CashAfter App Privacy Policy

1. Who is responsible for your data

CashAfter for Android (package com.vimaxstudio.cashafter) is published by Vimax Studio. The app uses the same service and account as the website cashafter.app, so the same rules apply. For any questions about your data, email support@cashafter.app.

2. What stays on your device

Your device stores your sign-in keys so you do not have to type your password every time, your language and theme, and your answer to the analytics question. All of this is deleted when you uninstall the app. Your account and the data in it are not deleted with the app: see below for how to delete them.

3. Your account and data on our servers

You need an account to use the app. Our servers store:

• account data: email address, a hash of your password, language and settings;
• financial data you enter yourself: wallets, balances, transactions, categories, regular payments, obligation rules, income sources and the upcoming payments calculated from them;
• statement import (Pro plan): uploaded statement files, the recognised rows and the categories you pick while reviewing them;
• referrals: your invite code, who registered with it and the reward status. The person you invited sees your email in masked form;
• shared workspaces: invitations and members;
• subscription: plan, trial end date and your identifiers at the payment provider;
• technical data: server logs with IP address, time and request details. We need them for security and troubleshooting.

4. Third-party services

A few services help us run the app. Here is what each of them receives:

• Google Firebase Analytics: in-app events (sign-in, sign-up, opening screens and similar actions), an installation ID, device model, OS version, language and approximate location based on your IP address (country or region). Analytics runs only with your consent: the app asks on first launch, and you can change your answer in the settings.
• OpenRouter and the AI models it routes to (for example Anthropic or OpenAI): they recognise and categorise the statements you upload for import. They only receive the statement lines and your category names, never your email, password or other account data. The request is processed on the fly, and where the provider offers the choice, we do not allow your data to be used for model training.
• Paying for Pro: if you subscribe through Google Play, Google Play handles the payment; if you subscribe on the website, Paddle does. We never see your payment details, only a confirmation of the subscription.
• Email service: messages about confirming your address, resetting your password, the trial period and invitations.

Learn more in the Google Privacy Policy, the Firebase privacy information, the Paddle privacy policy and the OpenRouter privacy policy.

5. What the app does not do

The app does not connect to banks or cards and does not store bank login details. It does not read your contacts, precise location or photos, does not use the camera or microphone, and shows no ads. It only accesses files when you pick a statement to import yourself. We do not sell data.

6. Legal basis

Under the GDPR:

• account, financial data, import, subscription and the emails about them: performance of our agreement with you;
• server logs and abuse prevention: our legitimate interest in keeping the service secure and stable;
• analytics: your consent.

7. Where data is processed

Data is stored on our servers. The services listed above may process it outside Ukraine and the EEA, including in the US. Where the law requires it, we use the safeguards it provides for.

8. How long we keep data

• account and financial data: as long as your account exists;
• statement files: deleted as soon as recognition finishes, and within 24 hours at the latest. Recognised rows stay until you add or delete the import;
• expired sign-in keys and one-time codes: deleted automatically;
• server logs: a short time, old entries are overwritten automatically;
• Google Analytics events: 2 months; user-level data: up to 14 months after your last activity.

9. How to delete your data

• You can delete your account in the app itself: Settings, then "Delete account", and confirm with your password. All your financial data, imports, settings, subscription and sign-in keys are deleted immediately. If you have an active subscription, we cancel it, and if you have shared your workspace with other people, you need to revoke their access first.
• If you cannot sign in, email support@cashafter.app from the address your account is registered to, with the subject "CashAfter: data deletion". Deletion takes up to 30 days, and we will reply to confirm once it is done.
• After deletion we keep only a hash of your email address, so that one address cannot get the trial period over and over, and the billing records we are required to keep by law.
• Data on your device is deleted when you uninstall the app. Analytics data is deleted automatically once the periods above run out.

10. Children

The app is not intended for children under 16, and we do not knowingly collect their data. If such data has reached us, let us know and we will delete it.

11. Your rights

Under the GDPR and similar laws, you can find out what data we hold about you, ask us to correct, delete or export it, and object to its processing. You can export and delete your data right in the app; for anything else, email support@cashafter.app. If you believe we are breaking the law, you can complain to the data protection authority in your country.

California residents: we do not sell or share personal information as defined by the CCPA.

12. Changes

If anything changes, we will update this page and the date at the top.