization for all users. Examples include statistics such as the share of subscriptions that bill on the first of the month, or the mapping of merchant names to spending categories. No information used for these purposes can be reasonably linked to an identifiable individual.

cashbff does not sell your information. cashbff does not share your information with third parties for their own use. This applies to advertising, analytics, and any other purpose.

AI Assistants You Connect

If you connect cashbff to an artificial-intelligence assistant (for example, Claude or ChatGPT) using cashbff's MCP connector, that assistant may read the same financial data you can view on your home page, including your running balance, recurring expenses, scheduled bills, recent transactions, and the results of searches you initiate. This access is read-only. Connected assistants cannot create, modify, or delete data within cashbff, and they cannot access the data of any other user.

cashbff logs the following information for each tool call made by a connected assistant: the name of the tool invoked (for example, search_my_transactions), the parameters passed (for example, the merchant searched or the date range), the size of the response returned, a timestamp, and your opaque user identifier.

cashbff does not receive or log the natural-language conversation between you and the assistant, the assistant's reply, or any other content from that chat session. Such content remains between you and the assistant you have chosen to use. cashbff responds only to the specific data requests that the assistant transmits on your behalf.

cashbff uses these tool-call logs to understand the questions users ask about their finances. If many users request a feature that the Service does not yet support, cashbff may add it. cashbff does not sell these logs and does not share them with third parties.

You may disconnect any AI assistant at any time through that assistant's connector settings. In Claude, for example, the path is Settings, then Connectors, then cashbff, then Disconnect. Disconnection terminates all future access immediately.

Third-Party Service Providers

A limited number of service providers support specific functions of the Service. Each provider receives only the information necessary to perform its role, and each maintains its own privacy policy that governs its handling of that information:

• Plaid connects your bank account and returns balances and transactions. Plaid maintains its own privacy policy and receives only the information required to retrieve your account data.
• Twilio delivers SMS one-time codes. Twilio maintains its own privacy policy and receives only your phone number and the code being sent.
• Stripe processes payments and, for /school, performs age verification. Stripe maintains its own privacy policy and receives only the information required to process payment and verify identity.
• Anthropic provides the AI capabilities that power cashbff's recurring-detection and forecasting features. Anthropic maintains its own privacy policy and receives only the prompts cashbff sends, which do not include raw account data or directly identifying information.
• PostHog provides anonymized product analytics. cashbff transmits event names and your opaque user identifier to PostHog, and does not transmit your email address, phone number, or transaction details. PostHog maintains its own privacy policy. Session recordings are disabled.
• Vercel hosts the cashbff website and collects cookieless, edge-anonymized pageview counts and Web Vitals metrics (page-load performance) so that cashbff can evaluate site performance on real devices. Vercel does not receive information that identifies you.

Note: AI assistants that you choose to connect through services such as Claude or ChatGPT are not listed above because they are selected by you, not by cashbff. The handling of data through that integration is described in the section titled "AI Assistants You Connect."

Your Rights

You may request deletion of your information at any time by emailing daksh@cashbff.com. cashbff will complete deletion within 30 days. You may also request a copy of all information cashbff holds about you, which cashbff will provide by the same channel. If you reside in California, the California Consumer Privacy Act (CCPA) grants you the right to know what information is collected, to receive a copy of that information, to request its deletion, and not to be discriminated against for exercising these rights. The email address above is the means by which you may exercise each of these rights.

cashbff retains your information only for the period during which you remain an active user, plus 30 days following deletion to ensure that the deletion has propagated through cashbff's backups.

Cookies and Tracking

cashbff uses two categories of cookies. The first category supports authentication state and consists of cbff_session, cbff_signup, and cbff_school, all of which are first-party and HttpOnly. The second category supports analytics and consists of ph_* cookies set by PostHog to deduplicate events across page loads. cashbff does not use advertising cookies.

Children Under 18

The standard Service is intended for users who are at least 18 years of age. Minors may use cashbff only through the /school flow with parental consent. The information collected from minors consists of the same minimal categories collected from any other user, together with a record of parental consent (parent name, parent email address, and timestamp). cashbff does not knowingly collect information from any individual under the age of 13. If you believe that a child under the age of 13 has registered for the Service, please contact cashbff at the address below and the associated information will be deleted.

Changes to This Policy

In the event of any material change to this Privacy Policy, cashbff will notify you by email at least 30 days before the change takes effect. Non-material clarifications and typographical corrections will be reflected by an updated "Last Updated" date below.

Contact

For questions, deletion requests, or any other matter relating to this Privacy Policy, please contact daksh@cashbff.com.