Privacy Policy · Kashfetti

1. Who we are

Kashfetti is operated by Crooks Group LLC, a Florida limited liability company (Florida Department of State filing number L25000437910, formed September 22, 2025) with its principal office at 66 West Flagler Street, Floor 9, Miami, Florida 33130. This Privacy Policy describes what personal information Kashfetti collects, how we use it, who we share it with, and how you can exercise your privacy rights.

2. What we collect

Kashfetti collects the following categories of personal information:

Account information: email address, first and last name, phone number (optional at signup, required for SMS notifications).
Claim submission data: mailing address, prior addresses (for unclaimed property searches), flight itineraries (for airline delay claims), and other information you choose to save to help you fill in a specific claim form yourself.
Identity verification uploads: Kashfetti does not ask for or store photos of your government-issued ID. If a claim needs your ID, you give it directly to the official claim website.
Proof documents: Kashfetti does not collect receipts, boarding passes, or other proof of eligibility for a claim. If a claim needs proof, you give it directly to the official claim website. (Proof of a payout you received is covered under “Payments you report” below.)
Payment information: credit card details are collected and processed by Stripe, our payment processor. Kashfetti never sees or stores full card numbers.
Case tracking data: status of each claim you file, dates of submission and response, and payout amounts you self-report.
Communication logs: emails, SMS messages, and push notifications sent to you, and messages you forward to Kashfetti-provided phone numbers for evidence collection related to Telephone Consumer Protection Act matters (paid Pro subscribers only).
Device and usage data: device type, operating system, application version, feature usage, and diagnostic information collected via PostHog and Sentry.
Notifications (if you allow them): a push notification address for your phone that Expo, Apple, or Google gives the app, which device type it belongs to, and your notification settings (on or off, quiet hours, time zone, which kinds of updates you muted, whether the “new in your state” email is on, and, for Kashfetti Pro members, whether instant alerts may come as a notification and as an email, whether deadline reminders for saved settlements are on, and whether you asked for them by email instead). Notification text is kept short and never includes claim details or document contents.
Consent records: timestamps, IP addresses, user agent strings, and version identifiers for every consent you give - Terms of Service acceptance, privacy policy acceptance, SMS opt-in (current version identifier "sms-v1-2026-09-22", recorded with the exact consent text shown), subscription auto-renewal acknowledgment, arbitration acknowledgment, and case-specific attestations made under penalty of perjury when filing a claim. Consent records are stored in append-only audit tables and retained for seven years for compliance and dispute defense.
Recovered money and rewards: the payouts Kashfetti has confirmed you received (amount and an internal reference to the claim, never bank details), the unlock rewards you have earned, and when you used them.
Match Quiz answers (optional): the companies you tell us you have used in the last four years, picked from a list of brands in the app (for example streaming services, phone carriers, banks, or airlines), and which quiz pages you finished or skipped. You choose whether to answer, and you can change or skip any page at any time. We only store which listed brands you picked, never anything you type.
Saved settlements (optional): the settlements you save in the app’s Discover tab, and when you saved them. To show “You might qualify” on a settlement, our own database compares your Match Quiz answers with the companies each settlement is about. That comparison happens inside our database each time you open the list; the result is not stored, and your answers are not shared with anyone for it.
States you’ve lived in (optional): the state you live in now and any other states you lived in during the last four years, if you choose to add them in the app (You, then Where you’ve lived). We store only the two-letter state code (for example CA), never your street address, city, or ZIP code, and we never read your phone’s location for this. Some settlements are only for people in certain states; our own database compares your states with those settlements to show the ones that may fit you. Only you can see your states.
Your filings (optional): when you tell us you filed a claim on a settlement’s official site, we store which settlement, the date you filed, whether you filed online or by mail, its status as you update it, and, if you add it, the claim or confirmation number the official site gave you. We also keep a history of each filing: when it was filed, status changes, notes you write (up to 300 characters each), our updates, and whether you have read them. Only you can see your filings.
Payments you report (optional): when you tell us a settlement paid you, we store the amount, the date you received it, how it was paid (for example check or direct deposit), and our review result. To confirm it, you add a proof file, such as a photo of the check or a screenshot of the payment email. The file is stored privately, only Kashfetti staff look at it to confirm the payment, and we delete it as soon as we have checked it. Never send a full bank account or card number; cover them in the photo. Confirmed payments count toward your unlock rewards.
Details for claim forms (optional): your legal name, current mailing address, and a phone number, if you save them in the app (You, then Details for claim forms). We use them only to fill in a settlement’s official claim form when you choose “Fill with one tap”: the official site opens inside the app, we fill these details into its form, and you check every field and submit it yourself. The settlement administrator then receives what you submit, under its own privacy policy. We never send these details to analytics or anyone else, and we never fill in signatures, sworn statements, Social Security, bank, or card details. Find Money shows your name from here with Copy buttons (your full legal name, your first name, and your last name) so you can paste it into a state’s official unclaimed property search yourself. Find Money never types your name into a state site and never puts it in a web address. To keep claims in your own name, we also keep the first legal first and last name you saved and the time you last changed your name: you can change your name once every 48 hours, and only to a similar name (for example a spelling fix or a nickname) unless you use “I changed my last name”. Only you can see them.
Former names (optional): names you used before, for example your name before a marriage or divorce, if you add them in the app (“Add a former name” on Find Money or in Details for claim forms), or the name we save for you when you use “I changed my last name”: the first, middle, and last name and the reason you picked (marriage, divorce, or other). You can keep up to 5. We collect them because states often hold unclaimed money under an older name, so Find Money lists each one with its own Copy buttons for you to search under. We never send them to analytics or anyone else, never put them in a web address, and never use them on claim forms. You can remove any of them in the app at any time. Only you can see them.
Claim sheet answers (optional): for some settlements, the app shows the questions the official claim form asks (copied from the official form), so you can answer them in the app before you file. If you save answers, we store them with the settlement they are for: for example a purchase date, a number, a choice you picked, or your Yes or No answer to an eligibility question (saved only as your own note; we never fill those in for you). The one exception: if the official form has a box asking to send you a confirmation email and you answered Yes to that question on the claim sheet, one-tap fill ticks that one box, so the confirmation goes to your tracking email. It never unticks a box and never ticks any other box. We never ask for or store Social Security numbers, bank or card details, PayPal, Venmo, Zelle or other payment app details, passwords, signatures, dates of birth, or driver’s license or passport numbers on a claim sheet, and we never store answers to sworn statements: you confirm those yourself on the official form. We use your answers only to show them back to you, to list them in the copy helper so you can paste them into the official form, and, when you choose “Fill with one tap”, to fill the matching questions on the official claim form for you to check and submit yourself. Kashfetti never submits a claim for you. We never send your answers to analytics or anyone else. Only you can see them.
Past addresses (optional): places you lived before, if you add them in the app (You, then Past addresses, or the Past addresses step of your money profile): the state, and if you choose, the city and the years you lived there. We never ask for or store a street address or ZIP code for this. States hold unclaimed money under the last address a company had for you, so Find Money uses these states to list each state’s official unclaimed property website. Only you can see them.
Find Money notes (optional): if you choose “Save what I found”, the note you type about money you found on an official state site: the state, the state site’s address, the company or holder name, the amount wording and property ID as the site showed them, a status you set (for example Claim filed), and your own note (up to 500 characters). You type all of it; Kashfetti never reads your search results from a state site, never searches state sites for you, and never files a claim or receives money for you. Searching and claiming on a state’s official site is always free, and Kashfetti charges nothing for Find Money. Only you can see your notes.
Your tracking email (optional): each person can get a Kashfetti address (for example yourname@claims.kashfetti.com, built from the name part of your sign-in email) to use on settlement claim forms. When a settlement administrator writes to it, we forward the whole email to your own inbox right away, then read it to update your filing (for example “more information requested” or “payment sent”). We keep the sender, subject, date, and our one-line summary with your filing, and the email text for at most 30 days (to read the update and to retry forwarding if it failed); attachments are forwarded to you but not stored. If you ask us to, we also send an email for you from your tracking address to a settlement’s official administrator (for example asking for a claim ID you never received): you see and can edit the whole message first, it is sent only when you tap Send, it goes only to the administrator address on the official settlement site, and we keep a copy with your claim. Only you can see these. If you delete your account, the address stops working and is never given to anyone else.
Spam Fighter log and screenshots (Kashfetti Pro, optional): if you use Spam Fighter, the spam calls and texts you log yourself: call or text, the number or name your phone showed, when it came in, what it was about (for example a loan, insurance, a warranty, political, or debt collection), whether it was a recorded voice, whether it reached a cell phone or a landline, your own answers about whether your number was on the Do Not Call registry and whether you had given the caller permission, whether the caller ID looked fake, and your notes. If you choose, the last 4 digits of your own number that got it (never your full number). Screenshots you attach (images only, up to 10 MB each and 10 per entry) are kept in private storage that only your account can open; there are no public links to them. We never share your log or screenshots with anyone: not the FTC, not the FCC, not the caller, not advertising or analytics providers, and we never sell them. If you report a call to the FTC or FCC, you do it yourself on their official site; the app only lists your details for you to copy. Whether an entry looks like a possible violation is worked out in the app each time and is not stored. Only you can see your log.
Flight checks and flight claims (optional, Flight Refunds): when you check a flight, the airline code, flight number, scheduled departure date, and the airports, and what happened to that flight (scheduled and actual times, delay, cancellation or diversion, and distance) as FlightAware reports it. If you read a boarding pass code on your phone, only those flight details are used: your name in the code is not read, and the booking reference stays on your phone and is never sent to us or saved. If you start a claim (Kashfetti Pro): the rule you claim under, the number of passengers, the estimate we showed, the status you set, the airline’s case number and notes you type, and the claim text if you save it. Names of other passengers go only into the claim text you write. For an airline that takes claims only by email, if you tap Send we email the claim you reviewed from your tracking address to that airline’s published claims address and keep a copy with your claim. Kashfetti never submits an airline’s web form for you. Only you can see your checks and claims.
Certified mail (Kashfetti Pro, optional, not available yet): if you ask Kashfetti to mail a paper claim form or a letter for you, the pages you give us (photos of the official form you filled in and signed yourself, a PDF you made, or the letter text you approved, and a signature you draw in the app only if that option is offered), which we turn into one PDF; the official mailing address we have on file for that settlement, airline or regulator (you never type it); your own name and mailing address from your details for claim forms, printed as the return address because you are the sender; and the mailing record: what kind of mail it was, when you approved it, the cost, whether it used one of your included sends or a paid extra send, and the status and USPS tracking number from our mail service. Kashfetti prints and mails exactly the pages you approved; we do not change, file, sign or submit your claim. The documents are kept in private storage that only your account can open; there are no public links. Only you can see your mail.

3. How we use it

Kashfetti uses your personal information to:

Deliver the money-recovery services you signed up for.
Help you file claims yourself with state agencies, settlement administrators, airlines, courts, and telecommunications carriers, for example by filling your own details into an official claim form for you to review and submit. Kashfetti does not file or submit claims for you.
Send you transactional notifications about your account and your claims.
Process payments for subscriptions and one-time purchases through Stripe, once paid plans go on sale (payments are not live yet).
Maintain audit records for consent and legal compliance.
Use your Match Quiz answers to show you class-action settlements you may qualify for, by comparing them with the companies each settlement in our own database is about. Your quiz answers are never shared with advertising or analytics providers and are never sold.
Keep the list of settlements you saved so you can find them again.
Use the states you’ve lived in, if you add them, to show you settlements that are only for people in those states. Your states are never shared with anyone, never sent to advertising or analytics providers, and never sold.
Use your states and past addresses, if you add them, to list the official unclaimed property website of each of those states (Find Money), and show your legal name and former names with Copy buttons so you can paste them into those sites yourself. Kashfetti does not fill in, search, or submit anything on those sites, file claims, or receive money for you. Your past addresses, former names, and Find Money notes are never shared with anyone, never sent to advertising or analytics providers, and never sold.
Use your claim sheet answers, if you save them, to show them back to you, to list them in the copy helper, and to fill them into a settlement’s official claim form when you choose one-tap fill. You review and submit the claim yourself on the official site. Your answers are never shared with anyone, never sent to advertising or analytics providers, and never sold.
If you saved the states you’ve lived in, email you about settlements newly open to people in those states (the “new in your state” email): once a month on the free plan, once a week on Kashfetti Pro, and only when there is something new. Our own servers pick the settlements by comparing your saved states with each settlement’s states, and leave out settlements you already recorded as filed in the Filings tab. The email lists only each settlement’s name, who qualifies, the deadline, and the payout the settlement published, with a link into the app. It has no ads and no partner offers. Every one has a one-click unsubscribe link, and you can turn it off in the app (You tab, then Notifications). We keep a record of when each one was sent and which settlements it listed, never the email text, so no one gets the same email twice.
If you are a Kashfetti Pro member, send you an instant alert when a new settlement is added that fits you: one of your saved states fits a settlement that is only for certain states, or a company you picked in the Match Quiz is part of the case. Our own servers pick these by comparing your saved states and Match Quiz answers with each new settlement, and leave out settlements you already recorded as filed. Each alert is one push notification on your phone or, when a notification cannot reach your phone (or you turned push alerts off), one email. It shows only the settlement’s name, who qualifies, the deadline, and the payout the settlement published, with a link into the app, and has no ads and no partner offers. Push alerts follow your quiet hours and notification switches; every alert email has a one-click unsubscribe link; and both can be turned off in the app (You tab, then Notifications). We keep a record of which settlement each alert was about, whether it went by notification or email, why it fit you (your states or your Match Quiz answers), and when, never the message text, so no one is alerted twice about the same settlement.
Remind you before a settlement you saved closes: one reminder when the deadline is 7 days away and one the day before (or on the deadline day if a reminder could not go out the day before). Our own servers pick these from the settlements you saved with the star and leave out the ones you recorded as filed. Each reminder is one push notification or, when a notification cannot reach your phone (or you asked for email), one email. It shows the settlement’s name, that it is about to close, and the payout the settlement published, with a link into the app, and has no ads and no partner offers. Push reminders follow your quiet hours and the “Send me notifications” switch; you can turn reminders off in the app (You tab, then Notifications), with the one-click link in any reminder email, or by unsaving the settlement. We keep a record of which settlement each reminder was about, which reminder it was, whether it went by notification or email, and when, never the message text, so no one is reminded twice.
If you use Spam Fighter (Kashfetti Pro), keep your log of spam calls and texts and your screenshots, group them by number, show a plain-English look at which federal rules may apply to each one (general information, not legal advice), and list your details so you can copy them into an FTC or FCC report you file yourself. Your log and screenshots are never shared with anyone, never sent to advertising or analytics providers, and never sold.
If you use certified mail (Kashfetti Pro), print and mail the pages you approved, by USPS Certified Mail with tracking, to the official address for that claim, with your name and address as the sender; show you the status and the tracking number; and count your included sends. If you ask for a refund under the money-back guarantee, we check your mailing records to see whether certified mail was sent from your account, because that decides whether the refund applies (Terms, section 6). Nothing is mailed until you approve the exact pages, the address and the cost. Your documents are never sent to advertising or analytics providers and never sold.
Check a flight you enter (Flight Refunds): we look the flight up once at FlightAware, then show what happened and which passenger rules (EU 261, UK 261, Canada’s APPR, US DOT refund rules) may apply, with an estimate that is not a promise. We count your checks so the free check and the Kashfetti Pro limit (25 a year) work. For Kashfetti Pro members we draft the claim, fill your name and contact details on the airline’s own claim form when you choose “Fill with one tap” (you check everything and submit it yourself), track the status you set, and show regulator complaint letters you send yourself.
Improve the service through diagnostic and usage analytics.
Comply with legal obligations and respond to lawful requests from authorities.

4. Third-party service providers

Kashfetti relies on the following third-party service providers to deliver the service. Each provider handles data on our behalf under contractual data-protection obligations:

Infrastructure and service delivery

Supabase - hosted database, authentication, and file storage.
Vercel - web application hosting.
Upstash Redis - rate-limiting for the waitlist and other public endpoints. Stores hashed IP-derived keys, or for signed-in actions such as data exports your Kashfetti account ID, for short windows to prevent abuse.
Stripe - payment processing and subscription management.
Postmark - receives emails sent to tracking addresses and forwards them to you; also transactional email delivery (magic-link sign-in, subscription confirmations with your plan, price, and renewal date, renewal reminders, cancellation confirmations, and the copy of your data you ask for), the “new in your state” email (it receives your email address and the settlements listed in it), Kashfetti Pro instant alert emails, and deadline reminder emails for saved settlements (for both, it receives your email address and the settlement in it), and flight claims you send to an airline that takes claims only by email (it receives your tracking address, the airline’s address and the claim text). Postmark keeps the emails it sends for a limited time under its own retention settings.
Twilio - SMS delivery and inbound receiving on our toll-free number.
PostGrid - printing and mailing for certified mail (Kashfetti Pro; not available yet). When you approve a mailing, our server sends PostGrid the PDF of the pages you approved, the official recipient address, and your name and mailing address as the sender, so it can print the pages, add an address page, and mail them by USPS Certified Mail. PostGrid sends back the status and the USPS tracking number. PostGrid processes this only to deliver your mail, as our service provider, and keeps it under its own retention terms. The US Postal Service sees what any mail carrier sees: the envelope and the addresses.
FlightAware - flight data for Flight Refunds. When you check a flight we have not looked up before, our server sends FlightAware only the airline code, flight number, date and airports, and receives what happened to that flight. FlightAware never receives your name, email, account ID or anything else about you, and each flight is looked up once and then reused for everyone who checks it.
Expo - mobile application delivery and push notification infrastructure. Push notifications, including Kashfetti Pro instant alerts and deadline reminders for saved settlements, pass through Expo and then Apple or Google to reach your phone, so they receive your phone’s notification address and the notification text.
Logo.dev - supplies the official brand logos shown in the Match Quiz. When a quiz page loads, your phone asks Logo.dev for the logos of every brand on that page, so Logo.dev sees your IP address and which logos were shown. It never learns which brands you pick.

Analytics and diagnostics

Google Analytics 4 - website and app analytics. Loaded client-side on the website and, for signup events, also sent server-side to survive ad-blockers and iOS Intelligent Tracking Prevention. GA4 receives page views, event names, and a pseudonymous client identifier; it does not receive your email address, phone number, or claim contents. The website does not load Google Analytics, and does not send the server-side signup event, if your browser sends a Global Privacy Control signal.
Microsoft Clarity - session replay and interaction analytics on the Kashfetti website. Records mouse movement, clicks, scrolling, and page structure. Does not record keystrokes on password, payment, or other sensitive fields. Recordings are used to diagnose usability problems. The website does not load Clarity if your browser sends a Global Privacy Control signal.
Sentry - error tracking and diagnostics for the web and mobile apps. When something breaks, Sentry receives the error, where in the code it happened, the device model, operating system, and app version, and in the mobile app your Kashfetti account ID if you are signed in. It does not receive your email address, name, phone number, or claim contents.
PostHog - product analytics for the Kashfetti mobile app and the kashfetti.com website, hosted in the United States. In the mobile app, PostHog receives the names of key actions (opening the app, signing up or signing in, opening a module, starting or finishing the Match Quiz, opening checkout for a plan, opening or confirming a waitlist invitation link, asking for a copy of your data, deleting your account, opening a settlement, saving or unsaving one, or opening its official claim site, saving the states you’ve lived in, answering yes or no to the quick state question on a settlement that is only for certain states, and whether you tap Start or Not now on the screen that introduces your money profile, and that you recorded a filing or reported a payment, that you copied your tracking email, that you opened or saved a claim sheet (with no details), and that you opened one-tap claim fill and how many fields it filled (and, with no details, when a settlement site's robot check would not let the in-app browser through; the app also keeps a short list of those site addresses on your phone only), that you opened Find Money, opened a state’s official site from it, tapped a Copy button for your name there, saved a Find Money note, saved a past address, or added a former name (with no details), all without your email address), your device type, operating system, and app version, and your Kashfetti account ID once you are signed in. For the Match Quiz, PostHog only learns that you started or finished it and how many pages you answered, never which brands you picked. For settlements, PostHog only gets our internal settlement ID, never the settlement’s name, the company, or whether you might qualify. When you save your states, PostHog only learns how many states you saved, never which ones. For the state question, PostHog only learns whether you tapped yes or no, never which settlement it was or which state. For filings and payments, PostHog only learns that one was recorded, never the settlement, the amount, or any number. For claim sheets, PostHog never learns the settlement, the questions, or your answers. For Find Money, PostHog never learns which state or site, your name or former names, which name you copied, your past addresses, or anything in your notes. Our server also tells PostHog when a subscription starts, renews, or is canceled, with the plan and billing period (monthly or yearly), but not the amount or your location. On the website, PostHog receives only page views: which kashfetti.com pages you open and leave (the page address without anything after a "?" or "#"), the site that sent you (just its name, such as google.com), your browser type, device type, operating system, screen size, language, and time zone setting, and a random ID stored in your browser so repeat visits can be counted. The website does not tell PostHog who you are. If you join the waitlist on the website and later sign in to the app with the same email address, our server links that random website ID to your Kashfetti account ID in PostHog (only the two IDs are sent), so we can see how people move from the website to the app. In both places PostHog may receive your IP address and use it to estimate an approximate location (country, region, and city). PostHog does not receive your email address, name, phone number, or claim contents, does not record your screen or your clicks, and does not see what you type. The website does not load PostHog at all if your browser sends a Global Privacy Control or Do Not Track signal.

Advertising and conversion measurement

Kashfetti runs paid advertising campaigns on the platforms below. Each of them receives a signal when you open a page on kashfetti.com and when you join the waitlist, so that we can measure how well our ads work and reach similar audiences. Meta and TikTok (and Google Analytics, described above) also receive a signal when you click one of the site’s main call-to-action buttons or links, such as “Get notified”, “Join waitlist”, “Reserve for the 2028 window”, or “See how it works”, including the sign-up bar at the bottom of the screen on phones. That click signal says only which button was clicked and on which page; Meta records it as a custom event, never as a sign-up. A signal contains the event name, the page, and a pseudonymous browser or cookie identifier set by that platform. When you join the waitlist, Pinterest, Snap, and TikTok also receive a hashed identifier made from your email address: your browser turns your email into a scrambled code (a SHA-256 hash) before anything is sent, so they never receive the plain-text email. Kashfetti does not add your email, in any form, to the signals it sends the other platforms, and we keep the platforms’ automatic form-reading features switched off. No signal includes your claim contents, payment details, or the specifics of any filing you make through Kashfetti.

How we credit ads (first visit record). When you first arrive on kashfetti.com, your browser keeps a note of how you got there: the ad click ID in the link (for example from Meta, TikTok, Google, Reddit, Snap, Pinterest, X, LinkedIn, or Microsoft), campaign tags (utm tags), the Meta and Google Analytics browser IDs, and the page you landed on (without anything after a “?”). If you join the waitlist, we save that note in our own database with a hashed version of your email (never the email itself) and the random website ID PostHog uses, plus whether your browser sent a Global Privacy Control signal. We never save the site that sent you, your IP address, or anything about claims or bills. Nothing is kept if your browser sends Global Privacy Control.

Purchases. Subscriptions are paid on Stripe’s checkout page, where ad tags cannot run. So if you first came to kashfetti.com from an ad, did not send a Global Privacy Control signal, and later subscribe, our server sends Google Analytics and TikTok one generic “purchase” or “subscribe” signal when you first pay and when your subscription renews. It contains the amount, the currency, and a transaction number, plus the Google Analytics browser ID (to Google) or the hashed email and TikTok click ID (to TikTok). It never says which plan or feature you bought. We do not send these signals for accounts that were first created in the app, or for test purchases.

Meta (Facebook and Instagram) Pixel
TikTok Pixel
LinkedIn Insight Tag
Pinterest Tag
Snap Pixel (Snapchat)
Reddit Pixel
X (formerly Twitter) Pixel

Under some state privacy laws (including California's CCPA/CPRA and similar laws in other states listed in Section 8), the transfer of this event data to an advertising platform for the purpose of cross-context behavioral advertising can be considered a "sale" or a "share" of personal information. You have the right to opt out of this activity at any time. To opt out: (a) enable the Global Privacy Control signal in your browser or a supporting extension. Kashfetti honors it on every page of the website: when your browser sends it, none of the advertising tags listed above load or receive any event from us, and neither do Google Analytics, Microsoft Clarity, or PostHog. Or (b) email hello@kashfetti.com with the subject line "Opt Out of Sharing" from the email address associated with your account, and Kashfetti will suppress the sharing signals tied to your identifiers within 15 days.

Affiliate and partner networks

Kashfetti does not show affiliate offers yet. When labeled partner offers go live, this section will name each affiliate network that receives data and describe what it receives, with a version note and a new LAST UPDATED date.

Planned providers

The following providers are scoped for near-term launch but are not yet processing user data on Kashfetti's behalf. When they go live, this policy will be updated with a version note and the LAST UPDATED date at the top will be bumped:

Anthropic - automated text extraction from uploaded documents, such as identity documents, boarding passes, and receipts (planned for the document-upload feature).
Perform[cb] - affiliate network (planned for partner offers). When you tap a labeled partner offer, the network and the advertiser receive a click identifier and, if you complete the offer on their site, a conversion signal. Kashfetti will not send your name, email address, or account details to the network.

Kashfetti does not sell your personal information for monetary consideration. Kashfetti does not use your personal information for any purpose beyond the service-delivery and measurement purposes described above.

5. Receiving entities

You file each claim yourself on the receiving entity’s official website, and that entity receives what you submit there. Kashfetti does not submit claims for you. The only things Kashfetti sends to a receiving entity for you are a request from your tracking email that you review and send, and, once certified mail is available, the pages you approve for mailing (see section 2). Receiving entities may include state unclaimed-property programs, class-action settlement administrators (such as Kroll, JND, Simpluris, Angeion), airlines, small-claims courts, telecommunications carriers, and enforcement bodies (such as the US Department of Transportation, UK Civil Aviation Authority, or European national enforcement bodies). Each receiving entity has its own privacy practices. Spam Fighter reports to the Federal Trade Commission or the Federal Communications Commission are filed by you on their official sites; Kashfetti sends them nothing. If you use certified mail, the recipient (for example a settlement administrator, an airline or a US regulator) receives the pages you approved, by mail, with you as the sender; Kashfetti is only the mail service and does not file the claim for you.

6. Data retention

Account information (your sign-in email, name, phone number, and preferences): kept for the life of your account and deleted when you delete your account. What we keep after that, and why: consent records (seven years, see below), payment records held by Stripe for tax and legal recordkeeping, a log that we sent the required subscription emails (IDs only, no longer linked to you), and your waitlist signup if you joined the waitlist (email hello@kashfetti.com to remove it).
Claim submission data: retained for seven years after the claim is closed or resolved.
Identity verification uploads and proof-of-eligibility documents: not collected (see section 2).
Consent records: retained for seven years for legal and compliance recordkeeping.
Diagnostic and usage data: retained for up to 24 months in PostHog and Sentry.
First visit records (how you first reached the website): deleted automatically after 90 days, and right away if you delete your account.
Push notification addresses: removed when you sign out on that phone, turned off when the phone stops accepting notifications, and deleted with your account, along with your notification settings.
Match Quiz answers: kept until you change them or delete your account. Deleting your account deletes your quiz answers right away.
Saved settlements: kept until you remove them or delete your account. Deleting your account deletes them right away.
States you’ve lived in: kept until you remove them in the app or delete your account. Deleting your account deletes them right away.
Details for claim forms: kept until you change or clear them, or delete your account (deleted right away). The first legal name you saved and the time you last changed your name are kept for the life of your account, even if you clear your details, so the name change limits keep working; deleting your account deletes them right away.
Former names: kept until you remove them in the app or delete your account. Deleting your account deletes them right away.
Claim sheet answers: kept until you change or clear them, or delete your account (deleted right away).
Record of the “new in your state” emails sent to you (when, and which settlements): kept for the life of your account and deleted when you delete it.
Record of the Kashfetti Pro instant alerts sent to you (which settlement, by notification or email, and when): kept for the life of your account and deleted when you delete it.
Record of the deadline reminders sent to you for saved settlements (which settlement, which reminder, by notification or email, and when): kept for the life of your account and deleted when you delete it.
Flight checks: kept for the life of your account (they also count your free check and Pro checks, so you cannot remove them one by one) and deleted when you delete your account. Flight claims: kept until you delete the claim in the app or delete your account. The flight facts we get from FlightAware (times, delay, cancellation) are kept without any link to you, so the same flight is not looked up twice, and stay after you delete your account; they say nothing about who checked the flight.
Past addresses and Find Money notes: kept until you remove them in the app or delete your account. Deleting your account deletes them right away.
Tracking email: the text of emails sent to your tracking address is deleted after 30 days; the sender, subject, and summary stay with your filing for the life of your account. Deleting your account deletes all of it and retires the address.
Filings, their history and notes, and payments you report: kept for the life of your account and deleted when you delete it (you can also remove a filing in the app). Payment proof files: deleted as soon as we have reviewed the payment, and right away if you delete your account first.
Spam Fighter log and screenshots: kept until you delete them in the app (one entry, one screenshot, or the whole log) or delete your account. Deleting your account deletes the log and every screenshot file right away. If your Pro plan ends, your log stays yours to see, export and delete; adding to it needs Pro.
Certified mail: the document file (the PDF of your pages) is deleted 30 days after the mail is delivered, or 30 days after it is returned, fails or is cancelled. Pages you add but never approve are deleted after 30 days. The mailing record (who it went to, when, the cost and the USPS tracking number) is kept for the life of your account so you can prove you mailed it, and is deleted when you delete your account. Deleting your account deletes every document file right away. PostGrid keeps its copy under its own retention terms.
Recovered money and rewards: kept for the life of your account and deleted when you delete it. So that each unlock reward is earned only once per person, we keep a one-way scrambled code made from your email address (a SHA-256 hash, which cannot be turned back into your email) together with the reward levels it has earned, for as long as the rewards program runs, including after you delete your account. It contains nothing else about you.

7. Your rights

You have the following rights regarding your personal information:

Access: request a copy of the personal information Kashfetti holds about you.
Correction: request that Kashfetti correct inaccurate or incomplete personal information.
Deletion: request that Kashfetti delete your personal information, subject to legal obligations to retain certain records.
Portability: request an export of your personal information in a machine-readable format.
Opt out of SMS: reply STOP to any SMS message to unsubscribe from text notifications, or disable SMS in account settings.
Opt out of email: unsubscribe via the link in any email or disable email notifications in account settings (the “new in your state” email: the one-click link in it, or the app’s You tab, then Notifications; Kashfetti Pro instant alert emails and notifications: the same, each with its own switch; deadline reminders for saved settlements: the one-click link in any reminder email, or the switch under You tab, then Notifications). Transactional emails required to operate your account (such as receipts and legal notices) cannot be disabled while your account is active.

In the Kashfetti app, the You tab has “Export my data” (we email a copy of everything we hold about you to your account email) and “Delete my account” (deletes your account right away and cancels any subscription so you are not charged again). For anything else, or if you cannot use the app, email hello@kashfetti.com from the email address associated with your account.

8. State-specific privacy rights

If you are a resident of a state that grants consumers additional privacy rights, those rights apply to you in addition to those listed in Section 7 above. Kashfetti honors requests from residents of every U.S. state; the list below names the states with statutory consumer privacy frameworks currently in force.

California (CCPA/CPRA): right to know what personal information Kashfetti collects, uses, shares, and sells; right to delete; right to correct; right to opt out of sale or sharing; right to limit use of sensitive personal information; right to non-discrimination for exercising these rights. Kashfetti does not sell personal information within the meaning of California law.
Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Delaware (DPDPA), Iowa (ICDPA), New Hampshire (SB 255), New Jersey (NJDPA), Nebraska (NDPA), Maryland (MODPA), Minnesota (MNCDPA), Rhode Island (RIDTPPA), Kentucky (KCDPA), Indiana (INCDPA), Tennessee (TIPA), Washington (MHMDA, health-specific): right to access, correct, delete, and port your personal information; right to opt out of targeted advertising, sale of personal information, and certain profiling activity. Kashfetti runs conversion-measurement pixels on the platforms named in Section 4, which under some of these laws is considered targeted advertising or a "sale" or "share" of personal information; you have the right to opt out of that activity at any time using the mechanisms described in Section 4 and Section 9.
Nevada (NRS 603A): right to opt out of the sale of covered information. Kashfetti does not sell covered information.

To exercise any state privacy right, email hello@kashfetti.com from the email address associated with your account, or write to Crooks Group LLC at the address in Section 13. Kashfetti will respond within the timeframe required by the applicable state statute.

You have the right to appeal any denial of a privacy request. To appeal, reply to the denial email with the subject line "Privacy Appeal" and Kashfetti will review within the statutory appeal window.

9. Cookies and tracking

The Kashfetti website uses several categories of cookies and similar tracking technologies. Each is described in Section 4 above; this section summarizes them by category.

Essential cookies: required for authentication, session management, form submission, and rate-limiting. These cannot be disabled without breaking the site.
Analytics cookies and browser storage: Google Analytics 4, Microsoft Clarity, and PostHog, used to measure page performance, feature usage, and session behavior. GA4 is supplemented by a server-side event for signup completion. Clarity records session replays but suppresses keystrokes on sensitive fields. PostHog does not set cookies on the website; it keeps a random visitor ID and visit details in your browser's local storage and session storage, which you can clear in your browser settings. PostHog does not load at all when your browser sends a Global Privacy Control or Do Not Track signal. Google Analytics 4 and Clarity do not load when your browser sends a Global Privacy Control signal.
First visit record: Kashfetti’s own browser storage entry (local storage, not a cookie) that remembers how you first reached the site (see “How we credit ads” in Section 4). It expires after 90 days, you can clear it in your browser settings, and it is never created when your browser sends a Global Privacy Control signal.
Advertising and conversion-measurement pixels: Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, Pinterest Tag, Snap Pixel, Reddit Pixel, and X (formerly Twitter) Pixel. Today these fire on exactly three things: when you open a page, when you join the waitlist, and (Meta and TikTok only) when you click one of the site’s main call-to-action buttons or links. Google Analytics 4 also records those clicks. Kashfetti uses this to measure paid-ad performance on those platforms and build similar-audience targeting. See Section 4 for the exact scope of what these pixels receive and for the opt-out procedure.

Kashfetti honors the Global Privacy Control browser signal site-wide as an opt-out of the advertising and conversion-measurement pixels described above and of any activity that could be considered a "sale" or "share" under state privacy law. When your browser sends it, none of those pixels load or fire on any page, the waitlist form sends no signup event to any advertising or analytics platform, and Google Analytics 4, Microsoft Clarity, and PostHog do not load either. You can also control cookies through your browser settings; disabling analytics or advertising cookies does not prevent you from using Kashfetti.

10. Children

Kashfetti is not directed to children under 18. Kashfetti does not knowingly collect personal information from anyone under 18. If you believe a child has provided information to Kashfetti, email hello@kashfetti.com and we will delete that information promptly.

11. Security

Kashfetti uses industry-standard security measures, including encryption in transit (HTTPS) and encryption at rest, to protect your personal information. No system is perfectly secure. In the event of a data breach affecting your personal information, Kashfetti will notify you as required by applicable law.

12. Changes to this Privacy Policy

Kashfetti may update this Privacy Policy from time to time. When material changes are made, Kashfetti will notify account holders by email and post the updated policy with a new "Last updated" date at the top. Continued use of the service after the effective date constitutes acceptance of the updated policy.

13. Contact

Privacy questions can be sent to hello@kashfetti.com or to Crooks Group LLC, 66 West Flagler Street, Floor 9, Miami, Florida 33130.

14. Related

Review our Terms of Service.