Privacy Policy

Kold Hard Kash · Effective October 5, 2026

The short version: Kold Hard Kash shows you your own money. You sign in with Apple and connect your bank through Plaid; we read your balances and transactions only to draw your money visualization. We store that data encrypted, we don't sell it, we don't show ads, and we don't use third-party analytics. You can delete your account and data at any time.

Who we are

Kold Hard Kash is an iPhone app made by Collin Chisholm, an independent developer ("we", "us"). This policy explains what information the app and its server handle and why. If you have questions, email Cwchiz16@gmail.com.

What we collect

From Sign in with Apple

The user identifier Apple gives our app for your Apple ID (it's unique to this app).
Your email address, if Apple shares it with us. If you choose "Hide My Email", this is a private relay address from Apple.
Your name, if you choose to share it when you first sign in. We use it as your display name in the app.

We never see your Apple ID password.

From your bank, through Plaid

When you connect a bank, you sign in to your bank inside Plaid's own screen; we never see your bank username or password. Plaid gives our server an access token for that connection, which we use to read:

Your accounts: name, type, balances (current and available), credit limit and currency, plus the name of your bank.
Your transactions: amount, date, description, merchant name, logo and website, category, and whether they are pending.

We only read this information. The app cannot move money, make payments or change anything at your bank.

To keep you signed in

When you sign in, the server creates a random sign-in token that the app stores in your iPhone's Keychain. The server stores only a one-way hash of it, with when it was created and when it expires.

Server logs

Like most servers, ours writes technical logs (for example errors, or a note when too many requests come from one place). These can include your IP address and an internal account number. They don't include your balances or transactions.

How we use it

To sign you in and keep your data separate from other users.
To show your own balances and transactions as the app's money visualization.
To keep the service secure and working (for example, rate limiting and fixing errors).

We do not sell your information, share it for advertising, show ads, or use third-party analytics or tracking tools in the app or on the server.

Only the services needed to run the app:

Plaid connects the app to your bank. Plaid's handling of your data is covered by the Plaid End User Privacy Policy.
Apple provides Sign in with Apple.
Railway hosts our server and its database in the United States.

We will also disclose information if the law requires us to.

Security

Plaid access tokens and the bank data we store (cached transactions and related data) are encrypted at rest with AES-256-GCM.
The app talks to our server over HTTPS (TLS).
Sign-in tokens are stored on the server only as hashes, and requests are rate limited.
Only the developer has access to the production server.

No system is perfectly secure, but we work to protect your information and will tell affected users if a breach affects their data.

Data retention and deletion

We keep your information while your account is active. Account balances are fetched from Plaid when the app asks for them; the server keeps your Plaid access tokens and a cache of your transactions so the app can show recent activity.

Delete your account in the app

In Kold Hard Kash, use Delete Account and confirm. This happens right away:

We ask Plaid to revoke our access to every bank you connected (Plaid's item removal), so we can no longer read your accounts.
We delete from our server your account, your sign-in sessions, your bank connections (including the Plaid access tokens), your cached transactions and any other data stored for your account.
You are signed out on every device, and the app also erases the data it saved on that iPhone.

Or ask us by email

Email Cwchiz16@gmail.com with the subject "Delete my account". If you can, send it from the email address connected to your Apple ID or Sign in with Apple, so we can find your account. We will delete your account and data, and revoke Plaid's access, within 30 days and reply to confirm.

What isn't covered

Plaid keeps its own records under its own privacy policy (Plaid End User Privacy Policy). You can see and manage the apps connected through Plaid at my.plaid.com.
Server logs kept by our hosting provider (Railway) may include your IP address and an internal account number, but not your balances or transactions. They are deleted when Railway's log retention period ends.
Data on your iPhone: deleting your account in the app wipes what the app saved on that phone. If you delete by email, or from another device, the data the app saved on a phone (for example, the last balances it showed) stays on that phone until you delete the app.
Sign in with Apple: you can also stop using your Apple ID with this app. On iOS 17 or later: Settings > [your name] > Sign-In & Security > Sign in with Apple > Kold Hard Kash > Stop Using Apple ID.

Children

Kold Hard Kash is not intended for children under 13, and we don't knowingly collect information from them. If you believe a child under 13 has given us information, email us and we will delete it.

Your choices

You can disconnect your banks and delete your account at any time (see above).
You can email us to ask what information we hold about you, or to correct or delete it.

Changes to this policy

If we change this policy, we'll post the new version at this address and update the effective date at the top.

Contact

Collin Chisholm · Cwchiz16@gmail.com