CashoutPrivacy Policy
Cashout exists to track your income for you, not to monetize it. We don't sell your data, we don't show ads, and we collect the minimum needed to run the app.
Without an account
Cashout works fully without an account. Your shifts, tips, jobs, expenses, mileage, pay stubs, bills, and tax setup are stored only on your phone. Receipt scanning reads the receipt on your phone; the photo and its text are not uploaded.
If you create an account
Your account is an email address, a password hash, and an optional display name. We email you codes to verify your address and reset your password. While you're signed in, your records sync to our server so your devices stay in step: jobs, shifts, tips, wages, hours, expenses (including the text read from a receipt, not the photo), mileage, pay stubs, bills, your tax setup, tax savings, income goal, and pay period. Everything travels over HTTPS. To get notifications, the app also sends a push token from Google's Firebase Cloud Messaging.
The Break Room
Break Room posts, employer reviews, and wage reports are stored under your anonymous handle, not your name or email. Wage reports are checked against the shifts you synced. Direct messages are end-to-end encrypted: the app makes an encryption key for your handle when you set it up, and we store ciphertext we cannot read. If the person you're writing to has no key on file yet, for example because their app couldn't upload one, that message is sent without end-to-end encryption. It is still protected by HTTPS on the way, but it is stored on our server in readable form.
AI Coach
When you ask the Coach a question, your question and a summary of your earnings (totals for the week, month, and year, your averages, tax setup, savings, and income goal) go to our server and on to Anthropic, which runs the AI model that writes the answer. Anthropic processes this for us under its commercial API terms, which do not allow it to train its models on this data. Your conversations are stored on our server so you can come back to them. You can delete any conversation in the Coach, and all of them are deleted with your account.
Crash reports and diagnostics
The Android app sends crash reports to Firebase Crashlytics, a Google service, so we can find and fix crashes. A report contains the stack trace, your device model, Android version, app version, and a random installation ID generated by Firebase. It does not include your shifts, tips, earnings, or account email. Crash reports are on by default, and you can turn them off any time in Settings > Crash reports. The iOS app does not use Crashlytics.
Receipt scanning on Android uses Google's ML Kit on your phone. ML Kit sends Google basic diagnostics (a random installation ID, the app's name and version, how long a scan took, and error codes) but never the receipt image or its text.
What we don't do
No selling or renting personal data. No advertising or ad tracking SDKs. No reporting of anything to employers or tax authorities. The Android app does not use your location. On iPhone, if you turn on auto shift detection, your location is processed on your phone to notice when you leave your workplace; your movement history is not uploaded.
Who processes data for us
Google (Firebase Crashlytics, Firebase Cloud Messaging, ML Kit) and Anthropic (AI Coach) process data on our behalf only to provide those features. Nobody else receives your data from us.
Deleting your data
Delete your account in the app under Settings > Account > Delete Account, or on the web at cashout.tips/delete-account. This permanently removes your account and everything synced to it from our servers: your records, your Break Room handle with its posts, reviews, wage reports, and messages, and your Coach conversations. Data on your phone stays until you uninstall the app or clear its data. Crash reports already sent to Crashlytics expire on their own within 90 days.
Contact
Privacy questions: support@cashout.tips.