Privacy Policy

The short version

StrayCash reads your bank transactions so it can tell you how much of your last paycheck you have not spent. It cannot move money. It never sees your bank password, and it never sees your card number. It does not sell your data to anyone.

What we store

Everything StrayCash keeps about you lives in one database:

• Your email address, used to sign you in and to contact you about your account.
• Your password, hashed. We cannot read it or recover it. A reset creates a new one.
• A Plaid access token, encrypted. This is what lets StrayCash read your transactions. It is encrypted before it is written and is never logged.
• The name of the bank you connected, and which recurring deposit you chose as your paycheck.
• Your Stripe customer and subscription identifiers, and whether your subscription is trialing, active, or lapsed.

What we do not store

We do not keep your transactions. Every time you open StrayCash it fetches them from Plaid, works out the figure, and shows it to you. Nothing about individual purchases, balances, or merchants is written to our database.

We never receive your bank username or password. You enter those inside Plaid's own flow, and Plaid returns only a token that permits reading transactions.

We never receive your card number. Payment details are entered on Stripe's own checkout page and stay with Stripe.

Who else is involved

StrayCash relies on four services, each doing one job:

• Plaid connects your bank and supplies transaction data. Your use of StrayCash is also governed by Plaid's own privacy policy, available at plaid.com/legal. By connecting an account you acknowledge that your information will be treated in accordance with it.
• Stripe processes subscription payments and stores your card details.
• Resend delivers account emails such as password resets.
• Railway hosts the application and its database.

We do not sell your personal information, and we do not share it for advertising.

Read-only access

The permission StrayCash requests from your bank allows it to read transactions and nothing else. It cannot initiate payments, move funds between accounts, or change anything at your bank.

How it is protected

• All traffic is served over HTTPS.
• Your Plaid access token is encrypted at rest.
• Passwords are stored only as salted hashes.
• Accounts are isolated: each request only ever reads the data belonging to the signed-in user.

No system is perfectly secure, and we do not claim otherwise. If you believe you have found a security problem, please contact us so we can address it.

Disconnecting and deletion

You can disconnect your bank at any time from the billing portal by cancelling your subscription. When a subscription ends, StrayCash instructs Plaid to forget the connection and deletes the stored token.

To have your account and all associated data deleted, email us and we will action it. Deleting your account removes your email, password hash, subscription identifiers, and any bank connection.

Contact

Questions about this policy, or requests about your data, can be sent to privacy@straycash.app.