Privacy Policy

1. Who we are

Cashback Counter is published by Ascidean LLC, 2585 S Broadway St, Truth or Consequences, NM 87901, US. In this policy "we" and "us" mean Ascidean LLC. You can reach us at raytracingon@icloud.com.

2. Data that stays on your device

You can use the app without an account. The data you enter is stored in a local database on your iPhone: transactions, income records, credit cards and their reward rules, points balances, receipt photos you attach, and your settings. That includes transactions imported through Bank Sync once they arrive. You control this data. Deleting the app removes it from the device.

3. iCloud sync

iCloud sync is on by default. While it is on, your app data is stored in a private CloudKit database inside your own Apple Account and synced across your devices. We cannot access that database or read its contents. Apple's handling of it is covered by the Apple Privacy Policy. You can turn iCloud sync off at any time in the app's Settings. After that, your data stays only on the device.

4. Bank Sync (optional subscription)

Bank Sync automatically imports transactions from your US bank and credit card accounts. It is the only part of the app that involves our server, and nothing is sent to us until you sign in and connect a bank.

4.1 Sign in with Apple

Bank Sync requires Sign in with Apple, and nothing else in the app does. When you sign in, we receive and store:

• the stable user identifier Apple assigns to you for our apps, which is how we tell your bank connections apart from other people's;
• your email address and name, only if you choose to share them the first time you sign in. The email can be an Apple private relay address;
• an Apple-issued token, stored encrypted and used only to revoke our access to your Apple Account when you delete your account.

4.2 Connecting a bank through Plaid

We use Plaid Inc. to connect to your bank. You enter your bank username and password in Plaid's interface, not ours, and we never see or store your bank login credentials. Plaid's handling of your data is described in the Plaid End User Privacy Policy.

For each bank you connect, our server stores:

• the access token Plaid issues for that connection, encrypted with AES-256-GCM;
• Plaid's identifier for the connection, and the bank's identifier and name;
• when you connected it and when Plaid last sent an update about it.

4.3 Accounts and transactions

When the app syncs, our server uses that access token to request your data from Plaid and passes it straight to your iPhone. This includes account details (name, type, the last few digits of the account number, balances and credit limit) and transaction details (date, amount, currency, merchant, description and category). Plaid never provides full card or account numbers. Our server does not save your account details or transactions. They are held only for as long as it takes to deliver them to your device, where they are stored as described in sections 2 and 3.

4.4 Notifications about new transactions

If you use Bank Sync and allow notifications, the app sends its Apple push notification token to our server so we can tell you when a bank has new transactions. The notification shows the bank's name and a short message. It does not include amounts or merchants.

4.5 Subscription status

Payments are handled entirely by Apple. We never receive your payment card or billing details. To know whether Bank Sync should keep running, our server receives the Apple-signed record of your subscription and Apple's App Store Server Notifications. From these we store the product you subscribed to, the expiry date, Apple's identifier for the subscription, whether it was refunded or revoked, and when that was last updated.

4.6 How we use this data

We use the data above only to provide Bank Sync. That means signing you in, fetching your bank data, sending the notifications you asked for, checking your subscription, and disconnecting banks you no longer pay for. We also use it to answer support requests you send us. We do not sell it, use it for advertising, or build profiles from it.

4.7 Where it is stored and how it is protected

Our server and database run on Microsoft Azure. All traffic between the app, our server and Plaid is encrypted in transit. Plaid access tokens and Apple tokens are encrypted at rest, and the encryption key is kept separately in Azure Key Vault. Like any web service, our hosting records standard request logs, such as IP address and request time, which we use for security and troubleshooting.

4.8 Keeping and deleting your data

• Unlink a bank in the app at any time. We ask Plaid to revoke that connection and delete its access token from our database.
• Delete your account from the Account screen in the app. We disconnect every linked bank at Plaid, revoke Sign in with Apple, and delete your user record, subscription status and notification tokens from our server.
• If your subscription ends and is not renewed within 30 days, we automatically disconnect your banks at Plaid and delete their access tokens.

Transactions already imported to your iPhone stay there until you delete them. Deleting our copy of your data does not delete data Plaid holds under its own policy. You can manage that through the Plaid Portal.

5. AI features

On-device model. By default, receipts and statements are parsed on your iPhone using Apple's Foundation Models framework. Content processed this way never leaves your device.

Cloud AI parsing (optional, off by default). If you turn it on, parsing requests are sent to Apple's Private Cloud Compute. Private Cloud Compute is designed so that neither Apple nor Ascidean LLC can read the request, and Apple does not retain it.

Your own AI provider (optional, off by default). You can configure an AI service of your choice (for example OpenAI, Anthropic, Google Gemini, or any compatible endpoint) using your own API key. When you do, the receipt images, text and statement content you ask the app to parse are sent directly from your iPhone to the address you entered. They do not pass through our server. That provider's own terms and privacy policy govern what happens to them. Your API key is stored in the iOS Keychain on your device, and we never receive it.

6. Other network requests

Apart from the features above, the app contacts the network only to:

• fetch public currency exchange rates, so foreign spending can be converted;
• fetch the shared credit-card template list published in our public GitHub repository;
• download card artwork images referenced by those templates.

These requests do not include your transactions, balances or any personal information. The services hosting those files may keep standard server logs, such as your IP address, as any web server does.

7. Reminders

Reminders such as payment-due and points-expiry warnings are scheduled on your device. Allowing or denying notifications does not affect any other feature.

8. Service providers, advertising and tracking

We rely on these third parties, each only for the purpose described above:

• Apple: iCloud sync, Sign in with Apple, App Store payments, push notifications, and Private Cloud Compute;
• Plaid: bank connections for Bank Sync;
• Microsoft Azure: hosting for our Bank Sync server;
• an AI provider you choose, if you configure one yourself.

Cashback Counter has no advertising, no analytics SDKs, no crash-reporting services and no social-media trackers. We do not track you across other companies' apps or websites. We do not sell your personal information or share it for advertising.

9. Children

The app is not directed at children under 13, and we do not knowingly collect personal information from children. If you believe a child has signed in to Bank Sync, contact us and we will delete the account.

10. Your rights

Depending on where you live, you may have the right to access, correct, export or delete the personal information we hold about you, or to object to how we use it. We honor these requests for everyone, wherever they live. Data on your device can be exported to CSV or deleted in the app. Data on our server can be deleted by deleting your account in the app. For anything else, email raytracingon@icloud.com.

11. Verifying these claims

The app's source code is public, so you can check how it handles your data yourself at https://github.com/RayTracingON/CashbackCounter.

12. Terms of Use

Your use of Cashback Counter, including the Bank Sync subscription, is governed by Apple's Licensed Application End User License Agreement.

13. Changes to this policy

If this policy changes materially, we will update the date at the top of this page and mention the change in the app's release notes.

14. Contact

Questions about this policy can go to raytracingon@icloud.com, or you can open an issue on GitHub.