Data Retention & Deletion Policy

1. Purpose

Cash Reveal stores transaction history so you can browse your spending calendar over time. When you disconnect a bank, you choose whether to keep or delete that bank's imported history.

This Policy explains what information may be retained, why it is retained, and how users can request deletion.

2. Information We Retain

To provide the calendar and bank connection features, we store:

• Transaction amounts, dates, merchants, categories, currencies, and currency conversions
• Pending and recurring status, transaction identifiers, and hide/include preferences
• Bank connection identifiers, institution names and logos, account masks, and sync status
• A device identifier used to associate your app with its bank connections and history
• Plaid access tokens while a bank connection remains linked

Financial history is stored in our backend database and cached on your device. Widgets store recent spending summaries. Our backend processes readable financial data to provide bank sync.

3. Retention of Historical Financial Data

While a bank is linked, we retain imported history to provide your calendar. We do not currently apply an automatic age or inactivity cutoff to that history.

Choose “Stop syncing, keep history” to remove the Plaid connection and keep past transactions available in Cash Reveal. The disconnected bank is archived, its access token is removed from our active database, and it no longer imports new transactions. Retained history stays until you delete it.

Choose “Stop syncing, delete history” to remove the Plaid connection, its stored access token, and that bank's imported transactions from our active database. You can also delete the history of a bank you previously archived.

Older app versions that do not offer a keep-history choice delete imported history when you successfully disconnect. Update the app to use the choices described here.

4. Data Deletion Requests

Users may request deletion of their stored data at any time.

In Settings, open a bank's disconnect options and choose “Stop syncing, delete history.” Repeat for each bank whose history you want removed. Hiding a transaction only excludes it from spending totals; it does not delete it.

For help deleting data, or to request deletion of support communications or other personal information, contact: support@cashreveal.app. We may need to verify your request. Do not send bank passwords, access tokens, or transaction histories by email.

Cash Reveal associates history with a device identifier, not an email-based account. An email address alone may not identify your records, so use the in-app controls while you still have access to the device whenever possible.

5. What Happens When Data Is Deleted

A successful in-app deletion removes the selected bank's records from our active database. The app updates its local cache after confirmation; other local copies and widget summaries update when they next successfully refresh. Offline devices can continue to hold an earlier copy until then.

Reconnecting a bank may import transactions again from Plaid. Deleting data from Cash Reveal does not delete your bank's records or independently erase data held by Plaid under its own policies. Uninstalling the app alone does not disconnect a bank or delete records on our servers.

Removing bank history does not reset app preferences or the device identifier used for future connections.

Hosting providers may retain recovery backups and operational logs according to the settings of those services. Removing records from the active database does not immediately erase all backup copies. We may also retain information when required by applicable law; any such retention is separate from history you choose to keep in the app.

Our current Supabase Free plan does not provide us with accessible daily database backups, and point-in-time recovery is disabled. This does not establish that Supabase holds no internal recovery copies. We have not confirmed an expiration period for those provider-held copies and do not promise one.

6. Deletion Timeline

In-app deletion is processed as part of the confirmed request. If the app cannot confirm completion, it displays an error; retry from Settings or contact support. For verified requests sent to support, our target is to complete the request within 30 days, subject to applicable legal deadlines.

This target concerns active systems and request handling, not a promise that every provider backup expires within 30 days. If more time is needed for a support request, we will explain the status and any applicable exception.

7. Analytics and Diagnostic Data

The app does not currently include a third-party product analytics or crash-reporting SDK. Hosting services can generate operational logs, and support messages contain information you choose to send us. These are separate from transaction history and are not erased by disconnecting one bank.

Our current Vercel Hobby plan provides a one-hour runtime-log viewing window, and we have no log drains configured. This viewing window does not describe all provider security records, build logs, or database backup retention.

Our Supabase plan has a one-day project-log retention setting. Log drains are not available on this plan. These settings do not establish an erasure deadline for every provider-held security or operational record.

If we introduce app-health or aggregate feature-usage analytics, we will describe the information collected and its retention in this policy before enabling it. Financial transaction details will not be included in those analytics.

8. Policy Changes

Cash Reveal may update this Policy from time to time.

Updated versions will be posted with a revised “Last Updated” date.

9. Contact

Questions regarding this Policy or requests for data deletion may be directed to: support@cashreveal.app