Privacy Policy

Your account. Your email address, an optional display name, your password (stored only as a secure hash by our authentication provider) and, if you turn it on, your two-step sign-in settings and recovery codes.

What you enter. Your portfolios and account types, transactions, cash balances, notes, goals, allocation targets, mortgages and other debts, investor profile answers, statements and screenshots you upload to read figures from, questions you ask the AI and its answers, and problem reports you send us.

How you use the app. Which pages you open and when (for our own usage statistics), when AI features run and what they cost, and technical events such as errors and sign-in lockouts, which we use to keep the service working and secure.

We don't collect your broker or bank credentials, and we don't use advertising or third-party tracking cookies.

• To run the service: calculate your holdings, gains, risk and goals, and show them to you.
• To run the AI features you choose to use, with the figures each one needs.
• To keep your account secure, prevent abuse and fix problems.
• To answer the reports and questions you send us.
• To understand, in aggregate, which parts of the app are used, so we can improve it.

By creating an account and using Finance, you consent to the uses above. Optional features ask first: news and web search for the AI are off until you turn them on. You can withdraw consent by turning a feature off or deleting your account; some uses (such as keeping security logs for a limited time) continue as the law allows.

We use a small number of service providers, each bound by contract to protect your information and use it only to provide their service to us:

• Supabase: our database and sign-in. Your account and everything you enter is stored there.
• Vercel: hosts the app and runs it.
• Anthropic (Claude): when you use an AI feature, the figures it needs from your portfolio are sent to Anthropic to generate the answer. Anthropic doesn't use this data to train its models.
• Google (Gemini): only if we enable it on a paid plan, on the same terms; never on a free plan that could use prompts for training.
• Perplexity: runs web searches for the AI when you turn web search on. Searches name companies or topics, never your own figures.
• Market-data providers (such as Finnhub and Financial Modeling Prep): receive the ticker symbols we need prices and news for, not your holdings or anything about you.
• Cloudflare Turnstile: if enabled, checks that sign-ins come from a person, not a bot.

We don't sell, rent or share your personal information with anyone for their own purposes.

Your data is stored in [Canada (Central) or the region your Supabase and Vercel projects use]. Some of our providers, including Anthropic, Perplexity and Vercel, process information in the United States or other countries. When information is processed outside Canada (or outside Quebec), it's subject to the laws of that country, and authorities there may be able to access it. We choose providers with strong security and contractual protections.

• Your account and what you enter: until you delete it, or delete your account.
• AI research conversations: deleted automatically after 90 days without a new message.
• Security and error logs: 90 days.
• When you delete your account, your data is deleted from the live database right away and from our providers' backups as those backups expire.

Connections are encrypted, every table holding your data is restricted so only you can read it, staff tools that reach across accounts are limited to administrators who use two-step sign-in, and we log and review security events. No system is perfectly secure; if a breach creates a real risk of significant harm to you, we'll tell you and the regulators as the law requires.

• See and take your data: export a full backup or a spreadsheet of your transactions from Settings at any time.
• Correct it: edit or delete anything you've entered.
• Delete it: delete your account from Settings, which removes your data.
• Ask us: for access to the information we hold about you, how it's used, or anything in this policy, write to us at [privacy@your-domain]. We'll answer within 30 days.

If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or, in Quebec, the Commission d'accès à l'information.

Finance is for people 18 and over. We don't knowingly collect information from anyone younger.

If we change this policy in a way that matters, we'll tell you in the app or by email before the change takes effect. The date at the top shows when it last changed.

[Company legal name] is responsible for your personal information. Our person in charge of privacy is [Name, title], reachable at [privacy@your-domain].