Privacy
Last updated 16 August 2026
You type your numbers in; nothing connects to your bank. We store them so your plan can be recomputed, we send a limited slice to a small number of named services to make specific features work, and we do not sell any of it or use it for advertising. You can export everything and delete everything from inside the app.
What we collect
Everything financial in Toonies is either typed in by you or read out of a bank statement you chose to import. There is no bank connection. We hold no banking credentials, we have no integration with any aggregator, and there is no way for us to reach your accounts.
What that leaves is the following, all of it supplied by you:
- Your household. Names you give household members, province, birth year, marital status, income and income type, dependants and their birth years, employer pension and match details, risk tolerance and goals.
- Accounts. Account names, institution names, types, balances, interest rates, estimated fund fees and contribution room — plus a monthly balance reading for each, if you use the check-in.
- Transactions. If you import a statement: the date, description, merchant, amount and category of each row, plus any note you add.
- Mortgage and fixed costs, where you have entered them.
- Account identity. Your email address and a user identifier, both from our sign-in provider.
- Subscription state. Whether your subscription is active, and an identifier for your customer record with our payment processor.
We never receive your card details.Payment is collected on our processor’s own checkout page; card numbers do not pass through Toonies and we cannot see them.
Where it is stored
Two places. A copy lives in your browser’s local storage, which is what makes the app work without waiting on the network. A copy is also written to our database, as a single record per household, so your plan survives clearing your browser and opening it on another device.
That database record contains the whole of the above, transactions included. It is not split up, filtered or redacted before it is stored.
Our infrastructure providers — hosting, database, sign-in, payments, email — operate internationally, and your information may be stored or processed outside Canada, where it can be subject to the laws of the country it is held in. If a specific residency guarantee matters to you, ask before you sign up rather than after.
Who else sees it
We use a small number of named services. Each one gets a specific slice for a specific purpose, and none of them gets everything.
| Service | What it receives | Why |
|---|---|---|
| Clerk | Your email and sign-in credentials | Signing you in. Passwords and any social-login identity stay with them and are never in our database. |
| Neon (Postgres) | The full household record described above | Storing your plan between sessions and devices. |
| Vercel | Ordinary request data — IP address, page, browser | Serving the site. Standard server logs. |
| Stripe | Your email and two internal identifiers; card details go to them directly, never through us | Taking payment. They receive no financial data from your plan. |
| Anthropic | Only when you ask a question: the question itself, plus your Stage, findings and their arithmetic, account names and balances, net worth, monthly income and expenses and take-home, and average spend by category | Answering the question. Individual transactions and merchant names are deliberately excluded and never sent. Nothing is sent unless you ask something. |
| Resend | Your email address, and the digest contents — finding names, per-finding annual dollar figures, and a summary score | Sending the digest, if you have it switched on. Balances, transactions and income are not in it. |
| Google Analytics | Five page-level events, with IP anonymisation on and ad personalisation off | Knowing which screens get used. Amounts, balances, incomes, net worth, merchants and account names are stripped in code before anything is sent — see below. |
Analytics never carries a number you typed. The tracking function removes any property whose name looks like an amount, balance, salary, income, net worth, merchant or account, and any value containing a dollar sign or a run of four or more digits. The ceiling is your province and coarse buckets. Analytics is only active where it has been configured; where it has not, the script is not loaded at all.
If you send feedback through the widget in the app, we receive your message, the page you were on, your browser’s user-agent string and your user identifier. Bear in mind that a free-text box will carry whatever you paste into it.
What we do not do
- We do not sell your information, and we do not share it with data brokers or advertisers.
- We do not run advertising in the product.
- No finding is paid for. There are no affiliate placements on any screen that assesses your situation. If that ever changes, it will not change on the assessment surfaces — an assessment that recommends and an affiliate that ranks cannot share a screen.
- We do not use your data to train models.
- We do not have access to your bank.
Security
Your data is transmitted over TLS and stored by providers who encrypt it at rest. Sign-in, including passwords and any multi-factor setup, is handled by a dedicated provider rather than by us, so there is no password of yours in our database to leak. Card details never reach our servers.
The honest limit: this is a small product, not a bank. It has no formal security certification, no third-party audit and no bug-bounty programme. What it does have is a deliberately small surface — no bank connections, no card storage, no file uploads, and one database record per household.
Statement files you import are read in your browser. The file itself is never uploaded; only the transaction rows it produced become part of your plan.
Getting your data out, and getting rid of it
Export.Settings › Data will download your transactions as a CSV at any time.
Reset. The same screen clears your financial data and starts you over, while keeping your account.
Delete.Settings › Delete your account removes your sign-in record and, if you are the last member of your household, the household record and everything in it — transactions included. If someone else is still in the household, only your own membership is removed, because the plan is theirs as much as yours.
Two things deletion does not reach, stated plainly:
- Billing records. Our payment processor keeps the invoice history it is required to keep. We cannot delete it and neither can you.
- Things already sent. A digest email already delivered to your inbox, and ordinary server logs, are not retrieved.
Local storage on your own device is cleared by Reset or Delete from within the app; if you want to be certain, clearing site data for this domain in your browser removes it outright.
How long we keep it
Until you delete it. We do not run an expiry schedule, and your plan is not aged out or archived — the product’s whole job is comparing this month against the last, which it cannot do to data it has thrown away. Household invitations expire seven days after they are created.
Your rights
Canadian privacy law gives you the right to know what personal information we hold about you, to see it, to have inaccurate information corrected, and to withdraw consent. Most of this is available to you directly in the app; for anything that is not, write to us at the address below and we will answer.
Children
Toonies is not for anyone under 18. We do not knowingly collect information from children. A household can record a dependant’s name and birth year — that is information about a child, entered by an adult, and it is used only to work out benefit and grant eligibility and the dates attached to them.
Changes
If this changes in a way that affects what we collect or who receives it, we will change the date at the top and tell you in the product rather than quietly reposting the page.
Contact
Questions, requests and complaints: privacy@toonies.co.