Cedar & Coin is built privacy-first. The short version: bank connection is optional, Cedar never receives your bank password or payment-card number, we never sell your data, and you can export or delete your information.
We collect the account information you provide (username, display name, email), security and limited activity records, subscription status and provider identifiers, and the financial entries you choose to record. Financial entries can come from manual entry, statement upload, transaction-alert email, or an optional connected institution. Uploaded statements are parsed into transaction rows and are not retained as files. An email forwarded to your private card-feed address is kept for 14 days so you can read it in the app, with long account and card numbers masked and the text encrypted at rest; then its text is deleted. Receipts you choose to attach to a transaction are different: they are kept as files, because their purpose is to substantiate the entry later.
Signing in with Google or Apple. If you choose it, the provider tells us your name, your email address (with Apple, possibly a private relay address), and an account identifier. We use them only to sign you in and to reach you about your account. We never receive your Google or Apple password, and we request no other access to those accounts: no contacts, files, mail or calendar. You can disconnect either one at any time in Settings, under Sign-in & security.
Cedar does not receive or store bank passwords, full payment-card numbers, card security codes, Social Security numbers, or government IDs. Payment details are entered on Stripe's hosted pages, not in Cedar. If you opt into Plaid when it becomes available, authentication will occur through Plaid Link or your institution's OAuth page; Cedar would receive an access token and the account data you authorize, not your password. Cedar itself uses only its secure session cookie; provider-hosted pages and frames are governed by their own policies.
Your data is stored in a Cloudflare D1 database operated by HK Applications LLC. Encrypted weekly backups are retained for 56 days for disaster recovery. Receipt images and PDFs you attach are stored in private Cloudflare R2 storage and can only be retrieved through your signed-in session. Passwords are stored only as salted PBKDF2 hashes - we cannot read them. Older encrypted snapshots created before September 2, 2026 may remain in private repository history until that history is separately purged.
You control AI processing in Settings, under Ask Cedar & privacy, and the ledger works fully with AI turned off.
Cloudflare only is the default for new accounts. Ask Cedar, statement parsing, and Tape Read run on Cloudflare Workers AI, part of the same infrastructure that hosts Cedar. Off means no feature sends anything to any model. External AI allowed sends the same requests to Anthropic, the maker of Claude, through its commercial API, with Workers AI as the fallback if Anthropic does not respond. Anthropic does not use API data to train its models.
What a request contains. AI features are only useful with your real numbers, so each request carries some of your data:
Nothing is sent until you use one of these features. Model providers handle requests under their own terms, and HK Applications LLC does not use your data to train a model. If you would rather none of this leave the ledger, choose Off.
You can let another app read your ledger: an AI app such as Claude through its connector (you approve it on a Cedar & Coin page that names the app and where it sends you back), an agent or script holding a personal API key you created with your password, or an inbox that receives the daily report. Each is off until you turn it on, and each is read-only: none can add, change, or delete anything, move money, or see your household partner's ledger, your password, or your sign-in codes.
We use service providers only to operate features you request: Cloudflare for application hosting and storage, Resend for transactional email, and the AI provider selected by your privacy setting. Apps you connect yourself are covered in section 5. When paid subscriptions launch, Stripe will process web billing; a future native app may use RevenueCat. Optional institution connection may use Plaid when that feature is enabled. We do not sell, rent, or trade personal or financial data. Household information is shared with your partner only according to the visibility setting you choose: a member always sees your totals, and sees itemized entries only if you turn sharing on. You can narrow it account by account: an account set to show its balance only shares no entries paid from it, and an account you hide is left out of everything your partner sees, totals included. A purchase you ask your partner about is shared with them by asking. When your partner reacts to one of your purchases, the reaction and any words with it are kept on your entry; they are deleted if your partner deletes their account. Your partner's view of your detail also shows when you last edited an entry by hand. New accounts start with sharing off. Nobody joins a household without the owner's say-so: either through an invite the owner created, which works once and expires after 30 days, or by the owner accepting a request. The owner is notified by email either way.
Transactional email (verification, password reset, the weekly digest, and the daily report if you turn it on) is sent via Resend from cedarcoinco.com with SPF, DKIM, and DMARC configured. The digest can be turned off inside the app, and the daily report goes only to addresses you added that confirmed they want it.
Plaid institution connection is optional and not yet generally available; when enabled, it can be revoked in Settings, under Connections. Revocation stops future access; previously imported ledger entries remain until you delete them or your Cedar account. Stripe is the system of record for subscriptions and payment status. Cedar stores Stripe's customer and subscription identifiers, the plan, its status and renewal date, not payment-card details. A future native app may use RevenueCat for in-app purchases.
Export your ledger at any time. Non-founder users can delete their account in Settings, under Your data; deletion requests revocation of any active Plaid access and cancellation of any associated Stripe customer when billing is live, then removes live Cedar account data, including stored receipt files. Founder-account deletion requires an operator request. You may also email digest@cedarcoinco.com from your account email. Encrypted backups expire on the 56-day retention schedule.
HK Applications LLC, Wichita, Kansas · digest@cedarcoinco.com