Privacy Policy

By using Cashy, you agree to this Privacy Policy. If you do not agree, do not use the app.

2.1 Account and profile information

When you create an account, we may collect:

• Email address
• Username
• Phone number
• Legal name and date of birth (during onboarding)
• Residential address (during onboarding or when enabling custody features)
• Profile information you choose to add (bio, avatar, creator settings)
• Sign-in method (Google or Apple)

2.2 Identity verification (KYC)

To access regulated custody and fiat features, you must complete identity verification through Didit, our third-party KYC provider. Through Didit and our systems, we may collect and process:

• Government-issued identification documents
• Selfie / liveness checks and face matching
• Proof of address
• Phone verification
• AML (anti–money laundering) screening results
• IP and device risk signals
• NFC verification (where supported)
• A short verification video you record in the app (camera and microphone)
• KYC results are stored on our secure backend. You cannot edit KYC or Bridge-related fields directly in the app.

2.3 Custodial account and fiat services (Bridge)

If you use Cashy custody features, we collect and process information needed to operate fiat deposit and withdrawal services through Bridge, including:

• Bridge customer ID and account status
• Virtual account details (e.g. USD, EUR, GBP, BRL, MXN, COP — depending on eligibility)
• Deposit and withdrawal transaction history
• External payment account details you provide (e.g. bank account numbers, IBAN, routing numbers, PIX keys, beneficiary name)
• Bridge Terms of Service acceptance status
• Approved KYC data (name, date of birth, address, etc.) is shared with Bridge to create and maintain your custodial account.

2.4 Self-custody wallet information

For non-custodial wallet features:

• Your seed phrase and private keys are generated and stored on your device. We do not receive or store your seed phrase or private keys on our servers.
• We may store wallet-related preferences and account metadata tied to your Cashy account.
• To display balances, transaction history, fees, and to broadcast transactions, the app sends public wallet addresses and transaction identifiers to third-party blockchain data providers.
• Note: Activity on public blockchains is inherently public and permanent.

2.5 Swap and on-ramp activity

When you swap tokens or buy crypto:

• Token pairs, amounts, chains, and wallet addresses may be shared with swap partners (Jupiter, LiFi, 0x, SwapKit, Squid, and similar) to obtain quotes and execute transactions.
• If you use Stripe Crypto Onramp, payment and identity information is processed by Stripe under Stripe's own privacy policy.
• We may log swap intents and transaction metadata on our servers for operations, fraud prevention, and fee processing.

2.6 Encrypted messaging

For private messaging:

• We store your public encryption key, optional messaging username, profile description, and avatar.
• We store encrypted message ciphertext and basic metadata (timestamps, sender/recipient IDs, thread IDs).
• Message content is encrypted end-to-end using keys derived on your device from your wallet seed phrase. Cashy cannot read the contents of your encrypted messages.

2.7 Social and creator content

If you use social or creator features, we may collect and store:

• Posts, stories, and videos you upload
• Follower, subscriber, and following relationships
• Audience and monetization settings
• Media may be stored in Cloudflare R2 and/or Firebase Storage.

2.8 Device and app data

We may collect:

• Device type, OS version, app version
• App lock PIN (stored locally in secure device storage — not on our servers)
• Biometric authentication usage (Face ID / fingerprint — processed by your device)
• Crash reports and error logs (via Sentry)
• API usage and rate-limit data for fraud prevention
• Push notification tokens (for account alerts and messaging)

2.9 Information from third parties

We receive information from:

• Google and Apple when you sign in
• Didit when KYC completes or updates
• Bridge for custody account status and transaction updates
• Blockchain and swap partners for on-chain data

You may use one or both. They are separate products within the same app.

Identity and compliance

• Didit — identity verification
• Bridge — custodial accounts, fiat rails, virtual accounts, withdrawals

Payments and on-ramps

• Stripe — crypto on-ramp payments

Blockchain and swaps

• Moralis, Chainstack, and public blockchain APIs (Etherscan, mempool.space, blockchain.info, Blockscout, Routescan, etc.) — balances, history, broadcast
• Jupiter, LiFi, 0x, SwapKit, Squid — swap quotes and execution

Infrastructure

• Google Firebase — authentication, database, cloud functions, file storage, push notifications
• Cloudflare R2 — media and avatar storage
• Sentry — crash and error reporting
• OneSignal / MailerSend — operational and alert communications

Sign-in providers

• Google, Apple

Referral partners (user-initiated only)

• Meanwhile.bm — if you tap the Bitcoin life insurance referral link, you leave Cashy and Meanwhile's privacy policy applies

We may also disclose information:

• To comply with law, regulation, subpoena, or legal process
• To protect the rights, safety, and security of Cashy, our users, or the public
• In connection with a merger, acquisition, or sale of assets (with notice where required)

You can manage permissions in your device settings. Some features will not work without required permissions.

Swap partners (Jupiter, LiFi, 0x, etc.) have their own policies governing on-chain transaction data.