Upside

Is Upside safe?

Upside is one of the safer cash-back apps to use, as long as you accept that your purchases and location feed its advertising. It is a single-purpose app from a company that lists ISO 27001, SOC 2 Type 2 and PCI DSS audits, and we found no reported breach and no regulator action against it in ten years on the App Store. We score it 58/100, above Ibotta at 54 and Fetch at 48, mainly because it does not ask for your inbox or your loyalty passwords and says it does not sell users' data.

The catch is account protection. Upside stopped refunding cash-outs made by someone who breaks into an account on 16 June 2020, and the extra sign-in check that would make that less likely is still rolling out.

The app is popular: 689,068 US App Store ratings averaging 4.8, about 456,000 Google Play reviews, and 13th place in the App Store's free Travel chart in October 2026.

What Upside does with your location and card

Upside works differently from receipt apps. You claim an offer, pay at the pump or till with a card saved in the app, and Upside matches that card against transaction data the merchant sends. The privacy policy says that by signing up you instruct participating merchants to send your purchase history at their stores to Upside, and Upside shares your history at each merchant back with that merchant.

A linked card is required. Upside says a third-party processor holds the full card number and that it keeps only the first six and last four digits. If you cash out to a bank, Plaid handles the login and Dwolla sends the money, and the policy says Upside may collect purchase history through its financial partner "to provide more personalized Services".

Location is the other half. The app uses precise location to show nearby offers and confirm purchases, and the help centre walks you through setting location access to Always so it can alert you near offers. Apple's label lists precise location as linked to you.

Does Upside sell your data?

Not in the narrow sense. The policy says Upside does not sell personal data from the app or the transaction data merchants send, and its state-law chart lists sales only for business contacts, not app users.

Sharing for ads is another matter. The same chart says identifiers, purchase history, internet activity, location data and inferences drawn about you are "shared" with third-party advertising partners for targeted ads. The policy's location section adds that device location, combined with the ads you viewed, may go to marketing partners. Apple's label shows only product interaction as used to track you, so it understates what the policy allows. Google Play's form lists purchase history collected for advertising and marketing.

You can opt out. In the app, open Account, then Data and privacy, then Your privacy choices. Upside also honours Global Privacy Control signals in browsers.

How secure is an Upside account?

The company side looks strong. Upside's trust centre lists ISO/IEC 27001:2022, SOC 2 Type 2 and PCI DSS v4.0.1, names Coalfire and Schellman as reviewers and offers a pen test report on request. Its security page says data is encrypted with AES-256 at rest and TLS 1.2 or newer in transit. Its Google Play form says the opposite ("data isn't encrypted" in transit), which looks like a form error, but it is what Android users see. Security reports go through a disclosure programme hosted by Inspectiv; we found no paid bug bounty.

The user side is weaker. You sign in with a password or with Apple, Google or Facebook. Upside is adding an emailed one-time code for sign-in, cash-out and new bank accounts, but its help page says the feature "is being rolled out over time" and some users will not see it yet. Bank cash-outs already need a click on a link sent to your email. There is no authenticator-app option. Since 16 June 2020 Upside has not refunded unauthorised cash-outs, so the security of your balance rests on your password and your email account.

Suspensions, expiring balances and the referral lawsuit

Most disputes with cash-back apps are about money that never arrives. Upside's terms let it suspend an account and cancel pending or current cash back "in its sole discretion" for breaking the rules. The help centre lists fake receipts, multiple accounts, breaking referral rules and disputing valid Pay with Upside charges, and families sharing one phone can trip the multiple-account check. There is an appeal form.

Two rules deserve attention. The terms say cash back expires after six months without earning or cashing out, while a help page says it never expires while the account is in good standing; we go by the terms. And the terms require arbitration and a class-action waiver unless you opt out in writing within 30 days of signing up.

In 2023 a personal-finance creator filed a proposed class action after Upside stopped, from December 2021, paying referral bonuses for codes it believed were promoted beyond friends and family; he alleged it had promised lifetime referral payments. A federal court in San Francisco dismissed the case with prejudice in September 2024, holding it was filed too late under the terms. A lawsuit is not a regulator finding, so it does not change the score.

How to use Upside more safely

1. Use a unique password, and secure the email account behind it with two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary sign-in, since cash-out codes go there.
2. Set location to While Using rather than Always.
3. Opt out of ad sharing under Account, Data and privacy, Your privacy choices.
4. Link only a card you use for gas and groceries, and delete old cards from the Wallet.
5. Cash out at least every few months, and before you delete the account.

How we scored it

Regulatory record (87) is the strongest factor: no fine, order or breach notice in ten years, but no large regulator has examined the app. Scams and harmful content (72) is lowered by a 4+ store rating for an app the terms limit to 16 and over. Privacy (40) is the weakest, because purchase history, location and inferences go to ad partners even though Upside does not sell them. Security (60) balances strong company audits against weak account protection and no refunds after a takeover.