The short version
- We make money from subscriptions, not advertising. We do not sell your data, show you ads, or track you across other apps or websites.
- Your bank credentials go directly to Plaid — we never see or store them.
- Your financial data is not used to train AI models.
- Sensitive fields are encrypted at rest, and everything is encrypted in transit.
- You can delete your account at any time from Settings, and your data goes with it.
1. Introduction
GenWealth Technology LLC ("Cypress", "we", "us") operates the Cypress mobile application, a personal financial management tool that lets you connect bank accounts, track transactions and budgets, monitor investments, and ask questions of an AI assistant about your finances.
This policy explains what we collect, why, who we share it with, and what control you have. It applies to the Cypress app and cypressmoney.com.
2. Information we collect
Information you give us
- Account information — your email address and password. We do not ask for or store your name.
- Financial content you create — budgets, categories, categorization rules, manually entered accounts and balances, notes, and similar records.
- AI assistant conversations — the messages you send to the in-app assistant, together with the financial context needed to answer them.
Information from your linked financial institutions
If you connect a bank or brokerage account, we receive data through Plaid Inc., including account names and types, balances, transaction history (amounts, dates, merchants, and descriptions), and investment holdings and securities. We do not request or receive identity information — such as your phone number or mailing address — from your financial institution.
We never receive or store your bank login credentials. You enter those directly with Plaid, which passes us only an access token. Plaid's handling of your data is described in its End User Privacy Policy.
Information collected automatically
- Device and diagnostic data — app version, operating system, device model, and crash reports and performance traces.
- Installation identifier — a random identifier generated on first launch, used to group crash reports from the same installation. It is not your account ID and is not shared with advertisers.
- Purchase data — subscription status, purchase and renewal events, and the identifiers needed to validate them.
- Approximate location — if you choose to sign in with Google, Google's sign-in SDK may derive an approximate, city-level location from your network address as part of authenticating you and securing your Google account. The app never requests access to your device's location.
What we do not collect
We never ask for access to your device's location services, contacts, photos, microphone, or health data. We do not use advertising identifiers, we do not use cookies or similar technologies for advertising, and we do not build advertising profiles.
3. How we use your information
- To provide the service — displaying accounts, syncing transactions, calculating budgets and net worth, and generating charts.
- To answer your questions through the AI assistant.
- To authenticate you and keep your account secure, including optional Face ID or Touch ID sign-in.
- To process and manage subscriptions.
- To diagnose crashes, fix bugs, and improve reliability and performance.
- To communicate with you about your account, security, and material changes to the service.
- To comply with legal obligations and enforce our Terms of Service.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use your financial data to train third-party AI models.
We do not make automated decisions about you that have legal or similarly significant effects. The AI assistant answers the questions you ask it; no algorithm decides your eligibility for anything or affects your account standing.
4. Service providers we share data with
We share personal information only with service providers that help us operate the service, each bound by contract to use it solely for that purpose. The categories of providers, and what each receives, are:
| Provider | What they receive | Why |
|---|---|---|
| Plaid Inc. | Bank credentials you enter directly with them; account, transaction, and holding data | Connecting and syncing your financial accounts |
| Our AI model provider | Your AI assistant messages and the financial context needed to answer them | Powering the in-app AI assistant |
| Our subscription management provider | Subscription and purchase events, app user identifier | Managing subscriptions and entitlements |
| Our error monitoring provider | Crash reports, diagnostics, installation identifier | Error monitoring and stability |
| Google LLC | If you use Google sign-in: name, email address, account and device identifiers, approximate location derived from your network address, and sign-in usage data | Authentication |
| Apple Inc. | If you use Sign in with Apple: your email address, or a private relay address if you choose to hide it. We do not request your name. | Authentication |
| Our cloud hosting providers | Hosting and storage of application data, in the United States | Running our backend and database |
| Our app update service | App version and installation identifier | Delivering app updates |
We may also disclose information when required by law, valid legal process, or to protect the rights, safety, and property of our users or ourselves; and in connection with a merger, acquisition, or sale of assets, in which case we will notify you before your information becomes subject to a different policy.
5. How we protect your information
All traffic between the app and our servers is encrypted in transit using TLS. Sensitive personal fields are encrypted at rest in our database, and searchable encrypted fields use a blind index so we can look them up without decrypting them. Your session token is stored in the iOS Keychain. Access to production systems is restricted to personnel who need it.
No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you as required by applicable law.
6. Data retention
We keep your personal information for as long as your account is active. If you delete your account, we delete or de-identify your personal information within 90 days, except where we must retain records to comply with legal, tax, or accounting obligations, or to resolve disputes. If your account becomes inactive — you stop using the app but do not delete your account — we retain your information for up to 24 months after your last activity or the end of your subscription, whichever is later, and then delete or de-identify it. Crash diagnostics are retained on a rolling basis, typically 90 days.
You can disconnect a linked financial institution at any time from within the app, which revokes our access to that institution going forward.
7. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal information, to withdraw consent, and to appeal a refusal. Residents of California, Colorado, Connecticut, Virginia, and similar jurisdictions have these rights under state privacy law; residents of the EEA and UK have them under the GDPR.
You can update most profile information in the app directly, and delete your account from Settings. For any other request, contact us at privacy@cypressmoney.com. We will not discriminate against you for exercising these rights — we will not deny you service, charge you a different price, or give you a lower quality of service because you exercised them.
8. California privacy rights (CCPA/CPRA)
This section supplements the rest of this policy and applies only to California residents. Terms such as “personal information,” “sell,” “share,” and “sensitive personal information” have the meanings given to them in the California Consumer Privacy Act as amended by the California Privacy Rights Act.
Categories of personal information we collect
Over the past twelve months we have collected the following statutory categories:
| Category | Collected | What this means for Cypress |
|---|---|---|
| A. Identifiers | Yes | Email address, account identifier, and a device installation identifier used to group crash reports. We do not collect your name or a username |
| B. California Customer Records (Cal. Civ. Code § 1798.80(e)) | Yes | Email address and financial information from your linked accounts |
| C. Protected classification characteristics | No | We do not collect age, race, gender, religion, or similar characteristics |
| D. Commercial information | Yes | Your subscription and purchase history |
| E. Biometric information | No | Face ID and Touch ID are performed entirely by your device. We receive only a success or failure result — never your fingerprint or face data |
| F. Internet or other network activity | Yes | How you interact with the app, plus crash and performance diagnostics. We do not collect browsing or search history |
| G. Geolocation data | Yes | Approximate, city-level location only, derived from your network address by Google's sign-in service. We never request access to your device's location |
| H. Sensory data | No | No audio, video, or similar data |
| I. Professional or employment information | No | |
| J. Non-public education information | No | |
| K. Inferences drawn to create a profile | No | We do not build behavioral or advertising profiles about you |
| L. Sensitive personal information | Yes | Your account credentials and your financial account information — see below |
We obtain this information directly from you, automatically from your use of the app, and from the service providers listed in section 4 — principally your financial institution by way of Plaid.
We do not sell or share your personal information
We have not sold or shared any category of personal information in the preceding twelve months, and we do not do so today. We do not disclose personal information in exchange for money or other valuable consideration, and we do not share it for cross-context behavioral advertising. Because we do not sell or share, there is nothing for you to opt out of — but if that ever changes, we will update this policy and provide an opt-out before the change takes effect. We also do not sell or share the personal information of anyone we know to be under 16.
We do disclose personal information to service providers for business purposes, as described in section 4. Each of them is bound by contract to use it only to perform services for us.
Sensitive personal information
We collect two kinds of information California classifies as sensitive: your account log-in credentials, and information about your financial accounts. We use both only to provide the service you asked for — authenticating you, and displaying and analyzing your own financial data. We do not use or disclose sensitive personal information to infer characteristics about you. Because our use is limited to what is reasonably necessary to deliver the service, the right to limit its use and disclosure does not apply; if that changes, we will offer that right here.
Your California rights
- Right to know. Request the categories and specific pieces of personal information we collected, the sources, our purposes, and the categories of third parties we disclosed it to.
- Right to delete. Request deletion, subject to the exceptions the statute allows — for example where we must keep records to complete a transaction, detect security incidents, or comply with a legal obligation.
- Right to correct. Request correction of inaccurate personal information.
- Right to opt out of sale or sharing. Available in principle; as stated above, we do not sell or share.
- Right to limit sensitive personal information. Available in principle; as stated above, our use is limited to providing the service.
- Right to non-discrimination for exercising any of these rights.
How to exercise your rights
Email privacy@cypressmoney.com. You may also use an authorized agent registered with the California Secretary of State, provided they supply written proof of authorization.
So that we do not disclose your financial information to the wrong person, we will ask you to verify your identity — ordinarily by confirming control of the email address on your account. We cannot fulfill a request we are unable to verify. We respond within 45 days, and may extend once by a further 45 days where reasonably necessary, with notice to you. Requests to know cover the 12 months preceding the request. Portable copies are provided in a readily usable, machine-readable format.
Shine the Light
California Civil Code § 1798.83 lets residents request details of personal information disclosed to third parties for those third parties' own direct marketing. We do not make such disclosures. You may confirm this by writing to privacy@cypressmoney.com.
Do Not Track
Cypress is a mobile application. It does not use cookies, does not track you across other apps or websites, and therefore has no Do Not Track behavior to disclose.
Removal of content posted by minors
California Business and Professions Code § 22581 gives registered users under 18 the right to request removal of content they posted publicly. Cypress has no public posting areas, so this right has nothing to operate on. All content you create is private to your account and you may delete it, or your whole account, at any time.
9. Children's privacy
Cypress is intended for adults. You must be at least 18 to create an account, consistent with our Terms of Service, and we do not knowingly collect personal information from anyone under 18. We especially do not knowingly collect personal information from children under 13, as defined by the Children's Online Privacy Protection Act. If you believe a minor has provided us information, contact privacy@cypressmoney.com and we will delete it.
10. International users
We operate in the United States, and your information is processed and stored there. If you access Cypress from outside the United States, you understand your information will be transferred to the United States, where privacy laws may differ from those in your country.
11. Changes to this policy
We may update this policy from time to time. We will post the revised version here with a new effective date, and for material changes we will notify you in the app or by email before they take effect.
12. Contact us
Questions or privacy requests: privacy@cypressmoney.com
GenWealth Technology LLC
7901 4th St N, Ste 300
St. Petersburg, FL 33702
United States