Privacy Policy

Last updated: May 10, 2026

This Privacy Policy explains how Savings Chart ("we", "us", "the service") collects, uses, stores, and protects information about visitors and registered users of saving-chart.ca (the "Site"). We are based in Canada and our handling of personal data is intended to comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Law 25, and, where applicable, the EU/UK General Data Protection Regulation (GDPR).

The short version: we collect the minimum we need to run your account (email, hashed password, 2FA codes, your budget data). We never sell your data. You can delete your account at any time by emailing [email protected].

1. Information we collect

1.1 Account data

Email address — used to identify your account, verify it via a one-time code, and send security notifications.
Password — never stored in plain text. We store a one-way bcrypt hash of your password. Even we cannot recover it.
Two-factor codes — temporary 6-digit codes generated when you sign in. Codes expire after 10 minutes and are deleted from our database after use.

1.2 Budget data

Anything you enter into your budgets (category names, amounts, currency, monthly snapshots) is stored under your account so we can show it back to you when you sign in. We do not analyze your budget data, share it with third parties, or use it for advertising.

1.3 Technical data

IP address and basic request logs — kept temporarily by our reverse proxy and content delivery network (Cloudflare) for security, abuse prevention, and uptime monitoring.
Browser and device information — your browser sends this to every website (User-Agent, language, etc.). We do not store it long-term.

2. How we use your information

To create and manage your account.
To verify your identity at sign-in via two-factor authentication.
To save and display your budget data when you return.
To send you essential service messages (security alerts, password recovery — not marketing).
To detect, prevent, and respond to abuse, fraud, and security incidents.

We do not use your data for advertising profiling, and we do not sell or rent it to anyone.

3. Cookies and local storage

The Site uses browser local storage (a small per-domain key-value store, similar to cookies) to keep you signed in between visits. The values stored are:

sc_token — your authentication token, used so you don't have to sign in on every page load.
sc_email — your account email, displayed in the app header.
sc_consent — records your cookie-banner choice so we don't ask again.

These are essential for the service to function. If you decline cookies or clear your browser storage, you'll need to sign in again on each visit.

3.1 Third-party advertising (planned)

We may, in the future, display advertisements on certain public pages of the Site through Google AdSense. If and when we do:

Google, as a third-party vendor, may use cookies to serve ads based on your prior visits to this and other websites.
Google's use of advertising cookies enables it and its partners to serve ads based on your visit to the Site and/or other sites on the Internet.
You may opt out of personalized advertising by visiting Google Ads Settings, or by visiting aboutads.info for the broader advertising industry's opt-out tools.

Advertising will only appear on public pages such as the homepage, About, and any future blog content. No advertising will appear inside your signed-in budget editor or near your personal financial data.

4. Third parties we share data with

We use a small number of trusted service providers to operate the Site. They only receive what they need to provide their service:

Resend (privacy policy) — sends our two-factor authentication emails. Receives your email address and the 6-digit code.
Cloudflare (privacy policy) — proxies traffic to the Site for security, caching, and SSL. Receives your IP address and request metadata.
Google AdSense (privacy policy) — only if and when ads are enabled on public pages. See section 3.1.

5. How long we keep your data

Account and budget data: retained for as long as your account is active. Deleted within 7 days of an account-deletion request.
Two-factor codes: deleted automatically after use or after 10 minutes, whichever comes first.
Server logs: rotated and discarded within 30 days unless required for an active security investigation.

6. Your rights

Under PIPEDA, GDPR, and similar laws, you have the right to:

Access the personal data we hold about you.
Correct inaccurate data — most data (email, budgets) you can edit yourself in the app.
Delete your account and all associated data.
Export your budget data — contact us and we'll send you a copy.
Withdraw consent for processing at any time.
Lodge a complaint with a privacy regulator (for example, the Office of the Privacy Commissioner of Canada).

To exercise any of these rights, email [email protected].

7. Security

We protect your data with industry-standard measures including HTTPS for all traffic, bcrypt password hashing, two-factor authentication, JWT-based sessions, and a hardened server configuration. No system is perfectly secure, but we work to minimize risk and notify affected users promptly if a breach occurs.

8. Children's privacy

The Site is not intended for children under 13 (or under 16 in jurisdictions that require it). We do not knowingly collect personal data from children. If you believe a child has created an account, please contact us and we will delete it.

9. Changes to this policy

We may update this Privacy Policy as the service evolves. The "Last updated" date at the top will reflect any change. For material changes, we'll notify registered users by email.

10. Contact

For any privacy question or request, write to:

[email protected]