Privacy Policy

CrestCast is a personal finance forecasting app for UK households. It is run by CrestCast Ltd, a company registered in Northern Ireland (company number NI744565, registered office 2 Grahamsbridge Park, Dundonald, Belfast, Northern Ireland, BT16 2DE), founded by Luke Walsh. References to “we”, “us”, or “CrestCast” in this policy refer to CrestCast Ltd.

The data controller for personal data collected through this website and the CrestCast app isCrestCast Ltd, of 2 Grahamsbridge Park, Dundonald, Belfast, Northern Ireland, BT16 2DE. Its founder, Luke Walsh, is registered with the Information Commissioner’s Office (ICO) under reference ZC259857. For questions about this policy, or to make any request about your own data, contact hello@crestcast.co.uk, which is the contact address for data requests. More about who is behind CrestCast is on the about page.

CrestCast is for adults aged 18 or over. If you enter details about your children, that is data about them which you control, and it is deleted with your account.

Waitlist: Before CrestCast launched you could leave your email on our website to be told when it opened. We stored the address and the date you signed up, nothing else. The form is closed and we no longer collect this.

Account: When you create an account, we collect your email address and a securely hashed password. We do not store your password in plain text. You can give us a first name at sign-up if you want the emails we send to be addressed to you. It is optional, you can leave it blank, and nothing else changes if you do.

Two-step sign-in: If you turn on two-step sign-in, we hold your authenticator enrolment and a one-way hash of each recovery code. The codes themselves are generated on your device and shown to you once. We never receive them, so nobody here can read them back to you, and they are deleted with your account.

Email we send you: We keep a record of which emails we have sent you, when, and what the delivery outcome was, so the same message cannot be sent to you twice and so we can tell whether our email is arriving at all. There are two kinds. Service emails are about the account you asked for: a welcome, a note that your trial is ending, a failed payment. Those are sent whether or not you want other email from us, because without them your subscription could lapse without warning. Marketing emails are the ones about getting more out of the product, and you can switch them off. The switch is in the app under Settings, and every marketing email carries a one-click unsubscribe link of its own that works without signing in. Turning them off never stops a service email. We do not track whether you opened these emails or which links you clicked in them.

Financial data: The income, assets, liabilities, and bills you enter into CrestCast are stored in our Postgres database on Supabase. By default your data is private to you: strict per-user access controls (Row-Level Security) mean no other user can see it, unless you deliberately choose to share it with a partner or an adviser (see “Sharing with a partner” and “Sharing with an adviser” below). The data is encrypted in transit (TLS) and encrypted at rest (AES-256) by the platform. We do not access your financial data except where necessary to operate the service, to provide support you have specifically asked for, or to comply with a legal obligation. We never use it for advertising, profiling, or sale.

Billing: Subscription payments are handled by Stripe. We do not store your card details. Stripe provides us with a customer ID and subscription status only.

Emails we send you personally: If we email you directly, for example about working together, the CrestCast links in that email carry a short code. If you click one, we record that the link was clicked and when. We don't use cookies for this or store your IP address, and the code is removed from the address as soon as the page opens.

Usage data: We measure how the crestcast.co.uk website is used, so we can see which pages are worth writing more of. There are two layers and they are different in kind. Vercel Web Analytics and Speed Insights run for every visitor: they set no cookie and no cross-site identifier, and they report page views, referring sites and page loading speed in aggregate, with no way to pick you out of it. Google Analytics runs only if you accept it on the banner: it sets cookies, which is what lets several page views be recognised as one visit and shows us how people move between pages. On our home page it also records which sections you scrolled down to, which buttons you pressed and which links you followed, so we can tell which parts of a long page are worth keeping. If you accept part way down the page, the sections you had already passed on that page are counted too: they are held in your browser's memory while we wait for your answer, and sent only if that answer is yes. Nothing is sent to Google and none of them is written to your device before you answer, and if you decline or simply close the page they are discarded. That is a count of anonymous presses and views, not a recording of your session, and if you decline, or simply never answer, no Google script is loaded at all and none of it happens. Neither layer runs on the financial data you enter into CrestCast, and neither ever receives it.

Our own page count: The website also counts its page views itself. For each page opened it adds one to a total for that hour, noting the page, where the visit came from (a search engine, LinkedIn, one of our emails, an affiliate link, another website, or none), whether the device is a phone or a computer, and the country. It sets no cookie, stores nothing on your device, and keeps no IP address, browser details or referring address, so nothing in it identifies you. In the same way it counts presses of the buttons that open the demo or start a free trial: one added to a total for that hour against the name of the button.

How you found us: When you press a button on this website that opens the demo or starts a free trial, the link carries the page you were on, the website that sent you (its name only, never the full address) and any campaign tags in the address. Nothing is stored on your device to do this. If you then create an account, CrestCast Ltd keeps those details, and your answer to the optional question “How did you hear about us?” if you give one, against your account, to learn which pages and sources bring people to CrestCast. We do not keep your IP address or browser details for this, and it is deleted with your account.

Usage data (inside the app): Inside the app we record which screens you open, which setup steps you complete, and how far through the first-run guide you get (which step was shown, which you finished, which you hid the guide on, and which screen you went to instead), so we can see where the product is hard to use. These records are keyed to your account and are stored in the same database as the rest of your data, in the EU. They never contain any of your figures: no balances, no income, no debts. They are not shared with any third party, they never leave that database, and they are deleted when you delete your account.

Advertising: none. We run no advertising, we set no advertising or personalisation cookies, and we never ask for consent to do so.

We use your data solely to operate CrestCast:

• Your email is used to manage your account and to send essential service communications.
• We also send occasional marketing email about getting more out of CrestCast. You can switch that off in Settings or from the unsubscribe link on any of them, and doing so does not affect the service emails about your account.
• Your financial data is used exclusively to generate your forecast within the app and, only if you use the AI assistant, to answer what you ask it (see “The AI assistant” below). It is never used for any other purpose.
• Billing data is used to manage your subscription.

We do not sell your data, share it with third parties for marketing, use it for advertising, or disclose it to anyone except as described in this policy.

UK GDPR requires us to have a lawful basis under Article 6 for each kind of processing. Ours are:

• Your account and your financial data: performance of a contract (Article 6(1)(b)). You asked us to forecast your finances, and we cannot do that without storing what you entered.
• The AI assistant: performance of a contract (Article 6(1)(b)). It runs only when you open Set up by chatting or Ask or try a what-if and send a message, because you asked it to, and what is sent is what it needs to answer. The usage record kept for each message is legitimate interests (Article 6(1)(f)) in keeping the feature within a daily limit and stopping it being abused.
• Billing: performance of a contract for taking the payment, and legal obligation (Article 6(1)(c)) for keeping the records HMRC requires us to keep.
• Google Analytics on the website: consent (Article 6(1)(a)), which is why it is behind a banner and loads nothing at all until you accept.
• Vercel Web Analytics and Speed Insights: legitimate interests (Article 6(1)(f)) in knowing whether our own site works and is fast. It sets no cookie and no cross-site identifier and reports in aggregate, so there is nothing in it that picks you out.
• Our own page count: legitimate interests (Article 6(1)(f)) in knowing which pages are read. It is a total per hour and holds nothing about you.
• How you found us: legitimate interests (Article 6(1)(f)) in knowing which pages and sources bring people to CrestCast. The answer to the question is optional, and leaving it blank changes nothing.
• Usage data inside the app: legitimate interests (Article 6(1)(f)) in finding out where the product is hard to use, so we can fix it. Our assessment is below.
• Keeping the service secure: legitimate interests (Article 6(1)(f)) in preventing abuse of accounts and of our infrastructure.
• Service emails about your account: performance of a contract (Article 6(1)(b)). A welcome, a trial ending, a payment that failed: without them your subscription could lapse with no warning, so they are part of providing the service rather than something separate from it.
• Clicks on links in emails we send you personally: legitimate interests (Article 6(1)(f)) in knowing whether an email we sent was of any use to you. It records only that a link was clicked and when.
• Marketing emails: legitimate interests (Article 6(1)(f)) in telling our own customers about our own product, sent under the soft opt-in in regulation 22(3) of the Privacy and Electronic Communications Regulations. That is not the same thing as consent and we do not describe it as consent: the setting starts switched on, and what the law requires in exchange is that refusing is easy and always available. So it is a single switch in Settings, a one-click unsubscribe link on every marketing email that works without signing in, and no effect on your account either way. We send these only to people who have created an account, only about CrestCast, and never to a list bought from anyone.
• The change history on your financial data: performance of a contract (Article 6(1)(b)) for the part you and your household partner can see, because a planner two people share needs a shared record of what changed, and legitimate interests (Article 6(1)(f)) in being able to answer “who changed this figure, and when” if a number is ever disputed or a sync goes wrong. An entry records the item, the one field that changed, its value before and after, which account made the change and when. Entries are written by the database itself rather than by the app, so no signed-in account can create, amend or delete one. Your partner sees an entry about a personal item only while you show them your own tab, and joint finances always.

Our assessment for the in-app usage data. The interest is real and specific: without it we cannot tell which setup step people give up on, and a fix aimed at the wrong step helps nobody. It is necessary, because asking people afterwards tells us what they remember rather than what happened, and the alternative is changing the product blind. And we think it does not override your interests, for reasons you can check on this page rather than take on trust: the records hold no figures of any kind, they are stored in the same EU database as your own data and under the same per-user access controls, no third party receives them, nothing is written to your device, they are never used to make a decision about you, and they are deleted when you delete your account. Because nothing is stored on or read from your device, PECR regulation 6 does not apply to it.

Where we rely on legitimate interests you have the right to object, and you can do that by emailing hello@crestcast.co.uk. We will stop the in-app usage recording for your account if you ask us to, and the product will work exactly as it did before.

CrestCast is built for couples and families to plan together, so it lets you share finances within a household. This is always your choice, and always reversible:

• Joint finances you set up together (a shared account, a joint bill, a mortgage in both names) are visible to both people in the household, because they belong to both of you.
• The person who sets up the household chooses whether their partner can view joint finances, or view and edit them.
• Your own tab (your personal accounts, income and debts) stays private to you by default, even after you link a household. You choose in Settings what your partner can do with it (Hidden, Viewing, or Viewing and editing), and they make the same choice for theirs; neither choice depends on the other. Viewing shows your partner your own accounts, income and debts. Viewing and editing lets them open your plan and change it, which means they can read everything in it, including your date of birth, tax code, student loan, pension contributions and goals; if you use two-step sign-in, switching it on asks for your second step. Every change they make is recorded in your change history under their name. Stepping down to Viewing or Hidden takes effect straight away.
• Anything shared within a household is protected by the same access controls and encryption as the rest of your data, and is only ever visible to the members of that household.

You can choose to give a named financial adviser access to your forecast from Settings > Share with an adviser. We send them an email invitation, and they can accept it only while signed in to a CrestCast account with that email address.

• Once they accept, they can see the figures you have entered and the forecast built from them. By default they can only view it.
• If you switch on Can edit for that adviser, they can also change your figures, and every change they make is recorded in your change history under their email address. If you use two-step sign-in, switching it on asks for your second step. You can switch Can edit off at any time, and it takes effect immediately.
• They cannot see anything your partner has entered, your saved versions, your past forecast copies or your change history.
• We record when you invite an adviser, when they accept, each time they open your forecast, and when either of you ends the access. You can see this in your change history.
• You can stop sharing at any time from Settings, and access ends immediately. If either account is deleted, the access is deleted with it.
• The adviser's email address is kept with the record of your invitation for as long as your account exists.

CrestCast has two optional AI features: Set up by chatting, which drafts inputs from what you describe, and Ask or try a what-if, which answers questions about any figure in your plan and drafts what-ifs. You can use everything else in CrestCast without them, and nothing is sent anywhere until you open one and send a message.

• Who answers: Anthropic, acting as our processor. For a UK business our contract is with Anthropic Ireland, Limited, and the processing can take place in the United States.
• What is sent, for Set up by chatting: the messages you type in that conversation, the assistant's earlier replies and the inputs it has already drafted (which include the figures you gave it), and a summary of which kinds of input your plan already holds, without their amounts.
• What is sent, for Ask or try a what-if: your question and the conversation so far, and figures from your plan across every tab and year, which can include month-end cash and net worth, cash in and cash out, year-end totals, the statements, your regular income and spending by item, debt balances and when each is forecast to clear, upcoming milestones, and the names and amounts of the bills, incomes and mortgages a what-if could change.
• What is not sent: your email address, your password or your account id. The names of the people in your household are replaced with roles (You, Partner, Child 1) in the figures before they leave your device. What you type yourself, in a message or as the label on a bill, income or debt, is sent as you typed it, so do not put in a name you would rather keep out.
• Nothing changes without you: a drafted input goes into your plan only when you tap Add, and a what-if is saved as a separate version only when you choose Save and compare. Your plan is never edited by the assistant.
• What CrestCast keeps: no conversation. Neither your messages nor the replies are stored by us. For each message we keep a usage record: when it was sent, which model answered, how many tokens it used and what it cost. For a signed-in account the record carries your account id and is deleted with your account. In the demo, with no account, it carries instead two one-way hashes, of a random code your browser holds and of your network address, which we use only to count messages against the daily limit and which cannot be turned back into either without a key held on our server.
• What Anthropic does with it: under its commercial terms Anthropic does not use inputs or outputs from its API to train its models, and it deletes them within 30 days, except where it must keep them longer to enforce its usage policy or to comply with the law. Its data processing addendum is part of those terms and covers transfers from the UK to the United States with the International Data Transfer Addendum issued by the Information Commissioner, alongside the EU Standard Contractual Clauses.
• It is not advice: the assistant explains your forecast and helps you enter your details. It does not make decisions about you and does not give financial advice.

We use a small number of trusted services to operate CrestCast:

• Supabase: cloud Postgres database and authentication (EU region). Supabase is SOC 2 Type 2 compliant and ISO 27001 certified. Your account and financial data are stored here, isolated per user by Row-Level Security, encrypted in transit (TLS) and encrypted at rest (AES-256). To stop abuse of the forecast service we keep the network (IP) address of each forecast request for about an hour, and a record of request sizes, without any of your figures, for 26 hours.
• Stripe: subscription billing. Governed by Stripe's own privacy policy.
• Vercel: hosting for this website and for the CrestCast web app, and cookieless Web Analytics and Speed Insights. Vercel receives the request data any host receives, including your IP address, and its analytics products store no cookie and no cross-site identifier. Your financial data is not stored there: Vercel serves the application, and the figures live in the database.
• Google: Google Analytics, and only if you accept it. Decline and no Google script is loaded, so nothing about your visit reaches Google at all. Accept and it is governed by Google's own privacy policy.
• Anthropic: the AI provider behind Set up by chatting and Ask or try a what-if, and only when you use one of them. It can process data in the United States. It receives what is described under “The AI assistant” above, does not use it to train its models, and deletes it within 30 days except where its usage policy or the law requires longer. CrestCast keeps no copy of the conversation.
• Resend: the service that delivers our email. It receives your email address, your first name if you gave us one, and the message itself, and it tells us back whether the message was delivered, bounced or reported as spam. Governed by Resend's own privacy policy.

We do not use any other third-party services that receive your personal data.

We retain your account and financial data for as long as your account exists. If your subscription ends, nothing is deleted: your figures stay where they are so that they are still there if you come back.

We do delete an account that has been left completely unused for 24 months. We email you 60 days before that point and again 14 days before it, and opening the app once starts the 24 months over. We will not delete an account this way while it holds a live subscription or trial, and we will not delete one where that final email did not reach you.

The addresses left on the pre-launch waitlist form have been deleted. The form is closed, nothing replaced it, and we hold none of them.

Your email preference and the record of which emails we have sent you are kept for as long as the account they belong to, and are deleted with that account by the same database rule that removes the rest of your data, so there is no separate request to make. The record of what was sent is what stops the same message going out to you twice, so shortening it would bring back the problem it exists to prevent.

If you delete your account, we record the request and remove everything 30 days later. Nothing is destroyed during those 30 days, so if you change your mind you can cancel and the account carries on exactly as it was. We stop emailing you as soon as the request goes in. After the 30 days, all associated personal data and financial data is permanently deleted.

If your account is linked to a partner, the joint accounts, bills and debts you shared are their records as well as yours, and their copy stays on their account: their own forecast is built on it and they remain liable for the debts. We remove the link between the two accounts, so nothing of yours reaches theirs again. Everything held on your own account goes. The delete dialogue in the app says the same thing before you confirm.

The change history on your financial data is kept for as long as the account it belongs to, and is deleted with that account by the same database rule that removes the rest of your data, so there is no separate request to make. We have deliberately not set a shorter period for it: a record of what changed that is trimmed away while the figures it describes are still live cannot answer the question it exists for.

Under the UK GDPR and Data Protection Act 2018, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate data.
• Erasure: ask us to delete your data (“right to be forgotten”). Data retention above sets out the one limit on this: where you share a household, records that are your partner's as well as yours stay on their account.
• Portability: receive your data in a portable format.
• Objection: object to processing we base on legitimate interests, which is the in-app usage data, the website speed and traffic measurement, our marketing emails, and our security monitoring. See “Lawful basis for processing” above for what each one is and why. For marketing email you do not need to write to us at all: the switch in Settings and the unsubscribe link on any of them both take effect straight away.
• Withdraw consent: where processing is based on consent, which here means analytics cookies, you can withdraw it at any time. You can do that yourself, in the Cookies section below, and it takes effect immediately.

To exercise any of these rights, email hello@crestcast.co.uk. We will respond within 30 days.

If you are unhappy with how we have handled your data, tell us first at hello@crestcast.co.uk. You have the right to make a complaint to us as controller. We acknowledge a complaint within 30 days and tell you the outcome without undue delay.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

The CrestCast app sets no cookies at all. To keep you signed in it stores your session token in your browser's local storage, or, in the mobile app, in the device keychain or keystore that your phone provides for exactly this. There is no way to turn it off other than not signing in, it is not used for measurement, and it is not shared with anyone. It stays until you sign out.

A copy of your financial data is kept on your device too, so the app opens instantly and keeps working when your connection does not. On the web that is your browser's local storage; in the mobile app it is storage private to the app, which your phone keeps separate from every other app but which is not the keychain. It is your own data on your own device and it is not readable by any website other than ours, but it is held as plain text rather than encrypted, so it is worth knowing it is there before you sign in on a machine you share. Signing out deletes it. Closing the app does not.

The app itself is kept in an offline cache: its code, its images and its fonts, so it will open without a connection. No figures go in it and nothing about you does. If the app ever fails to load, it keeps one flag in your browser's session storage so that it retries once rather than in a loop; the flag holds nothing about you and is gone when you close the tab.

Analytics on this website, only if you accept: accepting on the banner allows Google Analytics to set cookies in your browser, normally named_gaand one beginning_ga_, lasting up to two years. Their purpose is to recognise several page views as one visit, which is what turns a list of popular pages into a picture of how people move around the site. Until you accept, the Google script is never loaded and no such cookie exists. If you decline, none is ever set.

Advertising: none, and there is no option to turn any on, because there are none to turn on. We never ask for consent to advertising or personalisation storage, because we would have no use for it.

This website keeps three small things in your browser's local storage, and none of them is a cookie. Your answer to the banner above, because a cookie recording that you had refused cookies would be the very thing you had just refused. Whether you have dismissed the “get the app” prompt, for thirty days, so it does not ask again on every visit. And if you arrived through a link one of our affiliates published, that link's public reference, for thirty days, so they are credited if you go on to subscribe. That last one is the affiliate's own public code and nothing about you; it never leaves your browser except in a single request that counts the click, which records the code and the date and no address, device or page of yours.

Vercel Web Analytics and Speed Insights, and our own page count, described above, set no cookie at all, which is why they are not on this list and why they need no consent.

One cookie may be set that is not ours. Our database and sign-in provider, Supabase, lives at its own web address rather than at ours, and the links in our confirmation and password reset emails pass through it on the way back to you. Its network provider sets a short-lived security cookie there, on their address, to tell a person from a bot. We do not set it, we cannot read it, and it carries nothing about your account.

If we make material changes to this policy, we will notify you by email before the changes take effect. The “last updated” date at the top of this page reflects the most recent revision.