Privacy Policy

Last updated: March 18, 2026

HydraCash ("we," "our," or "us") operates the HydraCash mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App. Please read this policy carefully. By using HydraCash, you consent to the practices described in this Privacy Policy.

1. Information We Collect

1.1 Information You Provide Directly

Account Information: Phone number, full name, email address, date of birth, and profile photo when you create an account.
Identity Verification: Government-issued ID, Social Security Number (last 4 digits), and other information required by law for identity verification and anti-money laundering compliance.
Financial Information: Bank account details, debit card numbers, and billing addresses provided to fund your account or receive payments.
Transaction Information: Payment amounts, recipients, descriptions, dates, and associated metadata for every transaction you initiate or receive.
Communications: Messages, support requests, and feedback you send to us or other users through the App.
Receipt Data: Photos of receipts you upload for AI-powered bill splitting, including merchant name, item descriptions, prices, tax, and tip amounts.

1.2 Information Collected Automatically

Device Information: Device type, operating system version, unique device identifiers, and push notification tokens.
Usage Data: Features used, screens viewed, interaction timestamps, crash reports, and performance metrics.
Location Data: Approximate location (city-level) derived from your IP address, used solely for fraud prevention and regulatory compliance. We do not track precise GPS location.
Network Information: IP address, mobile carrier, and connection type.

1.3 Information from Third Parties

Contact Information: With your permission, we access your device contacts to help you find friends who use HydraCash. Contact data is hashed and matched on our servers; we do not store your full contact list.
Payment Processors: Stripe may provide us with limited information about your payment method status and transaction outcomes.

2. How We Use Your Information

We use collected information for the following purposes:

Provide Services: Process payments, manage your account, issue virtual cards, execute bill splits, and deliver rewards.
Fraud Prevention & Security: Monitor transactions for suspicious activity, verify identities, prevent unauthorized access, and comply with anti-money laundering (AML) and know-your-customer (KYC) regulations.
Receipt Processing: Analyze uploaded receipt images using AI to extract line items for bill splitting. Receipt images are processed in real-time and are not stored after processing is complete.
Analytics & Improvement: Understand how users interact with the App to improve functionality, fix bugs, and develop new features.
Communications: Send transaction confirmations, security alerts, account updates, and (with your consent) promotional messages.
Legal Compliance: Fulfill regulatory obligations, respond to legal requests, and enforce our Terms of Service.

3. How We Share Your Information

We do not sell your personal information. We may share information with the following categories of third parties:

3.1 Service Providers

Stripe, Inc. — Payment processing, virtual card issuance, and identity verification. Stripe processes your financial data under their own privacy policy.
Supabase, Inc. — Cloud database and authentication services. Your account data and transaction records are stored on Supabase's infrastructure with encryption at rest and in transit. See their privacy policy.
Anthropic (Claude AI) — Receipt image processing for bill splitting. Receipt images are sent to Anthropic's API for text extraction. Images are processed in real-time and are not retained by Anthropic for training purposes. See their privacy policy.
Expo / React Native — App delivery and over-the-air updates.
Apple Push Notification Service (APNs) — Delivery of push notifications.

3.2 Legal Requirements

We may disclose your information if required by law, subpoena, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

3.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

3.4 With Your Consent

We may share information with third parties when you explicitly consent to such sharing.

4. Data Retention

Account Data: Retained for as long as your account is active, plus 7 years after account closure to comply with financial record-keeping regulations.
Transaction Records: Retained for 7 years as required by federal financial regulations.
Receipt Images: Processed in real-time and deleted immediately after text extraction is complete. We retain only the extracted text data (item names, prices, split assignments).
Usage Analytics: Retained in aggregated, anonymized form indefinitely. Individual-level usage data is retained for 2 years.
Communications: Support conversations are retained for 3 years after resolution.

5. Data Security

We implement industry-standard security measures to protect your information:

Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
Authentication: Biometric authentication (Face ID / Touch ID) and secure token-based session management.
Access Controls: Strict role-based access controls limit employee access to user data.
Monitoring: Real-time fraud detection and anomaly monitoring on all transactions.
Secure Storage: Sensitive credentials are stored using platform-native secure enclaves (iOS Keychain).

No method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

6. Your Rights and Choices

6.1 Access and Portability

You may request a copy of your personal data at any time through the App (Profile → Privacy → Download My Data) or by emailing support@hydracash.app.

6.2 Correction

You may update your account information at any time through the App settings.

6.3 Deletion

You may request deletion of your account and associated data by contacting support@hydracash.app. Please note:

We are legally required to retain certain financial records for 7 years.
Deletion requests are processed within 30 days.
Some anonymized, aggregated data may be retained for analytics.

6.4 Opt-Out of Marketing

You may opt out of promotional communications at any time through App settings or by following the unsubscribe instructions in any marketing message.

6.5 Push Notifications

You may disable push notifications through your device settings at any time.

7. California Privacy Rights (CCPA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA):

Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, our business purposes for collecting it, and the categories of third parties with whom we share it.
Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
Right to Opt-Out of Sale: We do not sell your personal information. If this changes, we will provide a "Do Not Sell My Personal Information" link.
Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise your CCPA rights, contact us at support@hydracash.app or through the App's privacy settings. We will verify your identity before processing any request.

8. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):

Legal Basis: We process your data based on contractual necessity (to provide our services), legitimate interests (fraud prevention, security), legal obligations (financial regulations), and your consent (marketing communications).
Additional Rights: Right to restriction of processing, right to object to processing, and right to data portability.
Data Transfers: Your data is processed in the United States. We rely on Standard Contractual Clauses for international data transfers.

Note: HydraCash is currently available only in the United States. If we expand internationally, this section will be updated with region-specific details.

9. Children's Privacy

HydraCash is not intended for users under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will promptly delete that information. If you believe a child has provided us with personal information, please contact us at support@hydracash.app.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

Update the "Last Updated" date at the top of this page.
Notify you through the App via push notification or in-app banner.
For significant changes, require you to review and acknowledge the updated policy.

Your continued use of HydraCash after changes are posted constitutes acceptance of the updated Privacy Policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: support@hydracash.app
Privacy-specific inquiries: privacy@hydracash.app
Mailing Address: HydraCash, Philadelphia, PA, United States

We aim to respond to all privacy inquiries within 30 days.