Your workspace stays yours.

Browser boards are stored in local browser storage, together with a few interface preferences. Desktop boards are stored in a local SQLite database. Manual portfolio amounts stay on your device, and Cashboard builds no advertising profile. Optional B Cash access uses an account and a linked lifetime license, without cloud board sync. Cashboard's servers keep purchase records for lifetime access, described under Payments.

The web build uses Vercel Web Analytics to count page views. The script runs from cashboard.live and sends the address of the page you open, and the site you came from when you arrive from another site. A share link keeps the board layout after the # in its address, so opening one on the web build reports that address, layout included. The desktop app has no analytics.

Widgets contact the named market-data providers to load quotes, public portfolio balances and market information. A provider sees the request your device makes, including your IP address.

On the web build several lookups pass through Cashboard's own servers on cashboard.live first: market quotes and candles (/api/market-quotes and /api/market-candles), stock quotes (/api/stocks), watch-only EVM portfolios (/api/evm-portfolio), Solana RPC reads (/api/solana-rpc) and a fixed list of public feeds whose providers do not allow browser requests (/api/public-feed). A public wallet address you add to a Portfolio widget, or follow in Smart money on Solana, therefore reaches Cashboard's servers as well as the provider that reads it. Other lookups go straight from your browser to the provider, for example Hyperliquid accounts and Smart money on Base and Ethereum. The desktop app calls providers from the app itself and does not use these relays.

The Jupiter swap widget loads a script from plugin.jup.ag into the page, and Jupiter's own services handle the swap form. Token logos and event images load from third-party image hosts, which see your IP address as any site serving an image does.

Customer account activation is unavailable until the WorkOS sign-in service and AI backend are configured and verified. When you sign in, WorkOS and Cashboard process your account email and session identifiers; Cashboard checks a signed token, verified email and active session. WorkOS handles the configured sign-in, passkey and email-recovery methods. Account requests also carry network information such as your IP address to the hosting and identity providers.

Web sign-in sets a Secure, HttpOnly, SameSite=Lax refresh cookie. The refresh credential is not returned in JSON or saved in local storage. Desktop keeps credentials behind its private bridge and can remember a refresh credential only with operating-system encryption. Sign out clears local access and requests provider-session revocation; a provider outage can prevent immediate server revocation.

Link lifetime purchase is an explicit, permanent association of one license with one verified account. The server keeps the license identifier and a hash of the account subject in both directions, with no expiry. Older checkout records contain no account identity: the first link proves possession of the private CB1 recovery code. Keep it private, verify the displayed email before linking, and contact support about a disputed link. After linking, that account can restore access elsewhere without CB1; the code cannot bypass account authentication for AI.

AI sessions last at most one hour; the server stores token hashes and session metadata. Bounded model-attempt timestamps are retained per license for the rolling 24-hour and 30-day allowances, 20 and 300 attempts by default, shared across devices. Local watching uses no model credit. Provider failures and timeouts can consume an attempt. Clearing device storage or signing out does not remove the permanent purchase/account binding or reset usage.

Build board sends your message through Cashboard and Vercel AI Gateway to OpenAI GPT-6 Luna. Analyze board also sends a bounded snapshot of fresh public readings and selected recent signals. Wallet and account addresses, manual balances, notes, raw widget settings, chat history and authentication credentials are not attached to model input. Anything you type in the message is sent, so omit private details and credentials. Provider keys remain on the server. Conversation and watch history stay on the device; signing in does not restore them. Watching stops when Cashboard closes or the device sleeps.

Hosting, WorkOS, Gateway and model-provider logging and retention depend on their policies and configuration. This page does not promise zero data retention. Contact contact@cashboard.live about account or purchase-data requests. See Board Agent and Privacy and data for the scope and limits.

Checkout does not ask for a name or an email address. It sends the public wallet address you pay from to Cashboard's servers, together with the route and the terms version you accept.

• Routes: USDC on Base, ETH on Base, USDG on Robinhood Chain and SOL on Solana. The USDC contract on Base is 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 and the USDG contract on Robinhood Chain is 0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168. Checkout shows the recipient address, network, asset and exact amount with your request.
• Confirmation rules: EVM payments need 12 confirmations as of October 2026 and a block at or below the chain's finalized block. Solana payments need the finalized commitment. A transaction can be used for one purchase only.
• Stored for a request: a request id, a random buyer id made in your browser, the route, the paying wallet address you entered, the exact amount, the creation and expiry times, the terms version you accepted and when, and for ETH and SOL the price quote used. After you submit a transaction the server also keeps its id and what the chain showed: sender, recipient, amount, confirmations and finality.
• The recovery code is built from the request id and a secret claim token. The server keeps only a SHA-256 hash of that token, so the code stays with you. Your browser also keeps the request and recovery data so the checkout page can resume.
• When a purchase is confirmed the server stores an access record that links the buyer id, the request and the transaction. A download link is marked as used the first time it is opened, which is how it works once.
• Retention: requests that are never paid are kept for a limited period, 90 days by default. Records of confirmed purchases have no expiry date, so the recovery code keeps working.
• Abuse limits: checkout endpoints count requests per IP address, and those counters expire after 10 minutes (600 seconds).

You can remove local boards, clear site storage or uninstall the desktop application. Uninstalling does not delete the desktop board data. Export boards before clearing data if you want a portable backup. The Export this board command removes nothing, so its file includes addresses and manual holdings.

A share link carries the board layout in the part of the address after the #. Sharing first removes Portfolio and Perps addresses, manual holdings, Paper trading positions and followed wallets in Smart money and Money graph. It does not remove notes, widget titles, the Swap fees referral account, Web app addresses or widget alert rules, so review a board before you share it. Agent settings and activity are excluded. Library exports also remove the referral account and exclude note and frame text by default. See Templates and sharing and Privacy and data.