Privacy Policy

BuckWise is a personal finance logging and analysis application operated for users in Canada. This policy applies to the BuckWise website (https://buckwise.ca) and the BuckWise application (together, the “Service”). If you have questions about this policy or how your information is handled, contact us using the details in Section 13.

We use the information described above solely to:

• Provide, operate, and maintain the Service, including the calculations, charts, and analysis features you see in the app;
• Create and secure your account, authenticate you, and keep your session secure;
• Respond to your support requests and communicate with you about your account;
• Detect, investigate, and prevent fraud, abuse, and security incidents; and
• Comply with our legal obligations.

We share information only with the service providers below, each of whom processes it solely to help us operate the Service, and only to the extent described:

We may also disclose information where required to comply with a valid legal process (such as a court order or subpoena), to enforce our Terms of Service, or to protect the rights, property, or safety of BuckWise, our users, or the public. If BuckWise is ever involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction; we will notify you before your information becomes subject to a different privacy policy.

We may add or change service providers as the Service evolves. Any new provider that would receive your personal or financial information will be added to the table above, and material changes will be announced per Section 12.

BuckWiseis operated from Canada, but our database infrastructure provider (Neon) hosts our production database in the United States. This means your personal and financial information is stored and processed outside of Canada, and may be accessible to courts, law enforcement, and national security authorities of the United States under that country’s laws. By using the Service, you acknowledge and consent to this transfer. We select service providers that maintain appropriate technical and contractual safeguards for the information they process on our behalf.

We use a small number of first-party cookies to operate the Service. We do not use third-party advertising cookies, and no cookie on BuckWise is used to track you across other websites.

You can block or delete cookies using your browser settings, but the Service requires the session cookie to keep you signed in. Blocking it will prevent you from using the Service.

We take the security of your information seriously and apply industry-standard safeguards, including:

• Passwords are hashed with Argon2id, a modern, memory-hard hashing algorithm. We never store your password in plain text, and we cannot recover it.
• Sessions use an opaque, randomly generated 256-bit token; only a one-way cryptographic hash of that token is stored on our servers, never the token itself.
• Two-factor authentication secrets are encrypted at rest.
• Automated rate limiting on login, signup, and password-reset requests to deter brute-force and credential-stuffing attacks.
• All traffic between your browser and the Service is encrypted in transit (HTTPS).

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and the appropriate authorities as required by applicable law.

We retain your information for as long as your account remains active, so that the Service can continue to function for you. When you delete your account (Settings → Security), your data is immediately deactivated and no longer accessible through the Service. It is then permanently and irreversibly deleted from our production database within 30 days. Expired login sessions are removed automatically on an ongoing basis.

We may retain limited information for longer where required to comply with a legal obligation, resolve disputes, or enforce our agreements.

Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and similar provincial privacy legislation, you have the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Withdraw consent to our collection, use, or disclosure of your information, subject to legal or contractual restrictions;
• Export your data in a portable format; and
• Delete your account and the personal information associated with it.

You can exercise most of these rights directly, at any time, from Settings → Security: export the full record of everything you have logged as CSV or JSON, edit any record yourself, or permanently delete your account. For anything else, contact us using the details in Section 13, and we will respond within a reasonable time and in accordance with applicable law.

The Service is not directed to, and is not intended for use by, individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will update the “Last updated” date at the top of this page, and for material changes, we will provide more prominent notice (such as an email or an in-app notification). We encourage you to review this policy periodically.