Privacy Policy.
We built Cashew to be a calm, private place to plan your life. We collect what we need to make the app work, and not a byte more. This page explains, in plain English, what we collect, why, and how to control it.
Short version: We don't sell your data. We don't run ads. Your trip and task content stays yours. AI requests run under no-training agreements with our providers. You can delete everything anytime, or email us for a copy of your data.
Contents
1. Who we are
Cashew is operated by Voyagr, Inc. ("Cashew", "we", "us"), a Delaware corporation with a registered office at [street address], Chicago, IL [ZIP], USA. For EU/UK users, our representative is Voyagr EU UG, Berlin, Germany.
This policy applies to the Cashew mobile app, the cashew.app website, and any related services we operate.
2. What we collect
We try to keep this list short.
2.1 Account information
When you sign up with email or Apple, we store your email address, a unique account ID, and the time you created your account. We never see your Apple password.
2.2 Plans, trips, tasks & routines
Everything you create in Cashew, including tasks, routines, events, trips, itineraries, packing lists, journals, attached photos, locations, budgets, and notes, is stored in your account. We use it to render the app and sync between your devices.
2.3 Usage data
To diagnose crashes and improve the product, we collect anonymous usage events: which screens loaded, button taps, error stack traces, app version, OS version, device model. This data is aggregated and never tied to your plan content.
2.4 Device permissions
Cashew may request access to the following, and you can revoke it at any time:
- Notifications, for the gentle reminders you opt into.
- Photos, only the photos you attach to a trip or journal.
- Location, only when you tap "use my location" on a trip or event.
- Contacts, only when you tap "invite from contacts" to share a trip.
2.5 Payment data
Subscriptions are processed by Apple via in-app purchase. We receive a receipt and subscription status. We never see your card number or full payment details.
3. How we use your information
We use the data above only to:
- Run the Cashew app, show your plans, and sync them across devices.
- Generate AI itineraries, packing lists, and journals when you tap "generate".
- Send transactional emails, such as welcome, password reset, and receipt messages. You can never be opted into marketing without explicit consent.
- Diagnose bugs, prevent abuse, and improve the product.
- Comply with legal obligations.
We do not sell your personal data, share it with advertisers, or use your plan content to train AI models. We have committed to that in writing.
4. AI & third-party processors
When you tap a button that says "AI" (the lightning sparkle), Cashew sends the inputs you provided, such as destination, dates, budget, prompts, and packing constraints, to one of our AI providers. We currently use Anthropic and OpenAI, under enterprise agreements that include:
- No training on Cashew customer inputs or outputs.
- No long-term retention beyond the 30-day abuse-prevention window required by the providers.
- Processing in US or EU regions matching your account region where available.
We don't send your full account, calendar, or unrelated trips to the AI. We only send the inputs needed for the request.
5. Who we share with
A short, exhaustive list of the processors we rely on:
- Supabase (US/EU), primary database & auth.
- Apple, subscriptions, push notifications, and sign-in.
- Anthropic & OpenAI, AI feature generation.
- Sentry, crash reporting.
- PostHog (EU), anonymous product analytics.
- Postmark, transactional email.
- Cloudflare, DNS & DDoS protection.
Each is bound by a written data processing agreement.
6. Cookies & analytics
The Cashew app uses no cookies. The cashew.app website uses two: a session cookie for sign-in, and an anonymous PostHog identifier. We do not use third-party advertising cookies, retargeting pixels, or social trackers.
7. Security
We take security seriously. In practice that means:
- TLS 1.3 in transit for every connection.
- AES-256 encryption at rest in our database.
- Row-level security on every table, scoped to your user ID.
- SOC 2 Type II audit (renewed annually). We'll send you the report on request.
- Bug bounty program. Report vulnerabilities to security@cashew.app.
No system is perfectly secure. If we ever experience a breach affecting your data, we will notify you within 72 hours.
8. Your rights
Whether you live in the EU, UK, California, or anywhere else, you have the right to:
- Access: request a copy of your data by emailing privacy@cashew.app.
- Correct: fix anything inaccurate.
- Delete: wipe your account (Settings → Account → Delete). Takes effect immediately; backups purged within 30 days.
- Port: ask us for a portable copy of your data.
- Object: opt out of analytics or any non-essential processing.
- Withdraw consent: at any time, without affecting prior processing.
If you're not satisfied with how we've handled a request, you can lodge a complaint with your local supervisory authority. For EU users that's your national DPA; for UK users, the ICO.
9. Children
Cashew is intended for users 13 and over (16 in the EU/UK without parental consent). We do not knowingly collect data from younger children. If you believe a child under that age has signed up, please email us and we'll delete the account.
10. Retention
We keep your data for as long as your account is active. When you delete your account, we hard-delete all personal data within 30 days, except where we're required to retain it for legal/tax reasons (e.g. invoices, kept for 7 years).
11. International transfers
If you're in the EU/UK and your data is processed in the US (e.g. by Anthropic or Apple), we rely on Standard Contractual Clauses and Data Privacy Framework certifications where available. You can request a copy of the relevant SCCs at any time.
12. Data processing addendum
Business customers (those using Cashew Premium through a workplace policy) can sign a DPA with us. Email privacy@cashew.app with "DPA" in the subject line.
13. Changes to this policy
We'll post material changes here and notify you in-app and by email at least 14 days before they take effect. Minor edits (typos, clarifications) may happen without notice. The "Last updated" date at the top will always reflect the most recent change.
14. Contact us
Email: privacy@cashew.app
Mail: Voyagr, Inc., [street address], Chicago, IL [ZIP], USA.
EU rep: Voyagr EU UG, Linienstraße 23, 10178 Berlin, Germany.
Have a question about how this applies to you? We read every email. privacy@cashew.app