Privacy and data handling

Cashboard is local-first. The web app at cashboard.live and Cashboard Desktop keep boards on your own device. Optional B Cash access works without sign-in during an open access window, and otherwise through a one-hour trial or a lifetime license after sign-in; it does not upload or synchronise boards. Widgets still ask providers for live data. The list gives the summary and the sections after it give the detail.

Everything in the table stays on the device you use. Cashboard holds no server copy of your boards, so a lost browser profile or a deleted data folder loses them unless you exported a file first.

When a browser blocks local storage, a board survives only in the open tab. Cashboard shows the warning Browser storage is unavailable. Changes will last only in this tab; export the board from Commands before closing it.

Account sign-in, when configured, processes your verified email and account/session identifiers through WorkOS and Cashboard. The server stores a hashed account-to-license binding and bounded AI usage metadata, described below. This does not add board sync or general desktop usage analytics.

No part of Cashboard asks for a seed phrase or a private key. Watch-only widgets ask for a public address, and that is all they take.

• The address box in Perps positions deletes text that looks like a private key or a recovery phrase and says Removed: that looked like a private key or seed phrase. This widget only needs a public address.
• The desktop Connections tab takes provider credentials only: a CoinGecko Demo key, a Blockscout URL and key, a Coinbase RPC URL and a Dune key. It warns Only provider credentials belong here. Never enter a seed phrase, wallet private key, or exchange trading secret.
• The Portfolio button Connect browser wallet · account access only (or Connect Solana wallet · account access only) appears when your browser has a wallet extension. It asks the wallet for your public address and, on EVM networks, the current network. It requests no signature and no transaction.
• Checkout asks for the public address you will pay from. It does not connect to your wallet.
• Cashboard has no field for broker or exchange credentials.

Saved connections stay out of the window

On desktop, the window that shows your boards never receives a saved key back. After you press Save, the main process, the part of the app that runs outside the window, encrypts the value with your operating system's secure storage. The window learns only whether a connection is set up and whether its value was saved or came from the environment. The field empties and the value is not shown again. Test and every data request run in the main process with the stored value. When the system offers no secure storage, or only basic text storage, Save is refused and nothing is written in readable form.

A connection value is sent only to the provider it belongs to and never to cashboard.live. One case to know: Smart money reads Base, Ethereum and Robinhood Chain through api.blockscout.com whenever a Blockscout key is set up, so that key goes there whichever Blockscout URL you saved. A share link and an exported file do not carry connections, because they are not part of a board. See Connections.

Agents and MCP servers on desktop

Both MCP features are off until you switch them on. The Agents (MCP) server listens on 127.0.0.1 only and lets a program on your computer, such as Claude Desktop, read your boards after you approve it. Public data covers the board layout, alerts and public market readings, with no addresses, note text or web addresses. Read private board data adds those, and they then travel to whatever model that agent uses, which Cashboard does not control. Cashboard sends none of this anywhere itself. A server you add under MCP servers receives only the tool name and the arguments you saved in its widget, and what it returns is shown as text and never sent to B Cash or any model. A local command server runs on your computer with your user rights. Share links and templates remove the server binding. See Agents and MCP servers.

Signing and moving funds

Cashboard's own code never builds, signs or sends a transaction, and no widget holds your funds. On the web, two swap forms that come from other projects can ask your wallet for a signature: Jupiter's on Solana and LI.FI's on Base and Robinhood Chain. Your wallet signs only after you review and confirm the route and any token approval. See the Jupiter plugin, the LI.FI form and Trading.

A widget that shows live data has to ask a provider for it, and the provider sees that request, including your IP address. What differs between the builds is the route. On the web your browser makes the requests, and some of them pass through relays on cashboard.live, which is served by Vercel. On desktop the app's main process makes them directly, and no relay is involved.

What each input reaches

The relays hold no database of lookups: they pass a request on and return the answer. Cashboard does not document how long its hosting platform keeps request logs, and an EVM lookup carries the address in the request URL. The answer to an EVM lookup is marked as cacheable by shared caches for 45 seconds, with a stale copy allowed for up to 120 seconds more while it refreshes. Portfolios and wallets covers the watch-only widgets in more detail.

Besides those relays, the web build passes a fixed list of public feeds through cashboard.live because their providers do not allow requests from a browser, for example Kalshi, Aster, pump.fun and Yahoo Finance charts. Every other provider is asked straight from your browser. Data sources names the provider behind each widget.

Live streams and images, on both builds

• Live prices, trades, liquidations and new launches arrive over WebSocket connections that your browser, or the app window, opens straight to the provider: Binance, Hyperliquid, Lighter, Bybit, OKX, PumpPortal and PublicNode. They name the markets you follow and carry your IP address. They do not carry wallet addresses.
• Token logos and event images load straight from a fixed list of image hosts, among them CoinGecko, GeckoTerminal, DexScreener, IPFS gateways, X profile images, Robinhood, Coinbase, DuckFacts and the DuckDuckGo favicon service. Each host sees your IP address and which image you asked for, as any site serving an image does. An image from any other host is not loaded, and the widget shows a monogram instead.

On desktop

• The app's main process makes market-data provider requests; the window opens live streams and images. Account sign-in and opted-in B Cash planning or analysis use Cashboard's server, as described below. Market-data reads do not use the web build's portfolio relays.
• An installed buyer build sends no crash report and no usage data, and by default it does not check for updates. Its update panel offers Open secure download page, where you fetch a newer installer with your recovery code. See Desktop.
• A Web app widget, added with Custom app, loads the site you type, and that site receives what any browser sends it, your IP address included. Each widget has its own isolated session. The app denies every permission request from these sites, such as camera, microphone, notifications and location, and it cancels downloads. See Board tools.

The web build counts page views with Vercel Web Analytics. The script loads from cashboard.live itself, on the landing page and in the dashboard. For each page view it reports the page address and, when you arrive from another site, that site. The documentation, guide and legal pages load no analytics script. The desktop app has none either.

The page address can include the part after #. That is where a share link keeps its board, so when a share link opens on the web build, the script sends the full address, board included, to Vercel's analytics endpoint on cashboard.live. Treat a share link as public. Templates and sharing explains what a link holds.

Checkout sits on the landing page, so its page views are counted too. Checkout keeps your recovery code and your wallet address out of the page address.

Cashboard builds no advertising profile. Optional B Cash sign-in has its own account session and refresh cookie; those are separate from page-view analytics.

B Cash access comes three ways: a time-limited open access window without sign-in, a one-hour trial after WorkOS account sign-in, or a linked lifetime license. See Board Agent.

Open access needs no account. The browser or desktop app keeps a random device id on this device (in local storage on the web, in the app data folder on desktop) and sends it to start a session. The server stores a hash of that id, a hash of your IP address and the times of your AI requests for 24 hours, to enforce the 10-request daily limit and the caps per network and in total. Open-access sessions last at most one hour and end with the window.

WorkOS processes account email and session information for sign-in, configured passkeys and email recovery. Cashboard verifies the signed token, verified email and active session before granting customer AI access. WorkOS and hosting services receive network metadata such as IP addresses for these requests. Their logging and retention depend on their policies and configuration; this page does not promise a deletion schedule for their records.

On the web, the refresh credential is held in a Secure, HttpOnly, SameSite=Lax cookie and is not returned in JSON or placed in local storage. Account access credentials stay behind the API bridge in session memory. Desktop can remember a refresh credential only through operating-system encryption; without secure storage it supports the current session. Sign out clears local access and requests revocation of the verified provider session; an unavailable provider can prevent immediate server revocation.

The first explicit Link lifetime purchase action uses your private CB1 recovery code to permanently associate one license with one verified account. The server stores a hash of the stable account subject and the license identifier in both directions, with no expiry. The old checkout contains no account identity: this first association proves possession of CB1. Subsequent account-only restoration requires the same account, not the code. There is no receipt-only bypass for an already-linked license or automatic reassignment.

Server-issued AI sessions last at most one hour. The server stores token hashes and session metadata, not raw recovery codes or session tokens. A per-license ledger retains bounded model-attempt timestamps across devices for the rolling 24-hour and 30-day allowances (20 and 300 attempts by default). Disconnecting or renewing a session does not reset it. The account binding and confirmed purchase remain so lifetime access can be restored; clearing your device does not remove those server records. Contact support for an account or purchase-data request.

In Cashboard Desktop you can plan with your own Anthropic or OpenAI key instead. The key is encrypted with operating-system storage and stays in the main process. The request goes from your computer straight to that provider with the same message, inventory and snapshot rules as Luna, and their terms and retention apply. The web build cannot hold these keys. See Connections.

The morning brief is computed on your device. When you leave a board, a visit record of up to 60 public readings, alert states, connection states and widget ids is kept in local storage, at most 16 KB per board and 50 boards. The brief compares it with the current readings and writes a note on the board; neither the record nor the brief is sent anywhere. The id of the brief note is also kept in local storage.

Conversation and observed watch history stay in local storage per board on both builds; watch settings belong to the board. The Library keeps layouts and widget presets in a separate local storage entry. Clearing site data or the desktop profile removes those local records. Signing in restores access only, with no cloud copy of boards, conversations or the library.

Local planning and watch commands send no prompt to a model provider. Build board with Luna sends your message and a board inventory to the Cashboard server, through Vercel AI Gateway and to OpenAI GPT-6 Luna. The inventory lists up to 200 widgets by type, title, frame and public subject, such as a CoinGecko asset id or a chain, and the links between them. It never includes positions on the canvas, wallet or account addresses, balances, note text, URLs or alert settings beyond the asset, so notes B Cash writes are never sent back to a model. On a board with fresh readings, Build also sends the same bounded snapshot of public readings that Analyze uses. Analyze board sends bounded fresh public readings and selected recent signals with source references. Both exclude wallet/account addresses, manual balances, notes, raw widget settings and chat history. Anything you type in the message is sent, so omit private details and credentials. Authentication headers are verified by Cashboard and are not model input. Gateway keys stay on the server, and the private administrator access token is never a customer credential.

Share links and library layouts include no agent settings, conversation or watch history. A full board export includes watch settings but not the separate conversation, watch history or saved library. Library saving and importing also removes followed wallets and the referral account, and clears note and frame-label text unless you enable its text option. Titles, URLs and event sources remain. See Library.

Local monitoring requests the public data needed by configured widgets, including watched public addresses. Those provider reads are separate from model inputs. Running outside canvas rendering changes when a request happens, not which provider receives an address. Board Agent lists its limits and explains why watching stops when the app closes or the device sleeps. No overnight worker or closed-app push service is included.

The Jupiter swap widget on the web build embeds Jupiter's own swap plugin. It is third-party code: a script that loads from plugin.jup.ag into the page, not a feature that Cashboard wrote.

• When it loads: when a Jupiter swap widget is drawn on the canvas. That includes one added by a Buy button and the one in the Trade Desk template. The canvas draws only the widgets in view, so a swap widget far off screen waits until you pan to it. A board you open from a share link can hold one too, and its review screen lists the widget types before you add it.
• What it is: a script inside the page, not a separate frame, so it runs with the page's own access. Cashboard hands it the token pair to show and any fee settings, and does not pass it your board. Cashboard does not publish what the script stores or sends.
• What bounds it: the page's security policy admits scripts only from cashboard.live and plugin.jup.ag, plus one fixed start-up script. The same policy lets the page reach Jupiter's API hosts, Google Fonts and the image proxy wsrv.nl.
• What it saves: Cashboard gives it a storage prefix, so whatever it keeps in your browser's local storage sits under that prefix. Cashboard does not document what that is.
• Who signs: your wallet extension signs the swap inside Jupiter's form, after Jupiter shows its routing and fees. Cashboard's own code never builds, signs or sends the transaction. See Trading.
• On desktop it does not run. The widget shows Swaps run in your browser with an Open on Jupiter button, and Buy buttons open jup.ag in your system browser. The Limit and DCA links in the widget header open jup.ag with the token pair in the address, on both builds, only when you click them.

To keep the script off a board, do not add the widget, or remove it and reload the page. On the web a Buy button adds a Jupiter swap widget when the board has none, and a script that has loaded stays in the page until you reload.

An EVM swap widget (Swap under Base or Robinhood in the Add panel) shows LI.FI's form on the web. The form ships inside the web build, but it is LI.FI's code. It asks LI.FI's API for routes, tokens and prices and connects to an EVM wallet that your browser exposes. WalletConnect is available only when the site was built with its project id. Connecting shares your public address with the form; executing a route needs your own wallet confirmation and can need token approvals. Cashboard does not document every request the form makes once a wallet is connected.

The widget passes the chosen chain, the token pair and any configured integrator fee to the form, not your board. The form and your connected wallet handle the swap, so review the network, token address, approval, amount and fees before you sign. A Buy button in Smart money graph, in another token list or in a shared board can preload a token, but it never submits a trade. When the site is built with a Base builder code, swaps on Base carry that public Cashboard code (ERC-8021) at the end of the transaction data, so anyone can see on the chain that the swap came through Cashboard.

The desktop build does not run this form. The widget shows Swaps run in your browser with an Open on Jumper button, and Buy buttons for Base or Robinhood Chain tokens open Jumper in your system browser. The wallet connection, the signature and the swap then happen on that site. Read EVM swap and Trading.

A Web app widget on the web build shows a page inside the board only when its address is on a short fixed list: DuckFacts widgets (DuckFacts is the Cashboard partner), and from independent sites DefiLlama chart pages, Dune embeds, L2BEAT project pages, TradingView embed widgets, GeckoTerminal pool pages, Hyperscan, HypurrScan and Validator Queue. The Web app entry lists what each card opens. The pages are their owners' own code, shown read-only in a sandboxed frame. Cashboard does not proxy them and cannot read what they show.

• When it loads: when a Web app widget with a listed address is drawn on the canvas, up to 3 at a time, and only while the board is zoomed to 60% or more. A board you open from a share link can hold one, so its review screen lists every web address before you add it. An address that is not on the list stays a card that opens in a new tab.
• What bounds it: the page's security policy lets it frame only those hosts. The frame can run its own scripts and open links in a new tab, and it cannot navigate Cashboard, submit forms, open dialogs, save files or use the camera, microphone or location.
• What the site sees: your browser contacts the site's server directly, so it sees your IP address and your browser as it would on any visit, and the page address https://cashboard.live as the referrer. It receives no part of your board.
• What it saves: the embedded page can keep its own cookies or local storage under its own site, subject to your browser's third-party storage rules. Cashboard saves nothing for it. To stop the requests, remove the widget or change its address.
• Desktop: the same presets open in the widget's isolated browser session instead, which the Embedded sites row in the table above describes.

A share link and an exported file are the two ways a board leaves your device on purpose. Neither is private by default.

• A share link holds the board itself in the part of the address after #. Cashboard runs no share service. Building the link removes the address and manual holdings of Portfolio widgets, the address of Perps positions widgets, the positions, history and realised profit of Paper trading, and the wallets followed in Smart money or Smart money graph (the Add panel lists the second as Money graph).
• A link keeps the Swap fees account, notes, widget titles, the board name, Web app addresses, the dates and source addresses in Market events, and alert rules.
• Export this board strips nothing. The file holds every address, holding and note as readable text, so keep it to yourself.
• Saved connections travel in neither, because they are not part of a board.

The full list of what a link removes and keeps, and what the person who opens it sees, is in Templates and sharing. Opening a link on the web build is also a page view, as described under Page views.

Lifetime access for the desktop app is bought on cashboard.live. Checkout asks for no name and no email address. Its functions on cashboard.live write the records below to a hosted database so that your payment can be verified and your download restored.

Who else is involved

• To check your payment, the server asks a chain RPC provider about your transaction. For the ETH and SOL routes it asks CoinGecko for a price, with Binance as the fallback.
• To deliver the installer, the server redirects your browser to a temporary address on GitHub's release-asset hosts (githubusercontent.com), and your browser downloads the file from there.
• Blockchain transfers are public. The paying address, the recipient and the amount are visible on a block explorer whatever Cashboard stores.

Checkout links the Privacy, Terms and Refunds pages and asks you to accept them. The buyer's view of the flow is in Lifetime access. Questions about a purchase go to contact@cashboard.live.

What removing data means depends on the build. If you want to keep a board, export it first: press Ctrl K on Windows or Cmd K on macOS and run Export this board.

On the web

1. 1

   Remove a widget

   Select it and press Delete or Backspace, or use the bin icon Remove in its title bar. Its settings, such as an address or holdings, leave the board, and the autosave writes that about half a second later. There is no confirmation, and Undo brings the widget back while the page or app stays open.

2. 2

   Delete a board

   Open the Boards tab, point at the board and select the bin icon Delete board. Cashboard asks Delete “<name>”? This cannot be undone. The last remaining board cannot be deleted, and its bin icon does not appear.

3. 3

   Clear everything

   In your browser's settings, clear the site data for cashboard.live. That removes every board, the interface choices, the workstation library, any agent history, the checkout buyer id and recovery details, and anything Jupiter's script or the LI.FI form saved.

• A private window normally discards its storage when it closes, so a board made there disappears with it.
• Files you exported and links you sent are outside Cashboard's reach. Delete the files yourself. A link cannot be taken back.
• The checkout page has no control that deletes purchase records from the checkout database. For a question about them, write to contact@cashboard.live and read the Privacy page.

On desktop

1. 1

   Remove a widget or a board

   Use the same controls as on the web. Removing a Web app widget, or deleting a board that holds one, also erases that site's cookies, local storage, caches and logins, and Undo cannot restore them. Quitting the app does not clear them.

2. 2

   Clear a connection

   In the Connections tab, select the bin icon Clear saved credentials on the card. The saved value is deleted from this computer and the card shows Saved credentials cleared. A value that comes from the environment stays, under the badge Preconfigured. Clearing does not revoke the key at its provider, so rotate or revoke it there if it may have leaked.

3. 3

   Know what uninstalling keeps

   Uninstalling the app keeps its data folder. Your boards, saved connections and embedded site sessions stay on disk.

4. 4

   Delete the data folder

   To remove everything, quit Cashboard and delete the app's data folder yourself. The app has no menu entry that opens it and no reset command. It sits in the application data location of your user profile (%APPDATA% on Windows, ~/Library/Application Support on macOS), in a folder named after the app. Look for the folder that holds cashboard.sqlite. Desktop has more on the data folder.

Before you hand a computer on, clear each saved connection first and then delete the data folder.

Some parts of the picture belong to other parties, and Cashboard does not document them.

• What Vercel, which hosts cashboard.live, keeps from request logs and page-view reports, and for how long. Vercel's pages linked above and Cashboard's Privacy page are the places to look.
• What each data provider keeps. Each provider's own policy applies to the requests your device, or a relay, makes to it.
• What Jupiter's plugin and LI.FI's form store or send, including anything that travels through WalletConnect when the site is built with it.
• The production retention setting for unpaid checkout requests. The default is 90 days.