Privacy policy

Who we are

This policy is issued by IAS Digital Group LLC, 2285 S Hiawassee Rd, Suite 205, Office 16, Orlando, FL 32835, United States ("CubbyJar", "we"). It covers cubbyjar.com, the CubbyJar web app and the CubbyJar apps for iOS and Android. We decide how the personal information described here is used, and questions about it go to privacy@cubbyjar.com.

What we collect

Grown-ups: the name you sign up with, your email address, a password stored only as a hash, and the settings you choose, such as time zone and notification preferences. Household: the household's name and the family code your kids type to sign in on their own device.

Kids: a first name, a birth year, a username, the color the kid picks for their account, and a PIN stored only as a hash. We record which grown-up consented to the kid account and when. We do not collect a child's surname, date of birth, school, photo, email address, location or contacts.

The money you record: accounts, transactions and their splits, transfers, recurring items, budgets, categories, jars and jar moves, chores, paydays, goals, and any receipt image a grown-up chooses to attach to a transaction (JPEG, PNG, WebP or PDF, up to 10 MB). Also each kid's asks (the amount, the jar, up to 140 characters of reason, which grown-up was asked, the answer and an optional note), the Save-growth rate and day a grown-up sets for each kid, each grown-up's notification settings (which pushes they get and whether they get the weekly email), and a log of which notifications were sent to which device, kept for 30 days. We never ask for the password to a bank account, a card number or any account credentials, and CubbyJar never talks to a bank; a statement file is something you download yourself and upload.

Imported statements: if you import a bank or card statement (an OFX, QFX or CSV file, up to 5 MB), we keep each transaction the file lists (date, amount, description, memo and the bank's own transaction id) while you review it, plus the file's name, size, date range and closing balance. We keep a fingerprint and the last four characters of the account number in the file, never the number itself. A CSV's text is held only until you tell us which column is which; an OFX or QFX file is read once and not kept. We also keep the categorization rules you write, and the ones we learn from what you confirm: a short text pattern and a category.

The emails we send: every email passes through a queue on our server that holds the address, the subject and the text until it is sent; the text is discarded the moment it goes out, and the record that it was sent (address, kind, subject, when, and whether it was delivered) is kept for 30 days. The weekly email carries a link that turns it off without signing in; the link is a signed token that is not stored anywhere.

Devices and sessions: on each device you sign in from, the app generates a random installation id and sends it with the platform (iOS, Android or web), the device's model name, the push token described below (phone app only) and the time it was last seen, so the sessions from one device can be ended together. If a grown-up signs a shared device, such as a family tablet, in for the kids with their own email and password, we record which grown-up did so, when, and on which device; the device itself holds a kid sign-in, never the grown-up's. The installation id is not an advertising identifier and it is not shared with anyone. A device is deleted by a nightly job when it has not been seen for 60 days or when nothing is signed in on it any more. Our servers keep ordinary request logs (time, path, result and the network address the request came from) in rotating files of a fixed size, so the oldest lines are dropped as new ones arrive; we use the network address to slow down repeated sign-in attempts and for nothing else.

Push notifications: if you use a phone app and allow notifications, we store the push token your phone gives us with that device's record. Notifications are delivered through Expo's push service (Expo, Inc.), which hands them to Apple (the Apple Push Notification service) for iPhones and to Google (Firebase Cloud Messaging) for Android phones. Those three receive the device's push token, the text of the notification (such as a chore's name, a kid's first name, an amount or "Payday!") and a small routing payload the app uses to open the right screen when you tap it: the screen's path and the internal record numbers of the member and of the chore, ask, payday or goal concerned. They receive nothing else about your household. Signing out removes the token (if the phone is offline at that moment, a nightly job removes it as soon as that device no longer holds a valid sign-in), and you can turn each kind of notification off in the app.

Website visits: our own visit counter runs on our own server, sets no cookies and records page views without storing personal information. The forms on the site collect what you type: for the beta list, your email address and the page you joined from; for the contact form, your name, email address, a topic and your message. A contact message is delivered to our support mailbox and is not kept in our database once sent.

An audit record: each change to your household's data is logged with who made it, when, and what changed (the values before and after), so we can answer questions about what happened. Passwords, PINs and tokens are never in it.

Why we collect it

To run the service: to sign you in, keep each household's data separate, add up the numbers you enter, show kids their own jars and nothing else, and send the emails the service needs: address verification, invitations, a locked-PIN notice, password resets, your download link, a notice to every grown-up when the household is scheduled for deletion, a notice to the other grown-ups when one of them deletes their own account, and, if you leave it on, one weekly email on Sunday evening about your household's week and a single note one week after you sign up (each carries a link that turns both off without signing in).

To keep the service safe: to detect abuse, enforce the kid and grown-up wall on our servers, and investigate a security report.

To meet our legal duties, for example to answer a lawful request or to keep the records that tax and company law require.

We do not use your information for advertising, we do not sell or rent it, we do not build profiles from it, and we do not add you to a marketing list — the weekly email is about your own household, goes only to the grown-ups in it, and stops the moment you say so. If you joined the beta waitlist, we email you about the beta and nothing else, and you can ask us to remove you at any time.

Where a legal basis is required, ours are: performing our agreement with you, our legitimate interest in running and securing the service, your consent for a kid account and for the waitlist, and compliance with law.

Who else touches it

The app and its database run on a server we operate at Hostinger International Ltd. in Boston, Massachusetts, United States. Amazon Web Services, Inc. stores the nightly backups, receipt images and export files in its us-east-1 region (Northern Virginia, United States) and sends our email through Amazon SES. When an email we send bounces or is reported as junk, Amazon sends a notice with the address, the reason and the subject line to our support mailbox, which is hosted by Hostinger, and keeps that address on a do-not-send list so we stop emailing it. Expo, Inc. delivers push notifications to the phone apps through Apple Inc. (Apple Push Notification service) and Google LLC (Firebase Cloud Messaging), and each of them sees only the device's push token, the notification text and the record numbers the app needs to open the right screen. All of them process data only on our instructions.

No advertising network, data broker, analytics company or social platform receives your data. If we ever add a company that processes personal information for us, we update this policy before it handles any.

We disclose personal information only when the law requires it, to protect the safety of a child or of the service, or, if CubbyJar is ever sold or merged, to the successor under this same policy after emailing you.

Your data is stored and processed in the United States. If you use CubbyJar from elsewhere, you are sending your data to the United States.

How long we keep it

We keep your household's data while the household exists. When you delete the household, we first email you a download link to the export of your household's data described under Your rights, then purge the household from our live systems after 30 days. Backups are kept for 30 days, so deleted data leaves the backups within 30 days of the purge.

A deleted kid is kept for 30 days so a grown-up can restore them, then purged. Receipt images live as long as the transaction they belong to, including the 30 days in which a deleted transaction can be restored, and are deleted with the household; once a receipt is deleted from our records, the file itself leaves our storage within a further 30 days. Export files expire 30 days after they are created; the emailed link works for 7 days.

A grown-up's sign-in lasts 30 days and a kid's 90 days, counted from the last time the app was used; the record of an expired or ended sign-in is dropped 30 days later. Request logs are kept for a short operational period. The audit record lives and dies with the household.

Imported statements: a CSV waiting for its column mapping is deleted after a day; a row you dismissed is deleted after 90 days; a row you confirmed stays with your household's records as an ordinary transaction. The record of each email we sent, and the log of push notifications, are kept for 30 days. A device record is dropped after 60 days unseen or as soon as nothing is signed in on it.

If you join the beta waitlist and never create a household, we delete your waitlist entry when the beta ends or when you ask, whichever comes first.

Your rights

From inside the app, a grown-up can see and correct the household's records and each kid's details, ask at any time for a JSON export of the household's full records (the household's name and settings, each member's name, birth year, email or username, the devices that have signed in, the accounts, transactions, budgets, chores and other records the household keeps, and a log of what changed and when, without the before and after details; it never contains passwords, PINs, sign-in tokens, push tokens or the raw statement files you uploaded), delete a kid, delete your own account, and delete the whole household. We send a link that works for 7 days, and the file is deleted after 30 days. Deleting the household sends you that same export first. When a grown-up deletes their own account, their sign-in, devices and settings are removed at once; the household's records stay with the other grown-ups and show that person as Former adult. The last grown-up in a household deletes the household instead. To end every sign-in on every device at once, reset your password from the sign-in screen; that also signs out any shared device you signed in for the kids. To change your own name or email address, email privacy@cubbyjar.com and we do it for you.

You can also ask us to access, correct, delete or export your personal information, to restrict or object to how we use it, or to withdraw consent, by emailing privacy@cubbyjar.com. We answer within 30 days, and we never treat you differently for exercising a right.

Residents of California and of other states with privacy laws have the rights those laws provide, including the right to know what we collect and the right to delete it. We do not sell or share personal information as those laws define it, and we do not use it for targeted advertising, so there is nothing to opt out of.

If you think we have not honored your rights, tell us at privacy@cubbyjar.com. You can also complain to your state attorney general or to the Federal Trade Commission.

Children

CubbyJar is a family app. A child under 13 uses it only through a kid account that a parent or guardian creates and consents to. A child cannot create an account, and we do not knowingly collect information from a child except through a kid account. The Children's privacy notice sets out what we hold about a child and a parent's rights.

If you believe a child has given us information outside a kid account, email privacy@cubbyjar.com and we will delete it.

Changes

When we change this policy in a way that matters (a new kind of data, a new purpose or a new company processing data for us) we email the grown-ups in every household before the change takes effect and update the "Last updated" date. Wording changes are published with a new date. Earlier versions are available on request.