Legal

Privacy Policy

Last updated October 18, 2026

Cheapskate (“we”, “us”) is a personal finance assistant. You connect your own financial accounts, and we show you your money and answer questions about it — on the web and, if you choose, by text message. This policy explains what we collect, why, and who we share it with.

SMS messaging and your mobile number

We do not share your mobile number. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Your phone number is used only to operate the Cheapskate messaging service you asked for. We do not sell, rent, or otherwise disclose your mobile number, and we never share it for anyone else’s marketing. The only third party that receives it is our messaging carrier, Twilio, purely to deliver and receive your messages.

Message frequency varies. After you link your phone we send one welcome message. From then on, how often we text depends on the settings you choose and your own activity: replies whenever you text us, up to one daily spending recap if you enable recaps, questions about newly detected purchases unless you pause bookkeeping, and any reminders you specifically ask us to set. We cap outbound messages at 30 per day per user.

Message and data rates may apply. Reply STOP to opt out at any time, START to resume, or HELP for help.

How you opt in

SMS is off by default. To turn it on you must be signed in, accept the SMS disclosure, and then text a one-time code from the phone you want to link. That inbound text proves you control the number. We store the time you consented. We never text a number before this is complete, and we never treat consent given on another channel as consent for SMS.

What we collect

Account details. The email address from your sign-in provider, and a passphrase you set. Passphrases are stored only as salted hashes.
Financial data. If you connect an institution, we receive read-only account balances, transactions, holdings, and supported card benefits. We cannot move money, make payments, or trade.
Things you write. Purchase descriptions, corrected dates, budgets, goals, and preferences you save, including Venmo names and usernames you confirm for future bill splits.
Narrow Gmail signals, if you connect Gmail. We search only for these kinds of message, and keep only the structured details each feature needs:
- Billing notices (price changes, renewals, free trials ending, bills due): the sender's name, the kind of notice, amounts, and the date.
- Venmo notifications: the other person's name, direction, amount, date, and a possible username.
- Order emails from supported stores, matched to a purchase by total and date: a short description of what was bought.
- Travel and reservation confirmations: the place and dates.
We read only a message's sender, subject, date and preview, not the full message, except for Venmo notifications, where the sender's profile link is read to find a username. We never store email subjects, previews or bodies. Email activity never confirms a person's Venmo identity.
Your phone number and messages, if you enable SMS. Numbers are encrypted at rest and indexed by a keyed hash. We keep the text of messages you exchange with us so the assistant has conversation history.
Receipt photos you text us, if you choose to send them. Twilio holds the original MMS image. We send the image to OpenAI to read it, then save a Twilio media reference and any merchant, date, amount, or purchase link you ask Penny to record. We do not save a second image copy in Cheapskate.

Google user data

Gmail access is optional and read-only. We use it only to provide the features above, which you see in Cheapskate and in Penny’s messages to you. We do not use Google user data for advertising, do not sell it, do not use it to build or train AI models, and do not transfer it except as needed to provide those features (for example, a detail found in an order email may be part of what Penny uses to answer you), for security, or where the law requires. People at Cheapskate do not read your email or the details derived from it unless you ask us to, for security investigations, or where the law requires.

Cheapskate’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google at any time in Connections. Disconnecting revokes our access and deletes everything we derived from your email. Deleting your account deletes it too.

Bank credentials

We never see, receive, or store your bank username or password. Account connections are made through Plaid, which handles the login directly and returns only read-only data to us. Access tokens we hold are encrypted at rest.

Who we share data with

We do not sell your personal information. We share only what a provider needs to do its job:

Plaid — to connect your financial institutions and sync data.
Twilio — to send and receive your text messages.
Google — for sign-in, optional connected services, and Resy venue checks.
OpenAI — to generate Penny’s web and SMS answers from the relevant financial context.

To answer your questions, relevant parts of your financial data and receipt images you submit may be sent to the AI model. We exclude credentials and full account numbers from what the model receives. We may also disclose information where required by law.

People you choose to share with

Nothing is shared with other Cheapskate members unless you join an event, such as a night out a friend starts. Joining is a separate choice, and we show you exactly what will be shared before you agree. While you’re in an event, the other people in it see your first name and your spending totals for that event only: the total, the food and drink portion, and the number of purchases. They never see what you bought, where, your balances, your accounts, or anything outside the event. You can leave an event at any time, and your totals come off its board.

Keeping it safe

Connection tokens and phone numbers are encrypted at rest, data is scoped to your account, and access is checked on every request. No system is perfectly secure, so please use a strong, unique passphrase. Text messages are not end-to-end encrypted; we keep routine texts brief and put sensitive detail behind a signed-in link.

Your choices

Turn recaps or purchase questions on and off, or set quiet hours, in Spend diary.
Reply STOP to end all text messages. This does not close your account.
Disconnect an institution at any time to stop syncing.
Correct or remove a saved Venmo person in Text Penny.
Ask us to export or delete your account and its data.

We keep your data while your account is open and delete it on request.

Other things to know

Cheapskate is for adults and is not directed at children under 13. Cheapskate gives you information about your own money; it is not financial, investment, tax, or legal advice. We will post any changes to this policy here and update the date above.

Contact

Questions about this policy or your data: garv5114@gmail.com.