Cashew privacy policy
This policy explains what Cashew collects, why we collect it, which providers process it, and how you can access or delete your data.
Short version: We don't sell your data. We don't run ads. Your trip and task content stays yours. AI requests run under no-training agreements with our providers. You can delete everything anytime, or email us for a copy of your data.
Contents
1. Who we are
Cashew is operated by Voyagr, Inc. ("Cashew", "we", "us"), a Delaware corporation based in Chicago, Illinois, USA.
This policy applies to the Cashew mobile app, the cashew.app website, and any related services we operate.
2. What we collect
We try to keep this list short.
2.1 Account information
When you sign up with email or Apple, we store your email address, a unique account ID, and the time you created your account. We never see your Apple password.
2.2 Early-access waitlist
When you join our early-access waitlist, we collect your first name, email address, preferred platform, what you want help planning, your consent choice, signup time, referral page, and campaign parameters when present. We use this information to manage the waitlist, understand product demand, and send the early-access or product emails you requested.
2.3 Plans, trips, tasks & routines
Everything you create in Cashew, including tasks, routines, events, trips, itineraries, packing lists, journals, attached photos, locations, budgets, and notes, is stored in your account. We use it to render the app and sync between your devices.
2.4 Usage data
To diagnose crashes and improve the product, we collect anonymous usage events: which screens loaded, button taps, error stack traces, app version, OS version, device model. This data is aggregated and never tied to your plan content.
2.5 Device permissions
Cashew may request access to the following, and you can revoke it at any time:
- Notifications, for the gentle reminders you opt into.
- Photos, only the photos you attach to a trip or journal.
- Location, only when you tap "use my location" on a trip or event.
- Contacts, only when you tap "invite from contacts" to share a trip.
2.6 Payment data
Subscriptions are processed by Apple via in-app purchase. We receive a receipt and subscription status. We never see your card number or full payment details.
3. How we use your information
We use the data above only to:
- Run the Cashew app, show your plans, and sync them across devices.
- Generate AI itineraries, packing lists, and journals when you tap "generate".
- Send transactional emails, such as welcome, password reset, and receipt messages. You can never be opted into marketing without explicit consent.
- Manage the early-access waitlist, prioritize platform development, and send waitlist updates you explicitly requested.
- Diagnose bugs, prevent abuse, and improve the product.
- Comply with legal obligations.
We do not sell your personal data, share it with advertisers, or use your plan content to train models owned by Cashew.
4. AI & third-party processors
When you tap a button that says "AI" (the lightning sparkle), Cashew sends the inputs you provided, such as destination, dates, budget, prompts, and packing constraints, to Google Gemini to generate the requested result. Google's handling of that data is governed by the terms and privacy notices applicable to its API services.
We don't send your full account, calendar, or unrelated trips to the AI. We only send the inputs needed for the request.
5. Who we share with
A short, exhaustive list of the processors we rely on:
- Supabase (US/EU), primary database & auth.
- Apple, subscriptions, push notifications, and sign-in.
- Google, Gemini AI feature generation and Places venue enrichment.
- Sentry, crash reporting.
- PostHog (EU), anonymous product analytics.
- Postmark, transactional email.
- Cloudflare, DNS & DDoS protection.
Each is bound by a written data processing agreement.
6. Cookies & analytics
The Cashew app uses no cookies. The cashew.app website uses two: a session cookie for sign-in, and an anonymous PostHog identifier. We do not use third-party advertising cookies, retargeting pixels, or social trackers.
7. Security
We take security seriously. In practice that means:
- TLS 1.3 in transit for every connection.
- AES-256 encryption at rest in our database.
- Row-level security on every table, scoped to your user ID.
- Bug bounty program. Report vulnerabilities to security@cashew.app.
No system is perfectly secure. If we ever experience a breach affecting your data, we will notify you within 72 hours.
8. Your rights
Whether you live in the EU, UK, California, or anywhere else, you have the right to:
- Access: request a copy of your data by emailing privacy@cashew.app.
- Correct: fix anything inaccurate.
- Delete: wipe your account (Settings → Account → Delete). Takes effect immediately; backups purged within 30 days.
- Port: ask us for a portable copy of your data.
- Object: opt out of analytics or any non-essential processing.
- Withdraw consent: at any time, without affecting prior processing.
If you're not satisfied with how we've handled a request, you can lodge a complaint with your local supervisory authority. For EU users that's your national DPA; for UK users, the ICO.
9. Children
Cashew is intended for users 13 and over (16 in the EU/UK without parental consent). We do not knowingly collect data from younger children. If you believe a child under that age has signed up, please email us and we'll delete the account.
10. Retention
We keep your data for as long as your account is active. When you delete your account, we hard-delete all personal data within 30 days, except where we're required to retain it for legal/tax reasons (e.g. invoices, kept for 7 years).
Waitlist information is kept until you join Cashew, withdraw consent, ask us to delete it, or the relevant early-access program ends. We remove waitlist records that are no longer needed within 90 days after the program ends.
11. International transfers
If you're in the EU/UK and your data is processed in the US (e.g. by Google or Apple), we rely on Standard Contractual Clauses and Data Privacy Framework certifications where available. You can request a copy of the relevant SCCs at any time.
12. Data processing addendum
Business customers (those using Cashew Premium through a workplace policy) can sign a DPA with us. Email privacy@cashew.app with "DPA" in the subject line.
13. Changes to this policy
We'll post material changes here and notify you in-app and by email at least 14 days before they take effect. Minor edits (typos, clarifications) may happen without notice. The "Last updated" date at the top will always reflect the most recent change.
14. Contact us
Email: privacy@cashew.app
EU rep: Voyagr EU UG, Linienstraße 23, 10178 Berlin, Germany.
Have a question about how this applies to you? We read every email. privacy@cashew.app