privacy.

the short, no-nonsense version. we use your data to power your calendar. we don't sell it. we don't share it.

what we collect

depending on which side of the product you're on, we collect some mix of:

• your phone number. how you sign in.
• your name. for personalizing the calendar and any messages we send.
• transaction data via plaid. balances, accounts, transaction history. read-only. we never see your bank password.
• the scheduled expenses you add to your calendar yourself.
• the recurring streams we detect from your activity (e.g. that netflix charge that hits the 14th of every month).
• your email. only collected on the /school flow, for parental consent and receipts.
• your stripe customer info. only for /school parents who pay; stripe holds the card, we just see a customer id.

that's it. no ssn. no government id. no contacts. no location. no microphone, no camera.

how we use it

to power the calendar. to keep your scheduled transactions and forecasts current. to detect your recurring expenses. to keep your bank in sync via plaid. to text you a one-time code when you sign in. to send you the occasional product email if you've opted in. that's the whole loop. every byte you give us has a purpose tied to a feature you actually use.

we don't run ads. we don't have an ad business. there's nothing about your data that gets sold or licensed.

research data (anonymized)

we may use aggregated, anonymized patterns from how the product is used to make our forecasting and categorization smarter for everyone. things like "what fraction of subscriptions tend to bill on the 1st" or "which merchant names map to which category." nothing that could identify you.

we never sell your data. we never share it with third parties for their own use. not for ads, not for analytics, not for anything.

third parties we work with

a few partners power parts of the product. each gets only the data they need to do their job, and each has their own privacy policy that governs what happens on their side:

• plaid. connects your bank, returns balances + transactions. they have their own privacy policy and only see what they need to fetch your account data.
• twilio. sends our sms one-time codes. they have their own privacy policy and only see your phone number and the code we send you.
• stripe. processes payments and (for /school) handles age verification. they have their own privacy policy and only see what's needed to charge you and verify identity.
• anthropic. the ai that powers our recurring detection and forecasting features. they have their own privacy policy and only see the prompts we send them, never your raw account or identifying info.

your rights

you can ask us to delete your data anytime by emailing daksh@cashbff.com. we delete within 30 days. you can also ask for a copy of everything we have on you, and we'll send it the same way. if you're in california, the cppa gives you the right to know what we collect, get a copy, delete it, and not be discriminated against for asking. the email above gets you all of that.

we keep your data only as long as you're an active user, plus 30 days after deletion to make sure things have actually flushed through our backups.

cookies

only what we need to keep you logged in. specifically: cbff_session (your auth cookie) and cbff_signup / cbff_school (temporary signup-state cookies). no analytics cookies. no ad trackers. no third-party trackers of any kind.

under 18

the regular product is 18+. minors can use cash bff only through our /school flow with parental consent. the data we collect from minors is the same minimal set as anyone else, plus a record of their parent's consent (parent name, parent email, timestamp). we do not knowingly collect data from anyone under 13. if you think a child under 13 has signed up, email us and we'll delete it.

changes to this policy

if anything material changes, we'll email you before the change takes effect. small clarifications and typo fixes get a new "last updated" date here.

contact

questions, deletion requests, or anything else: daksh@cashbff.com.