Privacy Policy

We do not request or process: first name, last name, tax ID, date of birth, address, phone number, gender, identity document.

At every new sign-in we record:

These data are used exclusively for account security (suspicious access detection, anti-abuse). They are always collected and are not subject to the Improvement Programme opt-out (see §3.5).

These data live on our remote database (Supabase, European servers) associated with the user’s nickname and email. By design they do not contain personal identifying details of the real person, unless the user voluntarily inserts them (e.g. account names including their surname — a discouraged behaviour, see /privacy-radicale).

The content of these files is end-to-end encrypted on the user’s device before upload, with a key generated on the device and protected by the document code (separate from the account password); the 24 recovery words (BIP39 seed) are the backup copy of that key. The key never leaves the device in clear: our server only stores its encrypted form, and of the documents’ content we only see blocks of digital noise. The information the user attaches to a file stays readable, so it can be searched and organised: title, notes, date, type and size, warranty and policy details, and the link to transactions.

To improve the app we measure:

This data is pseudonymised at collection and normally analysed in aggregate form (art. 4.5 GDPR). It stays on our European Supabase servers: no third-party service (Google Analytics, Mixpanel, Amplitude, Sentry, Firebase Analytics, etc.).

A technical link to your account remains necessary, and in a limited number of cases a member of our team may look at usage data relating to a single account. This happens for four purposes, all tied to running and improving the service: (a) honouring the per-user opt-out (to stop collecting your account's data we need to know which data is yours); (b) measuring coverage by operating system (beta tester priority and platform support); (c) answering your support requests, where knowing which features you used and which errors you hit is often the only way to understand the problem; (d) diagnosing faults affecting few people, which aggregate numbers hide by definition.

Outside these purposes we do not use this data: no commercial profiling, no advertising, no automated decisions concerning you, no sale or sharing with third parties. Usage data does not affect the price you pay or the terms we offer you, and is not used to build behavioural profiles for marketing.

You can turn off collection at any time in the app settings, under “Improvement Programme” (opt-out).

Processed only if you actively choose to sign up (opt-in). See §5 for the third-party service that hosts them (ActiveCampaign). For the launch waiting list we also keep a row in our European databases — email, language and date — for one reason only: to know how many of the people who signed up then created an account. Nothing else, and no profiling. You can ask for deletion by writing to privacy@cashfulness.com, in addition to the unsubscribe link in every email.

Not processed directly by Cashfulness. Subscription payments go through:

Apple App Store and Google Play act as merchant of record: they process the user’s name, address, credit card, IBAN, and are responsible for issuing invoices or fiscal receipts to end users according to their own policies and the regulations of each country. For these two channels Cashfulness only receives the net proceeds and an opaque subscription identifier (e.g. sub_abc123): we never see the customer name, address, tax ID, credit card, IBAN.

On the website, too, we are not the seller. For subscriptions purchased via the website the seller is Link (Sold through Link, LLC, a Stripe group company), which acts as merchant of record: it collects the payment, calculates and remits the taxes of the customer’s country, issues receipts and invoices, and handles refunds and disputes. Link and Stripe process these data as the seller, under their own privacy policy. To calculate taxes Stripe asks for name and billing address: Vittorio Giusti srl sees them in the Stripe dashboard, together with the email address, the card network and last 4 digits, the payment outcome and a customer identifier, but name and address never enter the app’s database. We never receive the full credit card number or the security data (CVV). To link the payment to the account, Cashfulness sends Stripe the email address and the user identifier; when the payment is received we store the association between the user and the Stripe customer identifier.

Payment data for the web channel that we see in the Stripe dashboard are processed by Vittorio Giusti srl for the performance of the contract (Art. 6.1.b GDPR) and for the accounting obligations tied to the monthly invoice to Link (Art. 6.1.c GDPR); see §4 and §7.

If you turn on push notifications, we process:

Tokens and the sending queue stay on our Supabase servers in Europe. Delivery goes through Google Firebase Cloud Messaging and, on iPhone, through Apple Push Notification service: both see the token, the title and the text of the notification (see §5). On Mac, Windows and Linux there are no push notifications: reminders are generated on the device and never leave the app.

Legal basis: performance of the contract (art. 6.1.b GDPR), because you request the notifications by turning them on. You can turn them off at any time in the app settings or in the operating system; the token is deactivated and deleted together with the account.

When you write to info@, support@ or beta@cashfulness.com, or send a report from the app, we process what you send us: the text of the message, your email address, your nickname, the platform and version of the app, any attachments. How we use them, and with which tools, is described in §5.1.

Support requests. The requests that reach info@, support@ and beta@cashfulness.com and the reports sent from the app are read by a person on our team. To classify them and prepare a first draft reply we use Claude, an artificial intelligence tool by Anthropic: the text of the request and, for reports from the app, nickname, email address, platform, app version and any attachments are processed by Anthropic in the United States. We use it with an individual subscription, governed by Anthropic’s terms of use for individual users: there is no data processing agreement (DPA) between us and Anthropic, and in the account settings we have turned off the use of content to train the models. The draft is always reviewed, corrected and sent by a person: no reply goes out automatically. We are moving this processing to a server owned by Vittorio Giusti srl in Italy: once that is done, Anthropic will no longer receive this data and we will update this policy.

In-app assistant. The app contains an assistant that answers questions about using Cashfulness, available depending on your plan. When you ask it a question, the model receives your question, your language, the latest messages of the same conversation and a few excerpts from the manual. It does not receive your accounting data: accounts, balances, transactions and documents stay out. The model runs on a computer owned by Vittorio Giusti srl in Italy, reached through an encrypted connection provided by Tailscale, which cannot read its content (see §5). The text of the question is sent exactly as you write it: do not include personal data you do not want to share. Conversations are stored on our Supabase servers in Europe and are deleted together with the account. The assistant gives guidance on using the app, not financial, tax or legal advice.

Website chat. The chat window on cashfulness.com is not connected to any artificial intelligence service and does not send data to third parties. If we activate it, we will update this policy first.

We do not use your data to train artificial intelligence models, ours or anyone else’s, and we do not hand datasets to AI providers.

To exercise any of the rights listed above, the user can:

We will respond within 30 days of the request (extendable by a further 60 days for particularly complex requests, under Art. 12.3 GDPR; the user will be informed if so).