Privacy policy.

CashKitty is a personal finance app. In this page we means Deepchain Labs — the company that makes CashKitty and decides what happens to the data described here — and you means the person using it. Reach us at support@cashkitty.app, or by post at Deepchain Labs, Plot No. 01, Road No. 13 (Garib-E-Nawaz Avenue), 6th Floor, Sector No. 13, Uttara, Dhaka-1230, Bangladesh. More about the company is on About us.

• Your account. Your name, email address, and a password stored only as a hash. If you sign in with Google we receive your name, email address and profile picture from Google — never your Google password.
• What you record. Wallets, records, amounts, dates, categories, labels, notes, people you record money with, budgets, goals, debts, planned payments, events and warranties. If you add a place to a record, its name and coordinates.
• Files you attach. Receipts and documents you upload, and the account details you choose to store against a wallet.
• People you save. The name of anyone you add to your contacts in CashKitty, and their phone number or email address if you choose to keep those too. We read your phone’s contact book only at the moment you pick someone, and only the person you picked is saved — the rest of your contacts never leave your phone and never reach us.
• Technical records. Your sign-in sessions and devices, and server logs needed to run and secure the service. If you turn notifications on, the push token that identifies that phone to the notification service, so a reminder can reach it. Turning notifications off stops us sending to it, and closing your account clears it with everything else.

We do not ask for, and have no way to receive, your bank credentials. CashKitty does not connect to your bank — everything in it is what you or someone sharing a wallet with you put there.

If you buy Premium. Your card number, wallet PIN and banking credentials are entered on SSLCommerz’s own secure page, not on ours, and never reach us. No card number is stored anywhere in CashKitty, not even a masked one: SSLCommerz sends us the method only as a name, like “bKash” or “VISA” and the bank behind it. What else comes back is the result of the payment and enough to identify it — the amount, the currency, the date and their transaction reference — which we keep because tax law requires a record of a sale and because it is how we find your payment when you ask for a refund.

No card is kept, and nothing is charged automatically. SSLCommerz offers us no way to store a card or to charge one later, and we have not asked for one. Every payment needs you on their page at the time, which is also why Premium is paid for a month at a time rather than by subscription.

No app store is involved. Payment happens on this website only, so Google Play and the Apple App Store receive nothing about what you buy from us, hold no subscription of yours, and are not told that you are a customer. The mobile apps take no payment and send no payment data anywhere.

To show you your own records, to sync them between your devices, to send the reminders and notifications you ask for, to keep your account secure, and to answer you when you contact us. That is the whole list.

• We do not sell your data, and we do not share it for advertising.
• There are no third-party analytics or advertising trackers in CashKitty. We do not build a profile of you.
• Nobody on our side reads your records out of curiosity.

• People you share a wallet with. If you invite someone to a wallet, they see that wallet’s records and the categories it uses, as a viewer or a member depending on the role you give them. You can remove their access at any time.
• Anyone holding a share link. If you create a link to a wallet’s details, anyone with that link can open it until you revoke it or it expires. Treat it like a key.
• Our payment gateway. If you buy Premium, SSLCommerz receives your name, email address, phone number and the amount so it can take the payment and send you its own confirmation of it. It handles your card or wallet details itself, under its own terms and its own card-industry obligations, and we never see them. It requires a phone number and a billing location: the number is yours, and the location we send is our own company’s, not a guess about where you live.
• The companies that help us run it. Hosting and storage, email delivery, push notification delivery, and an exchange-rate provider. They process data on our instructions and only to provide their part of the service.
• Authorities, where the law genuinely requires it.

Traffic is encrypted in transit. Passwords are stored only as hashes and can never be read back. Sensitive stored values are encrypted before they are written. Every uploaded file is scanned for malware before it can be opened, and files are served in a way that stops them running anything in your browser.

On your phone, CashKitty keeps a copy of your data so it works without a connection. That copy is encrypted with a key held in your device’s secure storage, and it is removed when you sign out of the account on that device.

No service can promise perfect security. If we ever discover a breach that affects you, we will tell you.

Your records stay until you delete them or close your account. Deleted records and files are removed from our systems, though they may persist briefly in backups before those expire. Sign-in sessions expire on their own.

Payments are the exception. An invoice, what it was for and the gateway’s reference for it are a record of a sale, which tax law requires us to keep even after an account is closed. A refund request is kept with the payment it is about, for the same reason and so we can answer if you ask us about it later.

• A copy. You can export your records from the app at any time, as CSV, Excel or PDF.
• A correction. Everything you record is yours to edit in the app.
• Deletion. Close your account yourself from Settings → Privacy & security, in the app or on this website. It is scheduled 30 days out and you can cancel at any point before then; what happens when you do is written out in full. If you cannot sign in, email support@cashkitty.app.

Depending on where you live you may have further rights over your data, including the right to complain to a data protection authority.

The website uses cookies to keep you signed in and to protect forms against cross-site request forgery. There are no advertising or tracking cookies, so there is no consent banner to dismiss.

CashKitty is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has an account, tell us and we will remove it.

If this policy changes in a way that matters, we will say so in the app before the change takes effect. The date at the top always reflects the current text.

See also our terms of service.