Privacy Policy

This policy explains what data Looniee collects, why, and who processes it. By using Looniee you agree to this policy.

What we collect

• Account & identity — your email and authentication details, managed by our authentication provider (Clerk). We never see or store your password.
• Financial data you enter — accounts, holdings, transactions, contributions, ledger entries, tax records, and the names you give the people in your household.
• Files you import — CSV and spreadsheet exports are uploaded to our servers, parsed into transactions, and discarded. We do not keep the file.
• Payment information — if you subscribe to Looniee Plus, Stripe collects and stores your card details. We never receive your full card number. We do store your Stripe customer and subscription IDs, your subscription status, and a card fingerprint (an irreversible identifier Stripe derives from the card) used to prevent repeat free trials.
• AI feature content — if you use Ask Looniee or AI document import, your question and the portfolio context described below are processed by our AI provider. See AI features.
• Bug reports — if you report a bug, we receive your message and, unless you opt out, a short list of technical diagnostics (browser, screen size, app version, current view). The report screen itemises exactly what is included. Diagnostics never contain your financial data.
• Email signups — if you join our updates list, we store your email address.
• Usage analytics — aggregated, privacy-friendly page and performance metrics. We do not sell your data.

How we use it

• To provide the portfolio tracking and contribution-room features you request.
• To fetch live prices and FX rates for the symbols you track.
• To answer your questions when you use an AI feature.
• To bill you, if you subscribe, and to prevent repeated free trials on duplicate accounts.
• To send transactional emails (billing notices, trial reminders) and update emails you opted into.
• To monitor reliability and improve the product.

We do not sell your personal information, share it with advertisers, or use it to build an advertising profile.

AI features

Ask Looniee and AI document import are optional and only run when you choose to use them. They are not used to process your data in the background.

When you send a message to Ask Looniee, the following leaves our servers and is sent to our AI provider so it can answer:

• your question and the earlier messages in that conversation;
• a snapshot of your portfolio — net worth, account names and types, holdings and their values, sector and currency allocation, recent activity, contribution room, and the names of the people in your household as they appear on your accounts.

For questions about market events (“why did my portfolio drop this week?”), your question is additionally sent to Google Search so the answer can cite real, dated sources.

AI answers are generated by Google’s Gemini models, accessed through the Vercel AI Gateway. Looniee does not use your data to train any model, and does not permit our providers to use it to train theirs. AI output can be wrong — it is informational only, and is never financial, tax, or investment advice.

If you would rather no portfolio data reach an AI provider, simply do not use the AI features. Every other part of Looniee works without them.

Sub-processors

We share data only with the service providers needed to run Looniee:

• Clerk — authentication and account management.
• Neon — encrypted PostgreSQL database hosting your data.
• Vercel — application hosting, privacy-friendly analytics, and the AI Gateway that routes AI requests.
• Google — Gemini models generate AI answers; Google Search provides sources for market-event questions. Applies only when you use an AI feature.
• Stripe — payment processing and subscription management, if you subscribe.
• Resend — transactional, billing, and update email delivery.
• Yahoo Finance — market data lookups for the symbols you track (symbols only; no personal data is sent).
• icon.horse, DuckDuckGo, and Google — company logo images for your holdings. Your browser requests these directly, which reveals the ticker symbols being displayed. No account or personal data is sent.

Data retention & deletion

Your financial data persists until you delete it. You have two options, both in Settings:

• Wipe your data — deletes every account, holding, transaction, ledger entry, tax record, saved setting, and import history item, while keeping your login.
• Delete your account — cancels any active subscription, erases all of the above, and closes your login. This is immediate and cannot be undone.

After account deletion we retain one record: a minimal billing row holding a one-way fingerprint of your email address, a card fingerprint, and a flag recording that a free trial was used. Your email address itself is erased. We keep this solely to stop the same person from farming unlimited free trials by deleting and recreating accounts, which we consider a legitimate fraud-prevention interest. It contains no financial data and is never used to contact you.

Backups are retained by our database provider on a rolling basis and expire automatically. Server logs contain no financial data or personal information beyond IP addresses used for rate limiting.

You can also export a full copy of your data at any time from Settings, or email looniee.ca@gmail.com for help.

Your rights (PIPEDA)

Looniee is operated for users in Canada and follows the principles of the federal Personal Information Protection and Electronic Documents Act (PIPEDA), as well as applicable provincial privacy law. You have the right to:

• Access the personal information we hold about you;
• Correct inaccuracies in your information;
• Export a copy of your portfolio data;
• Delete your account and the associated data;
• Withdraw consent for optional processing (e.g. stop using AI features, or unsubscribe from updates);
• Complain to the Office of the Privacy Commissioner of Canada if you believe we have mishandled your data.

To exercise any of these rights, email looniee.ca@gmail.com. We respond within 30 days.

Data residency & cross-border processing

Our sub-processors may store and process your data outside of Canada (including in the United States and the European Union). When data is transferred across borders, it remains subject to this policy and the contractual safeguards we maintain with each sub-processor. While outside Canada, that data may also be accessible to foreign authorities under applicable law.

Children

Looniee is not intended for anyone under 18. You may record a child as a beneficiary of an RESP or RDSP you track — that information is yours, entered by you, and treated like any other data in your account.

Security

Data is transmitted over TLS and stored in an encrypted, access-controlled database. Looniee never asks for and never stores your bank or brokerage credentials. No system is perfectly secure, but we take reasonable measures to protect your data.

Changes to this policy

If we make a material change — a new sub-processor, a new category of data, or a new use — we will update the date at the top of this page and notify signed-in users in the app before the change takes effect.

Contact

Questions about privacy? Email looniee.ca@gmail.com.