Privacy Policy

Effective: May 18, 2026 ยท Updated: September 13, 2026 ยท Compliant: Law 25 (Quebec) + PIPEDA (Canada)

๐Ÿ In short

Data saved in our database is hosted in Canada (Supabase ca-central-1). Budget uses balances, income and expenses you enter or import manually; it does not connect to your bank or transfer money. You can export your budget from Budget, delete your account from settings, or request a copy of your data at support@mywealthwise.ca.

Table of contents

1. Data collected

1.1 What you provide

DataPurposeLegal basis
Email, nameAccount creationExplicit consent
Email, language and requested resourceDeliver a requested checklist and follow up by emailExplicit consent
Password (bcrypt hashed) or Google OAuthAuthenticationContract performance
Symbols, quantities, purchase pricesPortfolio analysisContract performance
Financial goals (FIRE, retirement)Personalized projectionsConsent
Manual Budget: account names and balances, income, expenses, CSV-imported transactions, scheduled items and reservesSave your budget and calculate forecasts at your request; no bank connection or automatic financial transactionContract performance
Bug reports and suggestions: message, category, relevant page and associated accountHandle your feedback and improve the service; do not include passwords or sensitive financial informationContract performance
Preferences (language, currency, alerts)PersonalizationConsent

1.2 Automatic collection

1.3 What we NEVER collect

2. Processing purposes

  1. Contract performance: create your account, calculate your portfolio, display your alerts.
  2. Legal obligations: retain transactions for tax obligations (CRA / Revenu Quรฉbec).
  3. Legitimate interests: security, anti-fraud, performance.
  4. Explicit consent: newsletters, AI improvements via anonymized data.

3. Third-party sharing

These providers support the relevant features. Optional advertising measurement requires the separate consent described below:

Third partyDataCountry
Supabase (database hosting)All (except password)๐Ÿ Canada (ca-central-1)
Google Gemini APIAnonymized portfolio (no email/identity)๐Ÿ‡บ๐Ÿ‡ธ United States
Stripe (Premium payments)Email, subscription amount๐Ÿ‡บ๐Ÿ‡ธ United States
Resend (emails)Email address, language and message content: requested checklist, account notifications and, with marketing consent, reminders and recaps. A personalized recap may contain the amounts and holdings displayed in it. Delivery, bounce, complaint and unsubscribe status and, when tracking is enabled, opens and clicks.๐Ÿ‡บ๐Ÿ‡ธ United States
Vercel Web AnalyticsAggregated pages and interactions, without email address or form content๐Ÿ‡บ๐Ÿ‡ธ United States
SnapTrade (broker connector โ€” read-only, optional)Positions and transactions from the broker accounts you choose to connect. No password, no trades, no fund transfers.๐Ÿ Canada (Toronto, ON)
Google Ads (ad conversion measurement โ€” only after consent)Anonymous advertising identifier + page URL visited. Activated only if you accept advertising cookies via the consent banner. Default: denied (Consent Mode v2). You can withdraw consent at any time.๐Ÿ‡บ๐Ÿ‡ธ United States
Yahoo Finance APIPublic symbols only๐Ÿ‡บ๐Ÿ‡ธ United States
Meta (optional pilot for eligible new registrations)Only when the pilot is technically enabled, after eligibility checks and separate Meta consent: confirmation and time of a new registration, IP address, browser information, optional advertising identifiers and a random deduplication identifier. No email, name, WealthWise account identifier, brokerage, holding, amount or budget data is sent.United States and other countries where Meta and its providers process this data

Transfers outside Canada are governed by standard contractual clauses (SCCs) and the EU-US Data Privacy Framework. No broker, no fund, no portfolio data is shared with any advertiser. Google Ads (above) receives only a generic advertising identifier and the page visited, and only if you enable advertising cookies.

Marketing emails help with getting started and offer a useful reason to return to the app. Links may contain a campaign identifier, not a sign-in credential. Opens and clicks are imperfect technical indicators, not proof that a message was read. Unsubscribing, available without signing in from every marketing message, stops those emails; essential security and account messages remain separate. You can also write to support@mywealthwise.ca.

4. Data retention

DataDuration
Active accountWhile using the service; immediate in-app deletion or processing within 30 days for an email request
Imported portfolio & transactionsUntil the account is deleted
Saved BudgetUntil you clear it in Budget or delete your account. Downloaded JSON/CSV copies remain under your control.
Billing records held by the payment providerAs required by the provider's applicable legal obligations
Access logs (IP)90 days
Authenticated usage events and technical session categoriesUntil the account is deleted; current reporting dashboards use a maximum 90-day window
Session cookiesSession or 30 days
Email consent and exclusionsProof is retained while we rely on the consent. A minimal exclusion record is kept to prevent accidental resubscription, including after a contact is removed from the mailing list.

5. Your rights (Law 25, art. 9)

To exercise a right: visit the account-deletion page or email support@mywealthwise.ca โ€” response within 30 days.

6. Security

7. Cookies

Optional Meta measurement โ€” eligible new registrations

Separate initial notice for new relationships โ€” version meta-new-relationship-2026-10-20-v1. This notice describes the optional pilot for measuring eligible first registrations. It is presented before any registration made eligible for the pilot, followed by a separate Meta choice. Sending remains conditional on technical activation of the pilot, server-side checks and your Meta consent. Publishing this notice does not prove that tracking is active or that Meta has received an event. Reading this notice or creating an account does not activate Meta.

Previous accounts and registrations: no historical event will be sent. A recently created account does not make a previous relationship eligible, including an earlier newsletter or waitlist registration. This initial notice does not retroactively replace their policy or the notice-period commitment below; server-side checks exclude previous relationships found in our records without enrolling older accounts in this measurement.

A genuine choice: rejecting this option does not limit the free account. It remains denied by default. Previous Google, analytics or newsletter permission does not authorize Meta measurement. Only when the pilot is enabled, after eligibility is confirmed and separate Meta consent is given, we may send one confirmed-registration event to Meta Platforms, Inc. to measure and optimize our advertising.

Data and uses: the event includes registration confirmation and time, a random event identifier to prevent duplicates, IP address, browser information and, if available after consent, ad-click or browser-cookie identifiers. These details are not anonymous: Meta may match them to other information, including your activity or Meta account. Its terms also provide for uses to improve ad delivery and personalize features or content on and off its platforms. The event sends no email address, name, WealthWise account identifier, brokerage, holding, amount or budget data. No Meta pixel or SDK is embedded in the browser.

Processing outside Canada: Meta and its providers may process this information outside Quebec and Canada, including in the United States, the European Union or European Economic Area and other countries. Foreign authorities may have access under their laws. A prior assessment has examined this limited flow, contractual and technical safeguards, and residual risks; it guarantees neither the absence of risk nor hosting in Canada. See the Meta Business Tools Terms and Metaโ€™s privacy policy.

Separate retention periods: the first-party cookies capi_fbc (an ad click, if available after consent) and capi_fbp (a random browser identifier) expire after a maximum of 7 days. The delivery ledger links the account to the event identifier, status, language and technical timestamps. It stores no IP address, browser information or advertising identifier. The ledger, separate minimal evidence of the initial notice, choice and withdrawal, and pseudonymous email fingerprints used to verify eligibility become eligible for erasure 30 days after server capture. These fingerprints are not anonymous and are not sent to Meta. These records are deleted at the next daily check, normally within 24 hours, or earlier upon account deletion. A failed check must be corrected and may delay erasure: we do not promise deletion at the exact minute of the thirtieth day. Metaโ€™s Business Tools Terms provide for event-data retention of up to two years; this is not a promise that all matched or derived information is erased at that deadline.

Withdrawal and rights: from the signed-in application, open cookie preferences to reject or withdraw the Meta choice and delete these cookies from this device. Once withdrawal is confirmed by the server, future sends and retries for the account are blocked, including from other devices. On this public page, the button below manages available local choices, including Google; it does not by itself withdraw a Meta permission for an account. Withdrawal does not recall an event already transmitted or automatically delete data held by Meta. To withdraw permission without accessing the application, request access or erasure, or exercise a right concerning this data and consent evidence, email support@mywealthwise.ca; we will handle the request and pass it to the relevant recipient when necessary.

CookieUseConsent
session_idAuthenticationRequired (essential)
language_prefLanguage (FR/EN)Implicit
themeLight/dark modeImplicit
Google Analytics (if enabled)Anonymous statistics๐ŸŸก Opt-in
capi_fbc, capi_fbpMeta attribution for new registrations; maximum 7-day durationSeparate Meta opt-in, denied by default
Vercel Web AnalyticsAggregated page and product interaction measurement without personal identifiers or third-party cookiesCookie-free

8. Contact & DPO

Data controller: WealthWise (publisher of the service)

Data Protection Officer (DPO): reachable at support@mywealthwise.ca

Email: support@mywealthwise.ca

Supervisory authority: Commission d'accรจs ร  l'information du Quรฉbec (CAI) โ€” you may file a complaint there if you are not satisfied with our response.

Changes to this policy

Any material change will be notified by email at least 30 days before it takes effect.