Privacy
Modelling your finances means typing your salary, your savings and your debts into something. Most tools ask you to trust a promise about how they handle that. This one is built so the promise is mostly unnecessary — and the parts that still need trust are named below rather than glossed over.
The short version
- Your plan is computed in your browser. There is no server that does the math.
- Your plan is stored in your browser. It reaches our server only if you make an account and press Save.
- An account needs only an email address. A saved plan is encrypted with our key.
- There is no analytics service, no tracking pixel, and no third-party script of any kind.
- The only cookie is the one that keeps you signed in.
- You can export everything as a JSON file, and delete everything from your browser settings.
Why a breach of our servers could not expose your plan
Not because we would protect it well. Because we do not have it.
This site is a set of static files — HTML, CSS and JavaScript. When you open it, your browser downloads those files and then runs everything locally. The tax engine, the projections, the mortgage math, the comparison between scenarios: all of it executes on your machine. Your salary is never transmitted anywhere, so there is no database of user finances to steal, subpoena, sell, or lose. There is no account to compromise and no password to reuse.
That is a structural property, not a policy. A policy can change with a funding round; this would require rebuilding the product.
What is stored, exactly
| What | Where | Why |
|---|---|---|
| Your plans | IndexedDB, this browser (and, for the moment a tab closes mid-save, localStorage) | So your plan is still there when you come back, including the last change you made |
| Your answers to the start questions, until you finish them | localStorage, this browser | So a reload halfway through does not lose them |
| Whether the inputs drawer is open, and whether you hid the example-numbers note | localStorage, this browser | So the page opens the way you left it |
| That you agreed to the terms and acknowledged this policy: the version of each, and the date | localStorage, this browser | So the two notices before the tools do not reappear every visit, and appear again when either changes |
| The life events you are trying out on the Life events page | localStorage, this browser | So they are still there when you come back to that page |
| How you set the pages up: light or dark, today's dollars, the table columns, the House page's side panel, the order and width of the dashboard cards, and notices you closed | localStorage, this browser | So each page opens the way you left it |
| For this tab only: what the start questions filled in, to say once when the plan opens | sessionStorage, this tab; gone when the tab closes | So the plan can say which numbers came from your answers |
| For this tab only: the campaign name from the link you arrived by, if it had one | sessionStorage, this tab; gone when the tab closes | Sent once, if you make an account in this tab (see below) |
| Which plan in your account this browser's plan was last saved to | localStorage, this browser | So the next Save updates that plan instead of making a new one |
That is the complete list. All of it lives only in this browser on this device. They do not sync, they are not backed up by us, and we cannot read them. Clearing your browser's site data for this domain erases all of it permanently — which also means that is your delete button, and there is no “delete my account” request to file because there is no account.
If you use a private window, storage is discarded when you close it. The tools still work; it simply will not remember anything.
It is stored as it is, not encrypted: anyone who can use this browser on this device can open the tools and see your plan. On a shared or family computer, erase it when you are done.
If you make an account
An account is optional. Without one, everything above stays true. With one, we hold the following, and nothing else.
| What | Why |
|---|---|
| Your email address and the date you joined | To send you sign-in codes. There is no password. |
If you came from a link with a campaign name in it (such as utm_source=reddit): that name | To count how many accounts each place we advertise brings, from our own records instead of a tracking service. It is saved once, when the account is made, and never with the page you were on. |
| A record of each signed-in device: a scrambled copy of its sign-in token and when it expires | So you stay signed in. We do not record your IP address or your browser. |
| The plans you choose to save | So you can open them on another device. Nothing is saved until you press Save. |
| If you pay: your subscription's status and renewal date | To know which features you have. Stripe holds your card; we never see the number. |
Saved plans are encrypted with our key before they are stored, with their names. Someone who obtained a copy of our database or its backups could not read them. Someone who obtained our key as well could, so we keep the key apart from the database.
We never ask for a social insurance number, account numbers, a link to your bank, or a full date of birth: a plan needs only the year you were born. Names in a plan can be nicknames.
Where it is stored. Accounts and saved plans are kept by Cloudflare, which runs this site. Cloudflare cannot promise to keep a database in Canada, so your account may be stored in another country, usually the United States, and the authorities there may be able to obtain it under their laws.
Deleting your account removes your email, your sign-ins and every saved plan in one step, and ends any subscription so you are not charged again. Our database backups keep a copy for up to 30 days, after which it is gone. If a backup is ever restored, a record of the deletion (a random number and a scrambled form of your email, kept 40 days) makes sure the account is deleted again. We keep only what tax law requires of our own sales: the invoice, its date, amount and tax, for six years. Exporting and deleting both ask you to sign in again if your last sign-in was more than 15 minutes ago.
If something goes wrong. We keep a record of every incident that affects personal information, from the first day. If one creates a real risk of significant harm to you, we tell you and the Privacy Commissioner of Canada as soon as we can.
What we can honestly still see
Being precise matters more here than sounding absolute. Serving a website means a server receives a request for it.
- Our host sees page requests. This site is served by Cloudflare Pages. Like any web host, it receives the ordinary metadata of an HTTP request — your IP address, your browser's user-agent string, which page you asked for, and when. That is how the file reaches you at all. It reveals that someone visited; it does not reveal anything you typed, because nothing you type is ever part of a request.
- Network errors may be reported. Cloudflare can send a standard Network Error Logging header, which asks browsers to report connection failures to Cloudflare (the address that failed, the timing and the browser). Cloudflare adds it after our own headers, so it is still sent; it reports nothing on successful loads, and it never carries anything you typed.
We do not add anything on top of that: no logging of our own, no analytics account, no session recording, no A/B testing service, no advertising network.
Your data, in your hands
Export writes every scenario to a JSON file you keep. It is plain, readable text with a schema version — not a proprietary format designed to trap you. Import reads it back, on this device or another one. That file is how you move between machines, keep a backup, or take your work with you if you stop using this tool.
Because that file contains your finances, treat it like any financial document: it is as private as wherever you put it.
If that changes
Some features people ask for genuinely cannot work this way — syncing between your phone and laptop, or sharing a plan with an advisor, both require a server to hold something. We have not built those. If we ever do, it will be opt-in, it will be described here in this same plain language before it ships, and the local-only path will keep working for people who want it.
Connecting to your bank accounts automatically is not planned. It is the single largest thing we could do to make this product easier and the single largest thing we could do to make it more dangerous to you, and that trade is not currently worth making.
The rest of the honesty
Privacy is one kind of trust; being right is the other. Every rate, bracket and premium in this tool traces to its source — CRA, CMHC, OSFI or statute, with the few checked only through secondary sources marked on the sources page — and the projection tells you plainly where it is approximating rather than burying the caveat. See the plan's warnings, which are shown, never swallowed.
This page describes how the software works, and is not a contract. The information-not-advice terms are on the terms page, and a short version is shown before you first use the tools.