Data Report Card · Cash App
Cash App Data Report Card
P2P payments · Block, Inc.
Data
Practices
Practices
2Access1Portability1Friction1Deletion1Sells0Trains AI
=
C
6/12
Agent
Readiness
Readiness
2Access
1Portability
0API access
=
C
3/6
Agent Readiness is a derived signal — a synthesis of two existing cells (Access, Portability) plus one sourced factor (API access), not an independently measured grade. API access scale: Best (2) consumer-grantable API · Moderate (1) partial / encumbered · Restrictive (0) manual export only. What is Agent Readiness?
Reviewed Jun 2026 · some cells re-verified Aug 2026 · policies are checked weekly for changes · stated — every cell is read from Cash App's published policy; none has been tested (run by us) yet.
2Accessstated
Self-serve: “Under Security and privacy … click Download your info” at cash.app/account returns a copy of your personal information, and the right “to receive the specific pieces of your personal information” is stated — extended “to all customers”, not just CCPA states.
Cash App Help — Access and delete your personal information · accessed Aug 2026 ↗1Portabilitystated
The self-serve download delivers “a .csv file containing your Cash App personal information” plus transaction-history downloads — a single stated format with coverage not itemized, the single-format level.
Cash App Help — Access and delete your personal information · accessed Aug 2026 ↗1Frictionstated
Download is self-serve, GPC opt-out signals are processed and a “Your Privacy Choices” footer link exists — but deletion runs through a support chat or phone call, no email or web form exists, Do Not Track is not supported, and no response window is stated.
Cash App Privacy Notice — your rights / opt-out signals · accessed Aug 2026 ↗1Deletionstated
Deletion is reachable but chat-gated, and the scope is narrow: “as a financial institution Cash App is legally required to maintain some transaction records and account information”, retention criteria are open-ended, no purge timeline is stated, and the notice says state privacy rights “do not apply to personal information governed by GLBA”.
Cash App Privacy Notice — retention / GLBA scope · accessed Aug 2026 ↗1Sells / sharesstated
The notice is candid: “while we do not sell personal information as that term is commonly understood, we ‘share’ personal information for advertising purposes … to show you targeted ads about our Services across the internet” — identifiers, geolocation and network activity go to advertising partners, with a working opt-out (link + GPC).
Cash App Privacy Notice — sale/share disclosures · accessed Aug 2026 ↗0Trains AIstated
The notice states Cash App uses personal information for “training artificial intelligence (AI) and other machine learning models” for service improvement and for safety — and contains no AI-training opt-out. Trains by default with no stated opt-out.
Cash App Privacy Notice — how we use your information · accessed Aug 2026 ↗0API access — feeds Agent Readiness, not the /12stated
developers.cash.app offers merchant and partner payment APIs (Cash App Pay, Afterpay) that let a business charge a customer — there is no consumer OAuth API for fetching your own account data; the self-data path is the in-account CSV download.
Cash App Developers (merchant APIs only) · accessed Aug 2026 ↗Graded 2026-08-31 against the Cash App Privacy Notice (effective Jun 8, 2026) and Cash App's help-center articles. Consumer surface = the Cash App app and cash.app, operated by Block, Inc. and its affiliates; affiliated products (Cash App Investing LLC, Cash App Taxes, Sutton Bank) carry their own notices. Access and download are self-serve and extended “to all customers” regardless of state, but deletion ends in a support chat, no response window or purge timeline is stated anywhere, and the notice states its state-rights section does not apply to information governed by the GLBA — which covers most Cash App customer data. The notice trains AI on user data for service improvement and safety with no stated opt-out. Regulators have published four actions against Block since 2025 (CFPB $175M, state regulators $80M, NY DFS $40M, multistate AGs $45M) — all fraud-handling or AML conduct, none a data-practices action, so under the two-lane rule none deducts here. All cells stated, not tested.
Events
Breaches, policy changes, and export-format changes we’ve recorded at Cash App — other parties’ actions, alongside the enforcement record above. An event never changes a grade by itself. All events →
No events on record for Cash App.
Grade history
Every change to this company’s grade since it was first published, and why. All grade changes →
No changes since this grade was first published in Jun 2026.
How to request your data from Cash App
- Go to https://cash.app/help/US/EN-US/6498-delete-personal-information — Cash App's data-request entry point.
- Web: cash.app/account → Security and privacy → Download your info (CSV); deletion via support chat or 1-800-969-1940 — no email, no web form.
- Expected wait: no stated response window; requests answered “consistent with applicable law” — Cash App's stated turnaround (we haven't independently timed a request yet).
These steps reflect Cash App's documented process as of Jun 2026. The wait time is the company's stated figure, not yet independently measured by us.