Privacy Policy

• We collect what you enter so Guardrail can work for you. We don't sell it, rent it or use it for advertising.
• A small number of service providers process it on our behalf, under contract, only to run Guardrail.
• Some of those providers are outside Canada, so your information may be stored or processed in the United States.
• You can see, correct and delete your information. Deleting your account deletes it.

[Leighnibor Inc.] is responsible for personal information in Guardrail and follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy law. Our privacy contact is privacy@leighnibor.com.

• Account details: your name, email address and password (stored only as a secure one-way hash).
• Profile details you choose to add: photo, phone number, date of birth, profession, relationship status, children, currency and time zone.
• Your financial records: income, expenses, budgets, debts and payments, bank and investment accounts and their balances, assets, goals, bills and subscriptions, and the categories and notes you attach to them. We do not connect to your bank and never ask for your banking passwords.
• Money Coach: your conversations with the coach, and the Coach Notes described in Money Coach and AI Features.
• Imports: statements, receipts, CSV files and notes you choose to import are read to find transactions and are not stored. Only the transactions you approve are saved, plus any matching rules you ask us to remember.
• Records we keep about the account: when you accepted these documents (with the IP address and browser used), sign-in times, the days you open Guardrail, the invite code you joined with, how much each AI feature was used (counts and sizes, not what was said), and a log of changes to your financial records so they can be traced.
• Billing, if you subscribe to Plus: your plan, its status and renewal date, and the reference Stripe gives your billing account. Your card details go to Stripe, never to us.

We use a single sign-in cookie to keep you signed in. We don't use advertising or third-party tracking cookies.

• To run Guardrail for you: show your figures, reports and progress, and send account emails such as verification and password-reset codes.
• To give you Money Coach replies and insights, if you use them.
• To keep Guardrail secure, prevent misuse, and fix problems.
• To run and improve the service as a whole: for example how many people finish setting up, hold a weekly review or come back, and what the AI features cost to run. We look at these as totals, not at anyone's finances.
• To bill Plus subscriptions.
• To meet legal obligations.

We don't use your financial information for advertising, and we don't sell or rent it to anyone.

These companies process information on our behalf, only to provide Guardrail:

• Supabase: database and file storage (all your records and your photo), in the United States (Ohio).
• Anthropic: the AI models behind the Money Coach and behind reading the statements, receipts and notes you import. It receives what each feature needs (see the Money Coach and AI document). Under its commercial terms, Anthropic does not use this information to train its models.
• Resend: sends our account emails.
• Vercel: hosts the Guardrail website and app servers, in the United States. [Confirm before launch.]
• Stripe: processes Plus payments and stores your card details. It receives your name, email and payment details.

Some of these providers store or process information in the United States, where it may be accessible to authorities under the laws of that country.

If you link your account with a partner's, you share the custom categories you each create. Your partner can't see your transactions, balances, goals or coach conversations.

We keep your information while your account is open. When you delete your account, we delete your records, coach conversations, Coach Notes, consent records and photo straight away, and close your billing account with Stripe, which stops any subscription. Stripe keeps its own payment records for as long as the law requires. Totals of AI use are kept without anything that identifies you. Copies in our providers' backups expire on their normal schedule [confirm: within 30 days]. Account emails and one-time codes expire automatically.

Information is encrypted in transit and at rest with our providers. Passwords and one-time codes are stored only as one-way hashes. Our database can only be reached by the Guardrail server, and your photo is kept in private storage that only your signed-in account can view. No system is perfectly secure; if a breach puts you at real risk of significant harm, we will tell you and the Privacy Commissioner as the law requires.

• See and correct: almost everything is visible and editable in the app. For a copy of everything we hold, email us.
• Delete: Settings → Security & privacy → Delete your account.
• Withdraw consent: you can stop using the Money Coach at any time. Because the coach is part of the service, withdrawing consent for it entirely means closing your account.
• Complain: contact us first. You can also complain to the Office of the Privacy Commissioner of Canada.

If we change this policy in a way that matters, we will ask you to review and accept the new version in the app.