App Privacy Policy
Last updated · covers the Cashout mobile app. The trycashout.com website is a different system with its own policy.
The short version
- Your streak, your money figures, your check-ins and your slips live on your phone. The app is built to work in airplane mode, so the phone — not our server — is the original copy.
- The app creates an anonymous account when it can connect, and recovery data syncs to our server even before you use Sign in with Apple. Linking Apple lets you recover that account on another device.
- The app defines 51 analytics events, listed below. Gambling losses and savings use ranges in analytics. Subscription payments are different: our server sends their transaction price.
- Our product events do not include your name, notes, lesson writing or community text. Those texts may still be stored in your account as described below.
- No session recording or automatic screen-view capture. We record the specific actions below, app lifecycle events and technical crash/error reports.
- Crisis resources and the self-exclusion directory are free and available offline. Calling a helpline needs telephone service; opening an external website needs an internet connection. We do not receive the contents of your calls.
- You can export your data in the app and request account deletion at privacy@trycashout.com. Resetting the app only resets the recovery data on that device.
Who is responsible for your data
The data controller is Bastien Youssfi, trading as YOUSSFI BASTIEN (entrepreneur individuel), registered in France:
- SIREN 942 550 989 · SIRET 942 550 989 00019
- APE 62.01Z — Programmation informatique
- 18 Mail Renaissance, 95120 Ermont, France
- privacy@trycashout.com
Cashout is a one-person project. The person who reads that inbox is the same person who wrote the code this page describes.
Local storage and offline use
Recovery state is stored as a JSON file in the app's private storage on your iPhone. Preferences and the Shield's shared state also use local storage. We do not add our own encryption layer; the device's iOS storage protections apply. The streak, money counter, panic flow, check-ins and bundled or cached lessons work offline. Community, purchases and syncing need a connection.
The Shield keeps your Screen Time selections as Apple's opaque tokens, alongside its settings and blocked-attempt counts in storage shared with the blocking extensions on your phone. Cashout does not upload those tokens or a browsing history. Its analytics include counts and settings as listed below.
Using Cashout without Sign in with Apple
You do not have to link an Apple account to start. When connected, the app creates an anonymous Supabase account and syncs to it. Anonymous here means no sign-in email is needed; it does not mean no data leaves your phone. Analytics and purchases are linked to that account identifier too. Before an account is available, analytics uses a generated identifier.
Link Sign in with Apple if you want to recover the same account after a reinstall or on another phone. An unlinked anonymous account is not a reliable way to recover your history after losing the device.
Helpline numbers and self-exclusion information are bundled in the app. The app chooses a suggested country locally; it does not request precise location. Tapping a helpline number opens the phone dialler. Cashout does not record the call or send an analytics event for that tap.
What syncs to our server
The app sends the following to Supabase under your account identifier, including when that account is anonymous. Note text and lesson responses are part of this backup, not part of product analytics. Community and subscription records are described separately below.
| What | The exact fields |
|---|---|
| Profile | Name if provided, original and current quit dates, monthly-loss figure, score and band, selected goals, betting types, triggers, quiz option codes, best streak, onboarding/account status, time zone and update time. |
| Check-ins | Date, urge level, update time and any saved note. Notes are included by the sync code; they are not guaranteed to stay on the device. |
| Slips | Time, trigger, optional amount and any saved note. |
| Urge sessions | Start time, duration, outcome and trigger if recorded. |
| Program progress and responses | Completed days, lesson selections and written reflections, and references to lines you keep from lessons. |
| Streak | Start time, best run and total clean days. |
| Notification delivery | APNs device token, sandbox/production environment, platform and token update time; campaign delivery records. |
Unlike analytics, the server copy holds your exact figures — it has to, because it is the backup of the numbers the app shows you. It is protected by database access rules: app users can access their own private recovery rows, while authorized server operations can access them to provide the service. Community data has different visibility, below.
The server also generates an anonymous handle like
QuietHarbor_402 when your account is created. That handle is
the identity shown with community posts. The feed can also show your streak
length and a clinician or administrator role badge. Text you choose to
publish may identify you even when the handle does not.
Analytics and diagnostics
We use PostHog's EU service to understand app use and failures. Events are linked to the Supabase account identifier once it is available, including an anonymous account. They are not anonymous usage statistics merely because you have not linked an Apple sign-in.
- Specific product events. The table lists the app's custom event names and the details sent with each one. Events marked reserved are not currently sent. We do not attach names, note text, lesson writing or community bodies to these events.
- Gambling amounts use five ranges: under 100, 100–500, 500–2,000, 2,000–10,000 and 10,000 or more US dollars. The separate subscription events below can contain the exact price paid for Cashout.
- Some values are exact: quiz score, selected option codes, urge level, day counts, duration, community text length and some Shield settings. We do not describe all of these as banded.
- No session replay or automatic screen-view capture. App lifecycle events are enabled, as is crash reporting. Specific actions, including opening the panic flow, are recorded as listed.
- Crash and error reports. PostHog can send native crash diagnostics, including exception/signal information, stack traces and app/device context, on a subsequent launch. Our handled-error reports send an operation name, error category and code. We do not attach request bodies, recovery notes or community text to them. Crash breadcrumb collection is not enabled.
Getting started
| app_first_opened | Reserved first-launch event; no additional properties. |
| onboarding_screen_viewed | The screen identifier and its position. |
| quiz_answered | The question identifier and selected option codes, not free text. |
| quiz_completed | That the quiz was completed; no additional properties. |
| results_viewed | Your exact score and score band. |
| money_projection_viewed | Your monthly-loss band and the band of the five-year projection. |
| commitment_held | How many days ago you chose to stop gambling. |
| goal_added | Selected goal codes and whether they were chosen during onboarding or in the editor. |
| notifications_prompt_answered | Allowed, denied or skipped; settings as the source when applicable. |
| onboarding_completed | Your score band and monthly-loss band. |
Subscription
| paywall_viewed | Offering identifier, score band, monthly-loss band and whether a trial timeline is shown. |
| paywall_plan_selected | The selected package identifier. |
| purchase_started | The selected package identifier. |
| purchase_completed | Package identifier and billing period. |
| purchase_failed | Cancelled or error; not the store's error message. |
| paywall_dismissed | Reserved event; no additional properties. |
| winback_offer_viewed | Push as the source when applicable. |
| winback_offer_accepted | Whether the offer came from a decline or a push. |
| restore_attempted | That Restore purchases was tapped; no additional properties. |
Recovery and sharing
| checkin_completed | Urge level, consecutive logged days, total logged days and whether a check-in was amended. |
| panic_opened | That the panic flow opened; no additional properties. |
| panic_step_completed | Which part of the panic flow you opened. |
| panic_resolved | The outcome and duration in seconds. |
| relapse_logged | Trigger code, an amount band (or unknown), and panic as the source when applicable. |
| streak_milestone_reached | The milestone day. |
| streak_detail_viewed | That the streak detail opened; no additional properties. |
| money_detail_viewed | That the money detail opened; no additional properties. |
| streak_share_opened | That the share preview opened; no additional properties. |
| streak_shared | Days clean, days logged and whether money was included in the shared image. Not the money figure or image. |
| data_exported | Whether the export contains only local data. |
The program
| lesson_started | The lesson day and phase. |
| lesson_completed | The lesson day and phase. Not your answers or writing. |
Community
| community_viewed | Whether the live feed was available. |
| community_post_created | Post type and character count, not its text. |
| community_reply_created | Parent post type and reply character count, not its text. |
| community_reacted | Reaction kind, whether it was added or removed, and post type. |
| community_reported | Whether you reported a post or a comment. |
| community_blocked | That a block occurred; no additional properties. |
| community_moderated | Moderation action, post/comment target type, and review queue as the source when applicable. |
Shield
| shield_setup_started | The blocking layer being set up. |
| shield_authorization_answered | Whether Screen Time access was granted and a predefined failure explanation, if any. |
| shield_apps_blocked | A banded app count, site count, whether app installs are blocked and cooling-off hours. Not app names or tokens. |
| shield_lift_requested | Cooling-off hours. |
| shield_lift_cancelled | That a lift request was cancelled; no additional properties. |
| shield_lifted | That the shield was lifted; no additional properties. |
| shield_attempts_seen | A banded count of attempts at blocked content. |
| selfexclusion_link_opened | Reserved event for the self-exclusion scheme opened. |
| bank_guide_opened | Reserved event for the bank guide opened. |
Lifecycle and diagnostics
| notification_opened | Notification route/type and campaign identifier, if present. |
| app_opened | That the app opened; no additional properties. |
| client_error | The failing operation, error category and technical error code. No error message or request payload is attached. |
Server events and analytics profiles
RevenueCat webhooks send rc_trial_started,
rc_trial_converted, rc_renewed,
rc_trial_cancelled, rc_churn,
rc_billing_issue and rc_refunded when applicable.
These include your account identifier, event time, product, billing period,
store and the transaction price supplied by RevenueCat. The webhook also
updates subscription status on your PostHog profile. The iOS app does
not separately attach your name, email or quiz summaries to that profile.
The notification service sends rc_winback_push_sent with
your account identifier, campaign, APNs environment and whether the
server corrected that environment while delivering the notification.
It does not send the device token to PostHog.
What the analytics SDK adds
PostHog attaches technical context such as app version/build, operating system, device model, screen information, locale, time zone, session and generated identifiers. It also records app lifecycle events. Requests necessarily expose an IP address to the receiving service. We do not use GPS or request location permission for analytics.
Subscriptions and payment
Purchases run through Apple's In-App Purchase system and are managed by RevenueCat. We never see your card, and never receive it. Apple takes the payment; RevenueCat tells our server whether your subscription is active.
RevenueCat starts with its own anonymous customer identifier. Once a Supabase account exists, including an anonymous one, the app links it to that account identifier. We also set a flag when you have seen the one-time discount offer. We do not send your name, email, quiz answers or recovery notes to RevenueCat. Our server keeps subscription status, product, trial/renewal dates and churn information. The app can read this mirror but cannot grant itself a paid subscription by writing it.
Cancelling is done in your Apple ID subscription settings and takes effect without asking us. We do not put a retention flow in front of it.
The community feed
Posts and comments are user-generated content that other people can read. Treat anything you post as public to everyone in the app. They are shown under your generated handle, never your name, but the text itself is exactly as you wrote it — if you put an identifying detail in a post, it is visible.
Post and comment text is stored on our server and is never sent to product analytics. Those events include post type and text length, not the body. You can delete your own posts and comments. You can read and react with an anonymous account; posting and replying require a linked Apple sign-in.
Reports and blocks are stored too: a report keeps who reported what, and a block keeps who blocked whom. Authorized moderators can review reports and flagged content and record moderation decisions. The community is not a private channel to a clinician or emergency service.
Moderation
After a post or comment is submitted, the app requests a server-side moderation check for contact details, lending, tipster promotion and abuse. The rule-based filter runs in our Supabase function. This is not a guarantee that every harmful message is detected or removed.
The app can additionally be configured to send the text of a post to OpenAI's moderation endpoint for a second opinion. When that is enabled, post or comment text is sent without an attached account id, handle or device information. Text itself can contain personal details you put in it. The rule-based filter runs alone when this optional service is disabled.
When the filter detects crisis language, it returns a crisis response so the app can offer helplines. It does not hide a post solely for that detected crisis language. Other moderation actions and user reports can still affect visibility; this is not an emergency-response service.
Notifications
Daily check-ins, milestones, trigger-window reminders, trial-ending reminders and other recovery reminders are scheduled on your phone. Reminder preferences are stored locally. Your profile still includes your time zone and recovery information for syncing, as listed above.
If notification permission is granted, the app also registers with Apple Push Notification service (APNs). We store the resulting device token, its environment, platform and update time against your Supabase account. Our server uses APNs to send a return offer after a subscription expires. It stores campaign delivery records to avoid sending the same campaign repeatedly. Apple receives the token and notification payload to deliver the message; the token is not a phone number.
You can turn off Cashout notifications in iOS Settings. The app's reminder switches control local reminders; they do not separately opt out of the server's return offer. Turning off notifications does not itself delete a previously stored token. Invalid delivery tokens are cleared by the server, and you can request deletion of your account data.
Signing in with Apple
Apple sign-in is optional. The current iOS app does not offer Google sign-in. When you link Apple, Supabase stores the sign-in identity and the email Apple provides so the account can be recovered on another device. Apple's Hide My Email relay address works here; we do not require your ordinary email address.
Signing out does not delete your server account or its history. We do not send marketing email to app account addresses.
Who else touches the data
These services handle app data for the purposes listed here. Apple also processes payments and Apple account information under its own terms and privacy policy. OpenAI is listed for the optional moderation integration; it receives community text only when that integration is enabled.
| Company | What it does | What it sees |
|---|---|---|
| Supabase, Inc. | Hosts your account and the copy of your data that syncs between devices. | Everything in the sync table above, plus the email address your sign-in provider returns. |
| PostHog (EU Cloud) | Product analytics and crash/error reporting. | The events and technical diagnostics described above, linked to your account id, plus subscription and push-delivery events. |
| RevenueCat, Inc. | Runs the subscription: purchases, renewals, restores. | Your account id and the App Store transaction. No name, no email from us. |
| Apple | Processes payments, optional Apple sign-in, Screen Time controls and remote notification delivery. | Purchase and sign-in information handled by Apple; APNs receives the device token and notification payload for delivery. We never see your card. |
| OpenAI, L.L.C. | Optional community moderation provider, only when enabled; see Moderation below. | The text of a community post or comment, with no id attached to it. |
Supabase, RevenueCat and OpenAI are US companies, so data may be processed outside the European Economic Area. Those transfers rely on the European Commission's Standard Contractual Clauses. PostHog is used on its EU Cloud.
Deleting your data
To request deletion of your server account and recovery/community data, email privacy@trycashout.com. The current iOS app does not have an in-app Delete account action. We may need to verify that the account is yours before acting; do not send your gambling history or payment details to identify yourself.
Reset everything in the You tab resets the recovery state on this device. It does not delete your server account, server history, subscription or all SDK/Shield preferences. Synced history can return when the app reconnects. Signing out and uninstalling likewise do not request server deletion. Cancel a subscription in Apple's settings if you also want future billing to stop.
For a copy of your data, use Export my data in the You tab. It writes your local recovery state and available account records to a JSON file and hands it to the iOS share sheet. The export goes to the destination you choose; Cashout does not upload the export file. It works offline from the data on your phone; run it with a connection and it includes your community posts and subscription details too, and the file says which version you got.
If you'd rather we did it, email privacy@trycashout.com and we'll send it within 30 days.
How long we keep things
- Your account data: until you delete it. We don't expire an account for going quiet — someone coming back after eight months should find their history where they left it.
- Anonymous accounts: server data can remain even if you never link an Apple sign-in or finish onboarding. Do not rely on uninstalling or resetting the app to remove it; contact us to request deletion.
- Analytics events: kept per PostHog's retention on our plan. Removing an account from Supabase does not automatically erase its PostHog or RevenueCat records; include those records in a deletion request. Payment records may need to be retained where required by law.
- Community posts: until you delete them or your account.
Sharing an image or export
If you choose to share a streak poster, it can include your day counts and, if you leave that option on, your money-saved figure. The image or exported JSON goes through the iOS share sheet to the app or person you choose. Those recipients have their own privacy practices. Cashout's share event records whether money was included, not the figure or image.
Why we're allowed to hold it
- Contract, Art. 6(1)(b) GDPR — your account, the sync, the subscription. Without them there is no app to provide.
- Legitimate interests, Art. 6(1)(f) — product analytics and moderation. The interest is making a recovery app that works and keeping predators out of a room full of people with money problems; the limited product-event properties and banded gambling amounts reduce the detail sent to analytics.
- Consent, Art. 6(1)(a) — notifications, and anything you choose to post. Withdraw either at any time.
Quiz answers and recovery records can reveal sensitive information about you. Private recovery rows are restricted from other app users. Selected quiz option codes, the score and score band reach analytics as listed above; written reflections and notes do not form part of product events.
Your rights
You can ask us to show you the data we hold, correct it, delete it, hand it over in a portable form, restrict what we do with it, or object to the analytics. Email privacy@trycashout.com and we'll act within 30 days. Account deletion is currently handled through that contact address.
If you think we've handled your data badly, complain to the French data protection authority, the CNIL, or to the supervisory authority where you live.
Age
Cashout is intended for adults aged 18 and over. We do not knowingly collect data from children. Contact us if you believe a child has supplied personal data so we can investigate and arrange deletion.
What the app never does
- No advertising SDKs, no attribution SDKs, no retargeting pixels.
- No sale of personal data or sharing for advertising. Service providers receive the data described in this policy.
- Nothing is ever shared with a gambling operator or affiliate. This is the point of the product.
- No session replay, automatic screen recording or keystroke logging.
- No contacts, no photos, no microphone, no precise location.
- No credit checks, no bank connections, no open banking.
- No emails to your account address that you didn't ask for.
Changes
When this policy changes, the date at the top changes with it. Anything that widens what we collect gets a notice in the app before it takes effect, not a quiet edit.
Contact
privacy@trycashout.com — questions, data requests, or anything on this page that reads as untrue. The last one gets answered first.