Privacy Policy

CrestCast is a personal finance forecasting app for UK households. References to “we”, “us”, or “CrestCast” in this policy refer to the operator of the CrestCast service.

We are the data controller for personal data collected through this website and the CrestCast app. For questions about this policy, contact us at hello@crestcast.co.uk.

Waitlist: If you submit your email on our website to be notified at launch, we store your email address and the date you signed up. Nothing else.

Account: When you create an account, we collect your email address and a securely hashed password. We do not store your password in plain text.

Financial data: The income, assets, liabilities, and bills you enter into CrestCast are stored in our Postgres database on Supabase. By default your data is private to you: strict per-user access controls (Row-Level Security) mean no other user can see it, unless you deliberately choose to share it with a partner (see “Sharing with a partner” below). The data is encrypted in transit (TLS) and encrypted at rest (AES-256) by the platform. We do not access your financial data except where necessary to operate the service, to provide support you have specifically asked for, or to comply with a legal obligation. We never use it for advertising, profiling, or sale.

Billing: Subscription payments are handled by Stripe. We do not store your card details. Stripe provides us with a customer ID and subscription status only.

Usage data: We measure how the crestcast.co.uk website is used, so we can see which pages are worth writing more of. There are two layers and they are different in kind. Vercel Web Analytics and Speed Insights run for every visitor: they set no cookie and no cross-site identifier, and they report page views, referring sites and page loading speed in aggregate, with no way to pick you out of it. Google Analytics runs only if you accept it on the banner: it sets cookies, which is what lets several page views be recognised as one visit and shows us how people move between pages. On our home page it also records which sections you scrolled down to, which buttons you pressed and which links you followed, so we can tell which parts of a long page are worth keeping. If you accept part way down the page, the sections you had already passed on that page are counted too: they are held in your browser's memory while we wait for your answer, and sent only if that answer is yes. Nothing is sent to Google and nothing is stored on your device before you answer, and if you decline or simply close the page they are discarded. That is a count of anonymous presses and views, not a recording of your session, and if you decline, or simply never answer, no Google script is loaded at all and none of it happens. Neither layer runs on the financial data you enter into CrestCast, and neither ever receives it.

Advertising: none. We run no advertising, we set no advertising or personalisation cookies, and we never ask for consent to do so.

We use your data solely to operate CrestCast:

• Your email is used to send you a launch notification (waitlist) or to manage your account and send essential service communications.
• Your financial data is used exclusively to generate your forecast within the app. It is never used for any other purpose.
• Billing data is used to manage your subscription.

We do not sell your data, share it with third parties for marketing, use it for advertising, or disclose it to anyone except as described in this policy.

CrestCast is built for couples and families to plan together, so it lets you share finances within a household. This is always your choice, and always reversible:

• Joint finances you set up together (a shared account, a joint bill, a mortgage in both names) are visible to both people in the household, because they belong to both of you.
• Your own personal finances stay private to you by default, even after you link a household. They become visible to your partner only if you both turn full sharing on, and only the items covered by that sharing. Either person can turn sharing off at any time.
• Anything shared within a household is protected by the same access controls and encryption as the rest of your data, and is only ever visible to the members of that household.

We use a small number of trusted services to operate CrestCast:

• Supabase: cloud Postgres database and authentication (EU region). Supabase is SOC 2 Type 2 compliant and ISO 27001 certified. Your account and financial data are stored here, isolated per user by Row-Level Security, encrypted in transit (TLS) and encrypted at rest (AES-256).
• Stripe: subscription billing. Governed by Stripe's own privacy policy.
• Vercel: hosting for this website, and cookieless Web Analytics and Speed Insights. Vercel receives the request data any host receives, including your IP address, and its analytics products store no cookie and no cross-site identifier.
• Google: Google Analytics, and only if you accept it. Decline and no Google script is loaded, so nothing about your visit reaches Google at all. Accept and it is governed by Google's own privacy policy.

We do not use any other third-party services that receive your personal data.

We retain your account and financial data for as long as you have an active account. Waitlist emails are retained until CrestCast launches or you unsubscribe, whichever comes first.

If you delete your account, all associated personal data and financial data is permanently deleted within 30 days.

Under the UK GDPR and Data Protection Act 2018, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate data.
• Erasure: ask us to delete your data (“right to be forgotten”).
• Portability: receive your data in a portable format.
• Objection: object to processing in certain circumstances.
• Withdraw consent: where processing is based on consent (the waitlist, or analytics cookies), you can withdraw it at any time. For analytics cookies you can do that yourself, in the Cookies section below, and it takes effect immediately.

To exercise any of these rights, email hello@crestcast.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

Essential, and not optional: the CrestCast app uses a single session cookie to keep you signed in to your account. Without it the app cannot tell one signed-in person from another, so there is no way to turn it off other than not signing in. It is not used for measurement and it is not shared with anyone.

Analytics, only if you accept: accepting on the banner allows Google Analytics to set cookies in your browser, normally named_gaand one beginning_ga_, lasting up to two years. Their purpose is to recognise several page views as one visit, which is what turns a list of popular pages into a picture of how people move around the site. Until you accept, the Google script is never loaded and no such cookie exists. If you decline, none is ever set.

Advertising: none, and there is no option to turn any on, because there are none to turn on. We never ask for consent to advertising or personalisation storage, because we would have no use for it.

Your answer is not itself a cookie: it is kept in your browser's local storage. A cookie recording that you had refused cookies would be the very thing you had just refused, so we do not set one.

Vercel Web Analytics and Speed Insights, described above, set no cookie at all, which is why they are not on this list and why they need no consent.

If we make material changes to this policy, we will notify you by email before the changes take effect. The “last updated” date at the top of this page reflects the most recent revision.