Your accounts, categories, transactions, balances, analytics, widget data and settings live on your iPhone or iPad. If you use the Apple Watch app, a summary of them is also kept on your watch.
Last updated: October 14, 2026
Cashful Privacy Policy
Cashful keeps your finance data on your device. If your iPhone or iPad is signed in to iCloud, Cashful also syncs your records through your own iCloud account (Apple CloudKit), and shared Spaces use the same service. When you use voice input or receipt scanning, the text or photo is sent to Cashful's server and passed to an AI model to fill in the expense. The Cashful Pro subscription is processed by Apple and managed through RevenueCat. This policy explains what stays on your devices, what is sent where and why, and what controls you have.
If your device is signed in to iCloud, your records are stored in Cashful's container in your private iCloud (Apple CloudKit) so they stay in sync across your devices. Shared Spaces use the same service. To stop syncing, turn off iCloud for Cashful in iOS Settings.
Shared notifications can show transaction details on the Lock Screen. Widgets can show balances, account names and spending by category on the Home Screen or Lock Screen, and the Apple Watch app and watch-face widgets show balances and recent spending on your wrist.
The subscription is bought and billed through your Apple ID. RevenueCat keeps track of whether Pro is active. No separate Cashful account is needed.
When you dictate an expense (in the app, with Siri or on Apple Watch) or scan a receipt, the text or photo, your app language and the names of your categories and accounts go to Cashful's server, which passes them through OpenRouter to an AI model (currently Google Gemini, with a backup model if it is unavailable). Our server doesn't store the text or the photo. Manual entry never uses AI. Cashful asks for your permission before the first voice entry or receipt scan, and you can withdraw it anytime with the “AI for voice and receipts” switch in the side menu.
Cashful has no separate account. iCloud is needed for sync and shared Spaces, and an Apple ID for Cashful Pro. You can delete your data, turn off iCloud for Cashful, disable notifications, stop sharing a Space, turn off usage statistics, export CSV (Pro) or cancel the subscription at any time.
1. Scope
Cashful is a personal finance app for iPhone and iPad, with a companion Apple Watch app. Everyday use works on your device. If your device is signed in to iCloud, or you join a shared Space, Apple's cloud services become part of how the app works. Voice input, receipt scanning and optional usage statistics use Cashful's own server. Cashful does not ask you to create an account; an Apple ID and iCloud are only needed for the Apple-powered features.
2. Data stored locally on your device
Cashful can store finance information locally on the device you use the app on. This may include:
- accounts, balances, categories, currencies, exchange rates, and reporting settings
- transactions, transfers, amounts, dates, notes, and related finance metadata
- analytics views, charts, filters, and summaries generated from your records
- widget snapshots and settings stored locally for Home Screen or Lock Screen widgets
- local app preferences and counters, such as notification and display choices, how many free voice entries and receipt scans you have used, and, only if you allow usage statistics, a random statistics ID and a short queue of statistics waiting to be sent
3. Data stored in Apple iCloud and CloudKit
If your device is signed in to iCloud, Cashful stores and syncs your records in its container in your private iCloud database (Apple CloudKit). Shared Spaces are stored the same way and shared through Apple's CloudKit sharing. This includes:
- Space name, reporting currency, and the language and region setting of the device that created the Space
- accounts, categories, subcategories (tags), exchange rates, and the links between these records
- transactions, transfers, amounts, dates, notes, and related finance entries
- CloudKit share metadata and Apple-provided CloudKit owner or participant identifiers needed for sync and sharing
This data lives in your own iCloud account and is protected by Apple. ANApps has no access to it, and it is used only to keep your devices in sync and to give invited people access to a shared Space. Sync starts on its own when your device is signed in to iCloud. To stop it, turn off iCloud for Cashful in iOS Settings → your name → iCloud; your records then stay only on your device.
5. Notifications and lock screen visibility
Cashful uses Apple's push service to learn that a shared Space has changed. These pushes carry no finance details; your device builds the notification itself. Shared-space notifications are optional, but if you enable them the text may show the amount, category or account, depending on your notification preview settings, so finance details can appear on the Lock Screen or in banners. Cashful can also show a monthly reminder to compare your spending; it is created on the device and contains no amounts.
6. Widgets, watch faces and App Group storage
Cashful widgets show the balance of the account you choose, on the Home Screen and Lock Screen of your iPhone or iPad and on Apple Watch faces. The Spending widget shows your expenses by category for the period and account you choose, from the same on-device data. Widgets are free. To show them, the app keeps a snapshot of balances, expenses by category, and account and category names in storage shared between the app and its widgets on the same device. Anyone who can see your screen or watch face may see this information.
If you turn on sharing with Pennypot (our own app, off by default), Cashful writes your expenses from the last three months (date, amount, currency, category, subcategory, note) to an App Group folder on your device that only our apps can read; Cashful sends nothing to us. Pennypot may keep its copy in your own iCloud. You can turn it off any time in Settings → Data in Cashful; the shared file is then deleted.
7. Apple Watch
If you install the Cashful app on Apple Watch, your iPhone sends it a summary of your data directly over Apple's encrypted connection between iPhone and watch (WatchConnectivity), not through Cashful's server. The watch keeps this copy so the app and its watch-face widgets can work:
- your total balance and this month's and today's spending
- the name, currency and balance of each account, and up to 20 recent transactions per account, including notes and subcategories (tags)
- your expense categories
- expenses you add on the watch, until your iPhone has saved them
Expenses you add on the watch go to your iPhone, which saves them like any other record. Voice entries on the watch are sent from the watch itself to Cashful's server, as described in section 10; voice input on the watch is free and does not count toward the free voice entries on iPhone. On watchOS 26, a Smart Stack card can suggest logging an expense when you are at a café, store or gas station. watchOS matches the place itself, and Cashful never receives your location. Deleting the Cashful app from the watch removes its copy.
8. CSV export and import
Cashful Pro includes a CSV backup export, an account report export (a ZIP file) and CSV import. You start each of these yourself. Exported files are saved to the place or app you choose, and what happens to them next depends on that destination. Importing a backup replaces the records in your own Space with the file's contents, and the result then syncs to iCloud like any other change.
Cashful Pro can also prepare a text file for ChatGPT or another AI app to analyze. It contains only your own Space, never Spaces other people share with you: all your accounts with their current balances and, for the period you choose, your transactions and transfers with dates, amounts, categories, subcategories and notes. The file is created on your device and goes only to the app you pick in the iOS share sheet, after the app shows a notice about sharing with third parties. Cashful does not send this data to any AI provider itself. Once you share it, the recipient processes the data under its own privacy policy, which Cashful does not control.
9. Cashful Pro subscription processing
Cashful Pro is offered as an auto-renewable subscription (Monthly $2.99 / Yearly $29.99, with a 7-day free trial on both plans). All purchasing, billing, renewal, and refund flows are handled by Apple through your Apple ID. ANApps does not see your payment card, Apple ID password, or full billing details.
Subscription state — meaning whether your Apple ID currently has the Cashful Pro entitlement — is managed via RevenueCat, an industry-standard subscription infrastructure provider. RevenueCat receives transaction events and entitlement information from Apple and exposes a stable subscription state to the App. The minimal data RevenueCat processes for this purpose can include:
- an anonymous, RevenueCat-generated user identifier created by the App
- App Store transaction information forwarded by Apple (product ID, purchase date, expiration, trial status, renewal status, refund status)
- technical data the RevenueCat SDK sends with its requests, such as your IP address, iOS and app version, language and App Store country, and a device identifier used to prevent fraud
- the Apple Ads attribution token (AdServices), which shows which Apple Ads campaign led to the download; it contains no personal identifier
RevenueCat does not receive your name, email, Apple ID, payment details, or any of your finance records. RevenueCat acts as a processor for ANApps and operates under its own privacy policy, available at revenuecat.com/privacy. We use RevenueCat to provide the subscription you purchased (Art. 6(1)(b) GDPR).
Your subscription renews automatically unless canceled at least 24 hours before the end of the current period. You can manage or cancel your subscription anytime in Settings → your name → Subscriptions → Cashful Pro on iPhone or iPad. Refund requests are submitted to Apple at reportaproblem.apple.com. Full subscription terms are in the Terms of Use.
10. AI recognition of voice input and receipts
Cashful offers optional AI features that turn what you say or a receipt photo into an expense: voice input on iPhone and iPad, the Siri “Quick expense” command, voice input on Apple Watch, and receipt scanning. The free plan includes 10 voice entries (in the app and with Siri combined) and 5 receipt scans, and Cashful Pro makes them unlimited. Voice input on Apple Watch is free for everyone. These features run only when you start them. Manual entry never uses AI.
Voice input. Apple turns your speech into text: iOS speech recognition in the app, Siri for the “Quick expense” command, or dictation on Apple Watch. Depending on your device and language, this happens on the device or on Apple's servers, under Apple's privacy policy. Cashful never receives the audio. The app (or, on Apple Watch, the watch itself) then sends the following to Cashful's own server (cashful.anapps.store):
- the recognized text of what you said
- the app language
- the names of the expense categories and accounts in the Space you are adding to (and, from iPhone or iPad, the subcategories), so the text can be matched to them
Receipt scanning. The app shrinks the photo you take or pick (to at most 2400 pixels on the long side), saves it as a JPEG and sends it to Cashful's server, together with the app language and the names of your expense categories and accounts.
Processing. Our server (in the EU, in Amsterdam) passes the request through OpenRouter (openrouter.ai) to an AI model and returns the amount, category, account and note, plus the date for receipts. In the app and on Apple Watch you review the result before saving. The Siri “Quick expense” command saves the expense right away and tells you what was added, so you can edit or delete it later in the app. Voice input currently uses Google Gemini 2.5 Flash Lite, with Meta's open Llama 3.1 8B model as a backup, run by a hosting provider that OpenRouter selects; receipt scanning uses Google Gemini 2.5 Flash Lite, with Gemini 2.5 Flash as a backup. OpenRouter and these providers may process the data in the United States or other countries. Cashful's server does not store the text or the photo and does not write them to its logs. Nothing else from your records is sent: no balances, saved amounts or transaction history, and no contact details or Apple ID.
To protect the service from abuse, each request is signed by the app and includes your device's vendor identifier (an ID Apple provides for our apps on that iPhone, iPad or Apple Watch). Our server keeps this ID only in memory, for about a minute, to limit how many requests one device can send. Like any website, our server also sees your IP address. Our web server records it in standard access logs, which are kept only as long as needed to keep the service running and secure.
OpenRouter and the model providers it routes requests to process the data under their own terms and privacy policies and may keep it for a limited time, for example to monitor abuse: see openrouter.ai/privacy and, for Google Gemini, ai.google.dev/gemini-api/terms and policies.google.com/privacy. For the backup Llama model, the hosting provider selected by OpenRouter applies its own policy. We process this data to provide the feature you asked for (Art. 6(1)(b) GDPR). If you do not want to use these features, use manual entry: it sends nothing for recognition.
11. Anonymous usage statistics (optional) and no tracking
Cashful uses no advertising networks, no cross-app tracking and no third-party analytics tools. The only other service that sees how the app is used is RevenueCat, for subscription status and reports (see section 9). If you allow it, the app sends anonymous usage statistics to our own server so we can see which features are used and what to improve:
- Off until you allow it. The app asks during setup. If you allow it, statistics from the current session are included; if you don't, they are discarded and nothing is sent. You can change your choice at any time in the app under Info → Anonymous usage stats.
- What is sent: which screens and features are used and when (for example, that a record was added by voice, on Apple Watch or with Siri, or that a receipt scan succeeded), setup steps completed, when the upgrade screen is shown, which plan you choose, whether a purchase succeeded and when you restore purchases (never prices or payment details), which kind of export you start, actions on shared Spaces, session length, simple counts (number of accounts, categories and records), whether Pro is active, app and iOS version, device model, app language, and the region set on the device.
- What is never sent: amounts, notes, names of accounts, categories or Spaces, the content of your records, your name, email, Apple ID, contacts or advertising identifier. IP addresses are not stored with the statistics. Our web server's standard access logs are described in section 10.
- Identifier: a random ID the app creates only for statistics. It is not linked to your identity, your iCloud account or other Cashful requests, and it is replaced when you turn statistics off.
- Storage and deletion: statistics are kept on our own server in the EU (Amsterdam, Netherlands) for up to 13 months and then deleted automatically. When you turn statistics off, the app asks our server to delete everything sent from your device; if your device is offline at that moment, the data is removed at the end of the 13 months instead. Deleting the app does not send this request.
The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the same switch; the app works exactly the same either way.
12. Device permissions
Cashful asks for access only when you use a feature that needs it: the microphone and speech recognition for voice input, the camera or photo library for receipt scanning, and notifications for shared-space updates and reminders. You can change any of these at any time in iOS Settings → Cashful; the rest of the app keeps working.
13. Your rights, children and changes
ANApps, the publisher of Cashful, is responsible for the data described in this policy. You can ask us to access or delete data we hold about you, object to its processing, or withdraw your consent by writing to anapps.team@gmail.com. Because Cashful has no accounts, we may ask for details from your device, such as roughly when you used a feature, to find it. You can also complain to your local data protection authority.
Some of the providers named in this policy (OpenRouter, Google, RevenueCat) are based outside the EU, so data sent to them may be processed in the United States or other countries under the safeguards described in their own policies. Cashful is not directed at children. If we change this policy, we update the date at the top of this page.
14. Contact
For privacy questions, support, or requests about how the app works, contact anapps.team@gmail.com.
15. Your privacy choices
You can control the privacy-sensitive parts of Cashful in several ways:
- disable notifications through iOS settings if you do not want finance previews to appear on screen
- stop using shared Spaces or disconnect shared relationships if you no longer want data visible to other participants
- delete your records with Settings → Delete All Data in the app (this clears your own Space on that device); to also remove the copy in iCloud, open iOS Settings → your name → iCloud → Manage Account Storage → Cashful and delete its data
- export your records first (Cashful Pro) if you want a separate copy
- skip voice input and receipt scanning if you don't want text or photos sent for AI recognition (manual entry sends nothing)
- review the dedicated Privacy Choices page for the public control summary
- turn anonymous usage statistics on or off in the app under Info → Anonymous usage stats; turning them off asks our server to delete the statistics already sent
- turn off iCloud for Cashful in iOS Settings → your name → iCloud if you want your records to stay only on the device
- turn off microphone, speech recognition, camera or photo access in iOS Settings → Cashful
- delete the Cashful app from your Apple Watch to remove the copy kept on the watch