App Privacy Policy

Last updated August 20, 2026 · covers the Cashout mobile app. The trycashout.com website is a different system with its own policy.

The short version

• Your streak, your money figures, your check-ins and your slips live on your phone. The app is built to work in airplane mode, so the phone — not our server — is the original copy.
• If you have an account, that data also syncs to our server so a lost phone doesn't cost you your streak. If you never sign in, it never leaves the device.
• Analytics records 44 specific events, all listed below. Money amounts are always sent as a range, never the exact figure.
• Nothing you type is ever sent to analytics. Not your name, not a note, not a post. There is no field for it to travel in.
• No session recording and no autocapture. We do not record your screen and we do not log taps.
• The crisis helpline and self-exclusion tools need no account, no subscription and no internet. Tapping a helpline number dials it from your phone and tells us nothing.
• Delete your account from inside the app and it is gone — server rows included, in one step, with no retention offer.

Who is responsible for your data

The data controller is Bastien Youssfi, trading as YOUSSFI BASTIEN (entrepreneur individuel), registered in France:

• SIREN 942 550 989 · SIRET 942 550 989 00019
• APE 62.01Z — Programmation informatique
• 18 Mail Renaissance, 95120 Ermont, France
• [email protected]

Cashout is a one-person project. The person who reads that inbox is the same person who wrote the code this page describes.

What stays on your phone

The app keeps its state in a key-value store inside its own private sandbox on the device, and that copy is the one the app actually reads. We don't add a second layer of encryption on top; it is protected by iOS's own file protection and the device passcode, the same as the rest of the app's storage. Every screen in the core loop — the streak, the money counter, the panic button, the check-in, the lessons — works with the network switched off, because none of them wait on a server.

Two things in particular never leave your device, on any plan, signed in or not:

• Check-in notes. The app has a field for them in its own storage and the sync code sends it as empty, every time.
• Anything you type, in analytics. See the event list below — no event has a field that can carry free text.

Using Cashout without an account

You can install the app and use it without signing in. In that state there is no account, nothing syncs, and the only thing that leaves the phone is the analytics listed below, attached to a random identifier the analytics SDK generates rather than to you.

The free crisis tools go further. The helplines and the self-exclusion directory are shipped inside the app as a plain data file, so they open with no network at all. The app picks which country's helpline to show from your device's time zone — that time zone is read on your phone and is not sent anywhere to make the choice. Tapping the number hands it to the phone dialler; the call is between you and the helpline, and there is no analytics event on that tap.

What syncs to our server

When you have an account, the app pushes the following to our Supabase database. This is a mirror of your local data, not a second collection — if you can see it in the app, it's here; if you can't, it isn't.

Unlike analytics, the server copy holds your exact figures — it has to, because it is the backup of the numbers the app shows you. It is protected by row-level rules in the database itself: a signed-in client can read and write its own rows and is refused at the database on anyone else's, whatever the app asks for.

The server also generates an anonymous handle like QuietHarbor_402 when your account is created. That handle is the only identity other people ever see, and it is generated server-side precisely so it can't be set to your real name.

Analytics: the complete list

We use PostHog's EU service to understand which parts of the app help. After you sign in, these events are tied to your account id — so this is identified analytics, and saying otherwise would be untrue. What keeps that honest is how narrow the events are.

The rules the code enforces, not just the intent:

• An allowlist, not a filter. Every event and every one of its properties is declared in a single file, and the app will not compile if a call site tries to attach a property that event didn't declare. A note or a post body has no field to travel in, so no future edit can start sending one by accident.
• Money is banded, never exact. Amounts are sent as one of four ranges. $1,250/month is close to identifying in a small group; 500_2000 is not.
• Some non-money numbers are exact, and you should know which: your mood 1–5, your quiz score, day counts, streak lengths and how long a screen or a panic session lasted. They're in the table below, spelled out.
• No session replay and no autocapture. Watching someone use a gambling recovery app is not a trade we make for debugging convenience. Neither feature is switched on.
• No crash or error autocapture. The SDK can ship exception messages and console logs; that option is off.

Getting started

Subscription

The core loop

The 90-day program

Community

Shield

Lifecycle

What's attached to your account profile

Alongside those events, five summary properties are stored against your analytics profile at sign-in: your dependence band, your monthly loss band, what you bet on, your goals, and where you said it mostly happens — all as fixed option codes from the quiz. No name, no email, no exact figure.

What the analytics SDK adds on its own

Every analytics tool attaches technical context, and pretending otherwise would make the rest of this page worth less. PostHog's SDK adds: your app version and build, device manufacturer, model and type, OS name and version, screen size, locale, time zone, whether it's a simulator, and a random device identifier it generates on first launch. It also records app-lifecycle events — installed, updated, opened, backgrounded.

Any request to any server necessarily arrives carrying an IP address. Ours is configured to throw it away: IP anonymisation is switched on at the PostHog project level, so the address is not stored on the event and no location is derived from it. The same project settings enforce the three rules above — autocapture, session replay and heatmaps are disabled on the server as well as in the app, so a change to the app alone could not turn them on.

Subscriptions and payment

Purchases run through Apple's In-App Purchase system and are managed by RevenueCat. We never see your card, and never receive it. Apple takes the payment; RevenueCat tells our server whether your subscription is active.

RevenueCat creates its own anonymous id for your device, and when you sign in the app tells it to link that id to your account id — so a purchase you made before signing in still follows you afterwards. We send it nothing else: no name, no email, no quiz answers. Our server keeps a mirror row with your subscription status, product and renewal date, which the app can only read, never write.

Cancelling is done in your Apple ID subscription settings and takes effect without asking us. We do not put a retention flow in front of it.

The community feed

Posts and comments are user-generated content that other people can read. Treat anything you post as public to everyone in the app. They are shown under your generated handle, never your name, but the text itself is exactly as you wrote it — if you put an identifying detail in a post, it is visible.

Post and comment text is stored on our server and is never sent to analytics — the events above record that a post was created and its type, and nothing more. You can delete your own posts, and deleting your account removes them.

Reports and blocks are stored too: a report keeps who reported what, and a block keeps who blocked whom. Both are readable only by you and by moderation.

Moderation

Every post and comment is checked by a rule-based filter on our server — pattern matching for contact details, lending, tipster promotion and abuse. That runs on our own infrastructure.

The app can additionally be configured to send the text of a post to OpenAI's moderation endpoint for a second opinion. When that is enabled, the post's text is sent and nothing else — no account id, no handle, no device information. If we have not enabled it, the rule-based filter runs alone. This page will say so either way; as of the date at the top, treat it as enabled.

One rule is not negotiable, and it is written into the moderation code: crisis language is never hidden. Someone posting that they want to die is the person this app exists for. That post surfaces a helpline and stays standing where other people can answer it.

Notifications

Reminders, milestone nudges and trigger-window check-ins are scheduled on your device by the app itself. They are not sent from a server, which means no server needs to know your schedule, your streak or your quiet hours to deliver them. The app does not currently register a push token, so there is no way for us to push you anything.

Turning notifications down in iOS Settings is enough; nothing about it needs to reach us.

Signing in with Apple or Google

Both are optional — the app creates an anonymous account for you at first launch and you can stay on it. If you do sign in, the provider returns an email address, which is stored by Supabase against your account and used for nothing except recognising you on your next device.

Apple's Hide My Email works normally here: we receive the relay address and never learn your real one. We do not send marketing email to app accounts at all.

Who else touches the data

Each of these processes data on our behalf under a data processing agreement, and none may use it for their own purposes.

Supabase, RevenueCat and OpenAI are US companies, so data may be processed outside the European Economic Area. Those transfers rely on the European Commission's Standard Contractual Clauses. PostHog is used on its EU Cloud.

Deleting your data

Delete account in the You tab does the whole thing in one step: it clears the synced rows, deletes the account itself — which cascades to every remaining row, including your posts and comments — breaks the link between your device and the analytics profile, and wipes the local copy on your phone. There is no confirmation funnel and no "are you sure you don't want 50% off".

Reset all data is the softer option: it clears your local data and the server copy but keeps the account.

Uninstalling the app removes the local copy with it. If you had an account, the server copy survives an uninstall — use Delete account first if you want it gone.

For a copy of your data, use Export my data in the You tab. It writes everything above to a JSON file and hands it to the iOS share sheet, so the file goes wherever you send it and nowhere else — we never receive a copy. It works offline from the data on your phone; run it with a connection and it includes your community posts and subscription details too, and the file says which version you got.

If you'd rather we did it, email [email protected] and we'll send it within 30 days.

How long we keep things

• Your account data: until you delete it. We don't expire an account for going quiet — someone coming back after eight months should find their history where they left it.
• Anonymous accounts that never finished onboarding: swept after 30 days of no use.
• Analytics events: kept per PostHog's retention on our plan. Deleting your account unlinks future events from you; ask us and we'll delete the historic ones too.
• Community posts: until you delete them or your account.

Why we're allowed to hold it

• Contract, Art. 6(1)(b) GDPR — your account, the sync, the subscription. Without them there is no app to provide.
• Legitimate interests, Art. 6(1)(f) — product analytics and moderation. The interest is making a recovery app that works and keeping predators out of a room full of people with money problems; the bands and the allowlist are what keep it proportionate.
• Consent, Art. 6(1)(a) — notifications, and anything you choose to post. Withdraw either at any time.

Quiz answers about gambling are sensitive in substance even where they are not special-category data in law, and we treat them that way: they sync to your own row, they are readable only by you, and only their bands ever reach analytics.

Your rights

You can ask us to show you the data we hold, correct it, delete it, hand it over in a portable form, restrict what we do with it, or object to the analytics. Email [email protected] and we'll act within 30 days. Deletion you can do yourself, immediately, in the app.

If you think we've handled your data badly, complain to the French data protection authority, the CNIL, or to the supervisory authority where you live.

Age

Cashout is rated 17+ and is not intended for anyone under 18. Gambling is age-restricted everywhere we operate. We don't knowingly collect data from minors — tell us and the account is gone that day.

What the app never does

• No advertising SDKs, no attribution SDKs, no retargeting pixels.
• No selling or sharing of personal data, at any price, to anyone.
• Nothing is ever shared with a gambling operator or affiliate. This is the point of the product.
• No session replay, no screenshots, no keystroke logging.
• No contacts, no photos, no microphone, no precise location.
• No credit checks, no bank connections, no open banking.
• No emails to your account address that you didn't ask for.

Changes

When this policy changes, the date at the top changes with it. Anything that widens what we collect gets a notice in the app before it takes effect, not a quiet edit.

Contact

[email protected] — questions, data requests, or anything on this page that reads as untrue. The last one gets answered first.