We collect information you provide directly to us and information collected automatically through your use of the Platform.
| Data Type | What We Collect | Why |
|---|---|---|
| Account data | Email address, password (hashed), name (if provided), OAuth profile data | Account creation and authentication |
| Subscription data | Plan type, billing status, Stripe customer ID | Managing your subscription |
| Usage data | Portfolio scenarios you save, risk profile preferences, planner settings | Providing the Service features |
| Technical data | IP address, browser type, device type, page views, session duration | Security, analytics, debugging |
| Payment data | Handled entirely by Stripe. We never see or store your full card details. | Payment processing |
We do not sell your personal data to third parties. We do not use your data for advertising or share it with data brokers.
Your data is stored securely using Supabase (PostgreSQL database with row-level security), hosted on AWS infrastructure. Authentication is handled by Supabase Auth. Payment data is processed and stored by Stripe — we never have access to your full card number.
We implement industry-standard security measures including encryption at rest and in transit (TLS), access controls, and regular security monitoring. However, no system is 100% secure, and we cannot guarantee absolute security.
We share your data only with:
We use cookies and similar technologies for authentication (session management) and basic analytics. See our Cookie Policy for full details. You can control cookie preferences through your browser settings.
Depending on your jurisdiction, you may have the following rights regarding your personal data:
To exercise any of these rights, contact us via our Contact page. We will respond within 30 days.
To delete your account: Log in → Dashboard → Account Settings → Delete Account, or email us directly.
We retain your account data for as long as your account is active or as needed to provide services. If you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law or legitimate business purposes (e.g., transaction records for tax compliance).
CashYield is not directed to persons under 18 years of age. We do not knowingly collect personal information from minors. If you believe we have collected information from a minor, please contact us immediately.
CashYield is operated from the United States. If you access the Platform from outside the US, your data may be transferred to and processed in the US, which may have different data protection laws than your country.
GDPR (EU/UK users): Our lawful basis for processing is performance of contract (providing the Service) and legitimate interests. You have the rights outlined in Section 6 above. Our data processor agreements with Supabase and Stripe comply with GDPR requirements.
We may update this Privacy Policy periodically. We will notify you of material changes by posting the updated policy on the Platform and, for significant changes, by email. Continued use of the Platform after changes constitutes acceptance.
Privacy questions or requests: Contact page. We aim to respond within 5 business days.