CashTalk Privacy Policy

Last updated: 2026-09-21

Operator: Joshua Wayne Parrish, sole proprietor, doing business as CashTalk

This Privacy Policy explains what information CashTalk collects, how it is used, and the choices you have. CashTalk is a personal finance application that connects to your bank accounts through Plaid.

1. Information we collect

Information you provide directly

At signup, CashTalk collects:

Email address (required)
Password (required; stored only as a bcrypt hash — we never store your plaintext password)

We do not collect your name, phone number, address, or date of birth at signup. Later, you may optionally set a display persona, roast intensity preference, and subscription status (via Stripe).

Financial information via Plaid

When you connect a bank account, CashTalk uses Plaid to access your financial account information and stores the following in our database:

Your Plaid access token, encrypted (Fernet AES-128, keys rotated)
Transactions: amount, date, merchant name, category, and pending flag
Institution name (e.g. your bank's name) and your account list (last 4 digits and account type only)

CashTalk does NOT store:

Full account numbers
Routing numbers
Your bank login credentials — authentication with your bank happens directly between you and your bank through Plaid; we never see those credentials
Social Security numbers

Technical information

CashTalk collects no device type, IP address, or client-side fingerprints. There are zero third-party analytics, advertising, or session-recording SDKs in the app — this was verified by a full codebase search (no PostHog, Google Analytics, Segment, Mixpanel, Amplitude, Hotjar, FullStory, LogRocket, Sentry, or similar tools).

Server access logs are retained for approximately 7 days for security troubleshooting only. They are not linked to user profiles and are never used for analytics or advertising.

2. How we use your information

We use the information we collect to:

Display your account balances and transactions and provide budgeting/coaching insights
Operate, maintain, and improve the app
Communicate with you about your account and important updates
Detect, prevent, and address fraud, abuse, and security incidents
Comply with legal obligations

We do not sell your personal information.

3. How Plaid data is used and shared

Your financial data obtained through Plaid is used solely to provide CashTalk's features to you.
Plaid-derived data is not shared with any third party besides the service providers listed in Section 4, each of which receives only what it needs to perform its function.
Data is transmitted over encrypted connections (HTTPS/TLS).
Plaid-derived data is stored in CashTalk's MongoDB Atlas database. Plaid access tokens are stored encrypted (Fernet AES-128).

4. Data sharing

We share your information only as follows:

Service providers that help operate CashTalk, each receiving only the data needed for its function:
- Plaid (bank account connectivity)
- Stripe (subscription payments)
- MongoDB Atlas (database hosting)
- Resend (transactional email)
- Emergent (app hosting and infrastructure)
Legal requirements: if required by law, court order, or to protect the rights and safety of CashTalk and its users.
We do not share data with advertisers, data brokers, or analytics providers. We do not sell your personal information.

5. Data retention

Account data is kept for as long as your account is active.
The app includes an in-app "Delete My Data" button which permanently deletes your transaction data and connected account information.
Disconnecting a bank account stops future data collection via Plaid; previously stored data is deleted when you use Delete My Data or delete your account.

6. Data security

CashTalk protects your information with:

Encryption in transit (HTTPS/TLS) for all connections
Database encryption at rest (provided by MongoDB Atlas)
Encrypted storage of Plaid access tokens (Fernet AES-128, keys rotated)
Passwords stored only as bcrypt hashes
Multi-factor authentication required on all administrative and service accounts
API keys and secrets — including the Plaid API keys, which are stored in Emergent's secrets/environment-variable store — kept in secure secret storage and never in source code
Automated dependency vulnerability scanning (Dependabot) with defined patch timeframes

No method of transmission or storage is completely secure, but we apply industry-standard safeguards appropriate to a consumer fintech application.

7. Your rights and choices

Depending on where you live, you may have the right to:

Access a copy of the personal information we hold about you
Correct inaccurate information
Delete your account and associated personal data (including via the in-app "Delete My Data" button)
Disconnect bank accounts at any time, which stops future data collection via Plaid
Opt out of non-essential communications

To exercise any of these rights, contact cashtalkcash@gmail.com. We will respond within 30 days.

8. Children's privacy

CashTalk is not intended for children under 13, and we do not knowingly collect information from children under 13.

9. Changes to this policy

Material changes (new data collection, new integrations, ownership changes): we will notify you by email and with an in-app banner at least 30 days before the change takes effect.
Minor edits (grammar, clarifications): we will update the "Last updated" date above.

Continued use of CashTalk after changes take effect constitutes acceptance of the updated policy.

10. Contact

For privacy questions, requests, or complaints:

Email: cashtalkcash@gmail.com

All statements in this policy were verified against the CashTalk codebase and infrastructure on 2026-09-21.