Privacy policy
Your data is yours. This page says what AskCash collects, why, and what we do not keep.
What we collect and why
We collect only what the product needs.
Account
We ask for an email address so we can send a sign-in link. We store that address, a hash of the sign-in token, when the token expires, and whether it was used. We may store when your email was first verified. We do not ask you to make a password.
Cookies
We use first-party cookies so the website can work:
- A session cookie keeps you signed in on the website.
- A referral cookie named
affiliate_refstores a signed id for the person whose invite link you used. It lasts about 30 days. It is first-touch only: if a valid referral cookie is already set, a later invite link does not replace it. It is HttpOnly. It is not bank data. We do not use it for advertising or ad targeting.
Bank connection
When you connect a bank, you do it in Plaid Link. We store what we need to keep that connection: a Plaid item id, an encrypted access token, the institution id and name, the institution logo Plaid provides (a brand image, not account data), and an error code if the connection needs you to sign in again.
We do not store your transactions. We do not store Plaid transaction payloads. We do not store balances. A transaction id is not a stored transaction.
When you or an agent you connected ask, we fetch balances and transactions from Plaid at that moment. Those fetches are not saved as bank records.
Two things may be saved on purpose, and only because you or your agent set them. They are not the transaction:
- Receipt notes you save, keyed to a Plaid transaction id.
- A custom category label you set, encrypted, keyed to the same kind of id.
Plaid’s own privacy policy applies to Plaid. Ours does not replace it. We will not describe Plaid’s use of data in a way that contradicts Plaid’s privacy policy.
Billing and referrals
Paid use goes through Stripe Checkout. Card numbers are entered on Stripe’s page, not on ours. We store Stripe’s customer id and subscription id, the status, whether renewal is off, and when the current paid period ends.
If you invite someone or join through an invite link, we may also store a referral record: who invited whom, the status of that invite (for example pending, qualified, expired, rejected, or forfeited), when attribution ends, a reward amount when one qualifies, and Stripe invoice or balance-transaction ids tied to that reward. Those records are account and billing data. They are not Plaid transaction payloads, balances, or stored transactions.
Connected agent
AskCash is used through an agent you connect. We store the codes and refresh tokens that keep that connection alive. Signing out of the website does not disconnect the agent. Disconnecting the agent revokes those tokens.
The agent you connect receives the results of the tools you let it call. AskCash is not that agent.
What we do not do
We do not use bank data for advertising.
When we access or share information
We use vendors to run the product. Today those are:
- Plaid, for the bank connection
- Stripe, for payment
- Resend, for sign-in email
- Render, for hosting the app
- Doppler, for secrets, not for a copy of your bank data
We do not add a vendor to this list in secret. If the live set changes, this page will change.
We share data if you tell us to, including by connecting an agent. We may share it if the law requires it.
Disconnect, cancel, and deletion
Disconnecting a bank deletes that connection record and, when a live bank connection is configured, asks Plaid to disconnect the bank. For some banks, the bank’s own permission screen can still show a connection after that.
Disconnecting a bank does not delete receipt notes or custom categories.
Cancel subscription stops the next charge. Access lasts through the paid period. It does not delete your account. See the cancellation policy.
Delete My Account closes your account. Content becomes inaccessible right away. We permanently delete account data from active systems within 30 days, and from backups within 60 days. Details are on the cancellation policy.
Security
See the security overview. Tokens and custom category labels are encrypted in the field. We do not claim the whole database is encrypted, and we do not claim a certification.
Your choices
You can disconnect a bank. You can disconnect the agent. You can stop renewal. You can ask us what we store.
Privacy: privacy@askcash.app. General questions: hi@askcash.app.
Operator: Ironwood Development LLC, a Utah limited liability company, doing business as AskCash. 879 N Sapphire St, Morgan, UT 84050.
Changes
If this page changes in a way that matters, we will change the date at the bottom.
Adapted from the Basecamp open-source policies / CC BY 4.0.