The app’s own privacy policy
Privacy
This is the same text Cashvy shows under Menu → Privacy policy, read from the one file the app ships, so the two cannot differ.
Last updated 20 September 2026
Cashvy does not collect anything, because there is nowhere for it to go.
That is about the app. Signing up to test Cashvy before release is separate: you give us your name and your email address, we keep them until the beta ends, and beta.cashvy.app says what is held and how to have it deleted.
Who we are
Cashvy is made by Soul Archive Limited, a company registered in England and Wales, company number 16186654. Its registered office is 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. On this page, "we" and "us" mean that company.
What leaves your device
Nothing, unless you send it.
There is no analytics SDK, no crash reporter, no advertising identifier, and no telemetry of any kind in this app. There is no Cashvy account and no Cashvy server holding your ledger. We do not know that you installed it.
The only time data leaves your device is when you choose to send it: sharing an export, sharing a reminder, connecting a friend to a trip, or emailing us. Each of those is something you tap, and each one goes where you point it.
The last one is worth spelling out, because it leaves for somewhere that is not another phone. An email opens your own mail app, prefilled with the app's version number and your platform and nothing else — no device id, no person id, nothing from your ledger — and no message is sent unless you send it.
What is stored, and where
| What | Where |
|---|---|
| Trips, people, expenses, settlements | A SQLite database in the app's private storage |
| The full history of every change | The same database, as an append-only log |
| Photos you attach | Files in the app's private storage |
| Theme, currency, haptics, lock | The app's key-value store |
All of it is inside the app's own container. Other apps cannot read it.
None of it is in your device's system backup. The ledger, the photos you attach and the avatars are all deliberately excluded, so a new device starts empty. That is not an oversight: the key that decrypts the ledger never leaves the device it was made on, so a copy of the database in iCloud or on a computer could not be opened by anything, including Cashvy. Leaving it there would cost you storage and give you nothing back.
The only copy that exists outside the device is a Cashvy backup you make yourself, from Settings. It is one encrypted file, opened by eight words that are shown to you once and stored nowhere. Cashvy cannot open it for you.
Photos
A picture you attach — an avatar, a receipt, a payment screenshot — is copied into the app's storage and resized. The original stays in your photo library untouched. Cashvy asks for photo access at the moment you pick a picture, not at launch, and never reads your library on its own.
Connecting a friend
When someone joins a trip from a browser, their device and yours exchange encrypted messages. The introduction is made by a relay that never holds the key and therefore cannot read anything it passes on — it sees an anonymous session identifier and a stream of ciphertext, and it keeps nothing once you disconnect. You can run your own relay instead of ours.
Your ledger is never uploaded to it.
What we cannot do
Because there is no server and no account:
- We cannot recover your data if you lose your device.
- We cannot delete your data for you — it is not ours to delete. Removing the app removes it.
- We cannot tell you which devices have a copy of a trip you shared. Your device can, in the trip's member list.
Children
Cashvy has no account system, collects nothing, and shows no advertising, so there is nothing to collect from anyone of any age.
Questions
Cashvy's source code is under the MIT licence, and it is meant to be read: the point is that anything this page claims can be checked against the code itself, which is a stronger guarantee than a privacy policy.
If you would rather ask a person: hello@cashvy.app. If you have found a flaw in how any of this works, security@cashvy.app goes to a private mailbox rather than a public tracker.