Privacy Policy

Last updated: June 22, 2026

1. Data Controller

CURTY DIGITAL LLC, 629 Maple Valley Drive - 524, Farmington, MO 63640-1951, USA.

Contact: info@curty.us

EU Representative (GDPR Art. 27): To be designated. EU data subjects may contact us at info@curty.us for all GDPR-related requests.

2. Data We Collect

  • Identity: Name, username, profile photo
  • Contact: Email address
  • Financial: Transactions, balances, budgets, savings goals, debts, recurring payments, shopping lists
  • Technical: Device type, OS, app version, crash reports (via Sentry, anonymized)

3. Legal Basis (GDPR Art. 6)

  • (b) Contract Performance: Providing the financial management service you requested
  • (c) Legal Obligation: Complying with applicable laws and regulations
  • (f) Legitimate Interest: Improving our service, preventing fraud, ensuring security
  • (a) Consent: AI processing of financial data (explicit opt-in, revocable anytime)

4. California Privacy Rights (CCPA/CPRA)

California residents have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

  • Right to Know: What personal information we collect and how it's used
  • Right to Delete: Request deletion of your personal information
  • Right to Correct: Request correction of inaccurate personal information
  • Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information. No action needed.
  • Right to Limit Use of Sensitive Personal Information: We do not process sensitive personal information beyond what's necessary for the service
  • Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise these rights, contact us at info@curty.us.

5. AI Processing of Financial Data

Cashual offers optional AI features powered by Google Gemini and OpenRouter. These features are:

  • Opt-in only: Disabled by default. You must explicitly enable AI in Settings
  • Revocable: You can disable AI at any time from Settings → AI Configuration
  • No model training: Your data is not used to train any AI models
  • Processed by third parties: Google Gemini and OpenRouter process your queries under their respective privacy policies

6. Data Sharing and Third Parties

We never sell your data. We share data with the following service providers:

  • Appwrite: Backend-as-a-Service (data storage, authentication)
  • RevenueCat: Subscription management and validation
  • Google Gemini / OpenRouter: AI processing (only when AI is enabled)
  • Sentry: Anonymized crash reporting for debugging

7. Data Retention

Your data is retained while your account is active. Within 30 days of account deletion, all data is permanently removed from our servers. Offline data stored on your device is your responsibility.

8. Your Rights (GDPR Arts. 15-22)

  • Access: Request a copy of your personal data
  • Rectification: Request correction of inaccurate data
  • Erasure: Request deletion of your data (“right to be forgotten”)
  • Portability: Export your data in CSV/JSON format from Settings → Export Data
  • Objection: Object to certain types of processing
  • Restrict Processing: Request restriction of processing in certain circumstances

To exercise these rights, contact info@curty.us.

9. Children's Privacy (COPPA)

Cashual is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us and we will delete it promptly.

10. Security Measures

  • Encryption for data at rest (Appwrite server-side encryption)
  • TLS 1.3 for all data in transit
  • Biometric authentication (Face ID / Touch ID)
  • Secure Enclave (Keychain on iOS, Keystore on Android) for tokens and keys
  • Content Security Policy (CSP) and HSTS headers
  • No hardcoded API keys in client code

11. International Data Transfers

Your data is processed in the United States (Appwrite Cloud). For EU data subjects, we rely on Standard Contractual Clauses (SCCs) as per GDPR Art. 46 for international data transfers.

12. Cookies and Local Storage

Cashual uses only essential local storage (AsyncStorage/SecureStore) for app functionality. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. See our Cookies Policy for details.

13. Do Not Sell My Personal Information

Under CCPA, California residents have the right to opt-out of the sale of their personal information. Cashual does not sell your personal information, so no opt-out is necessary. This right is automatically honored.

14. GDPR Art. 27 EU Representative

CURTY DIGITAL LLC is a US-based entity offering services to EU data subjects. Under GDPR Art. 27, we are in the process of designating an EU representative. Until then, EU data subjects may contact us directly at info@curty.us for all GDPR-related requests. We are committed to full GDPR compliance.

15. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via email or in-app notification. Continued use of Cashual after changes constitutes acceptance of the updated policy.

16. Contact

For privacy questions or to exercise your rights:

Email: info@curty.us

You also have the right to lodge a complaint with your local Data Protection Authority (DPA).