Your privacy, in plain English.

We try to collect as little information as possible while still providing a useful service. The categories below cover everything we collect.

Account information

• Your name and email address.
• A securely hashed copy of your password (we never store the password itself).
• Your subscription and billing status.

Financial planning information you provide

• Account balances you enter (RRSP, TFSA, pensions, real estate, debts).
• CPP and OAS estimates you enter.
• Goals, target retirement age, and household details (spouse, children if relevant).
• Scenarios you create and decisions you save in your plan.

Voice and chat content

• Audio you choose to record using the microphone, transcribed in your browser or by our speech provider.
• Ask TruePath conversations are processed to answer you in the moment. We do not store your chat history after your session ends.

Technical information

• Browser type, device type, operating system and IP address (for security and basic analytics).
• Pages visited and approximate time spent (privacy-respecting analytics, not personal tracking).
• Error logs that may include the URL of the page where the error occurred.

What we do not collect: your bank credentials, your SIN, your full credit-card number (our payment processor handles that and we never see it), your location beyond country level, and any data from outside our app.

Under PIPEDA, we collect, use and disclose your personal information with your consent.

• Express consent when you create an account, agree to our terms, and provide financial planning information.
• Implied consent for routine purposes that fit the context, such as sending you a billing receipt for a charge you authorized.

You can withdraw consent at any time, subject to legal and contractual restrictions. Withdrawing consent for the core service generally means closing your account, which we make easy to do.

We work with a small number of trusted service providers to operate TruePath. We share only the minimum information they need.

We never sell, rent, lease or trade your information. We do not share your information with advertisers, data brokers or unauthorized third parties.

We keep your information only as long as we need it for the purposes above, or as required by law.

• Active accounts: for as long as you keep your account open.
• Closed accounts: when you delete your account, your personal information is permanently erased right away, except as required by law (for example, billing records held for the period required by Canadian tax law).
• Saved scenarios: kept as part of your plan for as long as your account is open, the same as the rest of your plan data.
• Ask TruePath conversations: not retained after your session ends. We hold them only in the moment, to answer you.
• Backups: encrypted daily backups are retained for up to 7 days, then deleted.
• Anonymized analytics: aggregated, non-identifying usage data may be kept indefinitely.

We follow Canadian law. If we receive a request for user information from law enforcement, a regulator or a court, we require a valid legal basis (a warrant, court order or production order under Canadian law) and challenge requests we believe are overbroad or improper.

To the extent we are legally permitted, we will notify the affected user before disclosing any information, so they have an opportunity to seek their own legal advice.

We do not provide bulk or warrantless access to user data, and we have never received a request that would require us to do so. If this ever changes, we will note it in this policy.

We use cookies and similar technologies sparingly. They fall into three categories:

• Strictly necessary: for keeping you logged in, remembering your preferences, and protecting against fraud. Required for the app to work.
• Site analytics: on our public marketing site we use a product analytics tool (hosted in the EU) to understand which pages and features get used so we can improve them. This uses a cookie to count returning visitors, and it loads only after you accept it in our cookie banner; decline and no analytics cookie is set. We send only explicit, named events (like a pricing-page view), never any personal or financial information, and the data is never sold or shared. One deliberate exception, also consent-gated: the anonymized topic of questions typed into the public Ask box and the answers-library search, with all numbers and contact details stripped out before sending, which tells us which educational answers to write next. Your conversations themselves are never stored.
• Functional in-app analytics: inside the app, we use a product analytics tool (hosted in the EU) to understand how features are used so we can improve them. This data is tied to your account but never sold or shared. This includes the general subject of what you ask Ask TruePath and What if...?, chosen from a fixed list of categories such as CPP, RRSP and RRIF, or estate planning. This tells us which guides and updates to write next. Alongside that category we keep a short, generalized version of your question, rewritten so it could have come from anyone: names, ages, dollar amounts, employers and places are removed, so what we hold reads like "Should we split pension income as a couple?". That generalized question is stored separately, with no link to you or your account. We never keep the words you actually typed, and never any amount from your plan. Your conversations themselves are still never stored. You can turn this in-app analytics off at any time in Settings.

We do not use any advertising cookies, retargeting pixels, or third-party trackers on this site.

In addition to the federal Personal Information Protection and Electronic Documents Act (PIPEDA), the following provincial laws may apply, depending on where you live:

• Quebec residents: An Act respecting the protection of personal information in the private sector, as amended by Law 25. You have additional rights, including the right to data portability and the right to be informed of automated decision making.
• British Columbia residents: Personal Information Protection Act (BC PIPA).
• Alberta residents: Personal Information Protection Act (Alberta PIPA).

We comply with all of the above. To exercise rights specific to your province, contact our Privacy Officer.