Privacy policy

What we store

• Your account: your email address, your name, and your profile picture if you sign in with Google. We also keep how you sign in (passkeys and linked Google accounts) and your active sessions. We don't record your IP address or browser.
• Your household: its name, its members and their roles, and the email addresses of people invited to join.
• Your finances: what you enter, import, or sync: accounts and balances, transactions with their descriptions, amounts, dates, categories, splits, and labels, vendor rules, budgets, categories, and investment holdings and prices.
• Connections: if you connect a brokerage, the SnapTrade identifiers needed to sync it. If your household adds a Tiingo token, we store it encrypted.
• Settings and history: your notification choices, a record of which alert emails were sent so none goes out twice, and any integration requests you send us.
• Suspended accounts: if we suspend an account for abuse, we keep its email address and the reason so it can't sign up again. When we also delete its data, those two are all that's left.

We never see or store your bank or brokerage passwords. A CSV file you import is read once and not kept. Everything in a household is shared: every member can see and change all of it.

How we use it

Only to run Cubby: signing you in, showing your budget, sending the emails you've asked for, and keeping the service secure. We don't sell your data, show ads, share it for marketing, or use analytics or tracking tools.

What we can see

Your financial data is stored in our database without end-to-end encryption, so as the operator we are able to read it. We use it only as described above. We never see your bank or brokerage passwords, and error reports sent to Sentry carry your account ID but not your transactions.

Who else handles it

These companies process data for us, each only for the job listed:

• DigitalOcean hosts the server and the database.
• Amazon Web Services sends our emails (SES), which means it handles your address and the email's contents, and stores the encrypted nightly database backups (S3).
• Cloudflare Turnstile checks for bots on the sign-in page. Cloudflare sees your IP address and browser details while it does.
• Sentry receives a report when something breaks: the error, the page, your browser, and your account ID.
• Google , only if you choose to sign in with Google. We receive your name, email address, and profile picture.
• SnapTrade , only if you connect a brokerage. You sign in to the brokerage through SnapTrade, and it sends us your accounts, balances, and holdings.
• Tiingo , only if your household adds its own token. We send it ticker symbols to look up prices, and nothing about you.

Emails

Sign-in links, household invitations, and notices about your account are always sent. Alert emails (the weekly summary, review reminders, and large-transaction, budget, and new-account alerts) go out only while you have them on. Every alert email has a one-click unsubscribe link, and you can switch them off any time in Settings → Household → Email alerts.

Cookies

We use only the cookies the app needs: one that keeps you signed in, one that remembers whether the sidebar is open, and a short-lived one that carries a notice across a page change. Your theme choice is saved in your browser. Cloudflare Turnstile may set its own cookies on the sign-in page. There are no advertising or analytics cookies.

Keeping and deleting your data

• Export: download everything your household has stored, as one archive of JSON and CSV files, any time from Settings. Transactions, vendor rules, and budgets are also available as single CSVs.
• Deactivate: signs you out everywhere and stops your alert emails. Nothing is deleted, and signing in again brings you back.
• Delete your account: removes your sign-in and personal details straight away. If you're the household's only member, the household and all of its financial data go with it. If others share it, the household's data stays with them, and an owner has to hand ownership to someone else first.
• Backups: we keep encrypted nightly backups for 30 days, so deleted data is gone from them within 30 days.
• Sessions expire 30 days after you last use them.

Your rights

You can see, correct, export, and delete your data, most of it yourself from Settings. For anything else, or to ask what we hold about you, email info [at] jvp.design. We answer within 45 days.

Security

Everything travels over HTTPS, sign-in is passwordless, stored tokens are encrypted, and backups are encrypted at rest. No system is perfectly secure; if a breach affects your data, we'll tell you as the law requires.

Children

Cubby is for adults. You must be 18 or older to use it, and we don't knowingly collect data from children.

Changes to this policy

When this policy changes, we'll post the new version here with a new date. If a change affects how we use your data, we'll email you before it takes effect.