Security & privacy
Your data stays in Canada. Period.
TruePath is built for Canadians, by Canadians, encrypted and stored in Canada. No bank linking, ever. We do not sell your data, and we never will.
Three things we will never do
The short version, first.
We never connect to your bank
No linking, no screen scraping, no Plaid, no third-party connectors. You enter your numbers yourself. We have no way to log into your accounts, even if we wanted to.
We never sell your data
Your information is not a product. We do not have advertisers. We do not run an analytics-for-sale business. We make money from your subscription. That is it.
We never share it for marketing
Your numbers are never sold or handed to advertisers, data brokers or marketing partners. The only companies that ever touch your data are the service providers that run the app, like our Canadian database host and the optional AI and voice tools you choose to use, each limited to the minimum they need.
The same scrutiny runs through the math. See how we calculate every number.
How we protect you
Six pillars of TruePath security.
Canadian data residency
Your plan data lives in a Canadian-hosted Supabase database in ca-central-1, governed by Canadian privacy law. A few operational services we rely on are based outside Canada and receive only the minimum data they need. See our Privacy Policy for the full list.
Encrypted at rest
All stored data is encrypted using AES-256, the same standard banks use. It is not readable from inside TruePath without authenticated, logged access.
Encrypted in transit
Every connection uses TLS 1.2 or higher. Nothing leaves your browser unencrypted. Your numbers are protected on the way to us, and on the way back.
Strong authentication
Passwords are hashed with bcrypt and never stored in plain text. Session tokens are short-lived and expire automatically on sign-out.
Privacy-first by design
We designed TruePath around the principles in Canada's federal privacy law (PIPEDA): collecting only what we need, storing it securely and giving you full control over your own data.
Row-level data isolation
Your data is locked to your account at the database level. The rule that only you can reach your data is enforced by the database itself, not left to app code to remember every time. There is no setting that turns it off.
Data policy
Your data, your control.
We collect what we need to make a plan
Your name, email, account credentials, and the financial numbers you enter. That is it. We do not collect your SIN, banking details or anything beyond what is needed.
You can delete your account any time
Account deletion is a single click from settings. Your data is permanently removed right away, with no copy retained beyond legal requirements.
You can export your plan any time
PDF export is always available while your subscription is active. Export anytime to keep a copy of your plan, including right before you cancel.
Security questions
Straight answers.
Why don't you connect to my bank like other apps?
Bank linking through aggregators creates a copy of your credentials and a long-term security risk. It is also unnecessary for retirement planning, where ballpark balances are enough. We chose to build a tool that works without ever needing your login. Less risk for you, less risk for us, simpler all around.
Where is my data physically stored?
Your account and plan data are stored in Canadian-hosted data centres, governed by Canadian privacy law. A few optional features, the AI assistant and voice input, send the text or audio you choose to share to trusted processors in the United States to generate a response. Everything else stays in Canada.
What happens if you go out of business?
You can export your plan as a PDF any time, so a copy of your numbers is always yours to keep. Exporting whenever you make a big update means you never depend on any single service staying online.
Do you use my data to train AI models?
No. We never train any model on your data. The AI provider behind Ask TruePath uses your plan numbers only to generate your answer in real time, under business terms that do not allow training on your inputs.
Is two-factor authentication available?
Yes. Two-factor authentication using an authenticator app (Google Authenticator, Authy, 1Password and similar) is available in Settings, Security. We do not require it at signup so it never adds friction, but we strongly encourage every Canadian planning their retirement to turn it on. You will get ten one-time recovery codes during setup in case you lose your phone.
What if I forget my password?
A standard reset email returns you to your account. Your data is encrypted but recoverable on a successful reset, because we want planning tools to be usable, not user-hostile.
Your retirement plan, kept current as life changes.
Fourteen days free. Start fast. Keep refining as your real life moves. Cancel any time before the trial ends and you pay nothing.