Privacy Policy

What we store in your workspace

When you use FlintBoard, your profile, accounts, categories, transactions, and related FIRE settings live in a workspace database. No bank login, stored encrypted on our server. When you import CSV statements, the file is written to that workspace's import folder and parsed into staging rows before you commit to the ledger. Statements are stored with that account and encrypted. We do not sell them, we do not connect to your bank, and we do not send statements to advertisers or other companies. You can delete that workspace from Settings at any time.

Each workspace's money data is encrypted at rest with standard database and file encryption using a key on our host. Someone who controls the live server can still read what the app can read. Sign-in records, the product-update list, shared FIRE snapshots, and feedback stay in separate databases that are not encrypted that way. A backup you download is plaintext JSON you choose to save.

Shared FIRE snapshots

An operator can publish a read-only sample link from reviewed FIRE figures (for example age, province, income, spending, and account balances). Opening that link starts a read-only sample in the app. New shares do not store the full text of a social post. A link back to someone else's public post (such as a Reddit thread) is stored only when that person has said yes and the operator records that yes. Short non-identifying source labels and operator or demo samples without a post link do not need that step. The share file on the host is separate from your workspace and is not encrypted. The sample cannot import, restore, or edit money data. If you sign in and copy the snapshot, FlintBoard creates a new workspace for you. Your previous workspace and the public sample do not change. These pages are not indexed. If you accept analytics cookies, a visit to the public share link can be counted. The app, including this read-only sample, does not load analytics.

If a shared page shows figures from your post and you want it removed, use email a removal request on that share page, or email hi@flintboard.ca with the share id from the page URL (/s/…). An operator deletes that public link so the page no longer opens. The same 404 shows for a link that was never published.

Essential cookies

Sign-in uses httpOnly cookies (flintboard_session and flintboard_workspace) so the app can keep you authenticated and open the correct workspace. flintboard_fire_familiar stores yes or no after you answer whether you know FIRE on the homepage or before the demo. Either answer hides that question until the cookie is cleared. flintboard_money_familiar stores new, saves, or plans after you say how familiar saving and investing are. That question is separate from FIRE. New to it shows a short crash course. The other answers skip it. The cookie stays until you clear it. flintboard_demo_age stores skip or your age after the demo asks how old you are, so a refresh does not ask again. The demo tour uses flintboard_dashboard_tour. A signed-in account stores the same fact on the profile instead of a cookie. These are required for the product to function and are not used for analytics.

Optional analytics (Google Analytics 4)

If you click Accept analytics on the cookie banner, and this host has analytics configured, we load Google Analytics 4. It counts page views on public pages (home, sign-in, the FAQ, the spreadsheet comparison, legal pages, and shared FIRE snapshots). Google may process that page-view data in the United States. Analytics is never loaded on signed-in /app workspace pages, where your statements and balances appear, or on setup, the demo, or a read-only share sample. Page addresses sent to Google omit query strings, so sign-in links are not included. We keep GA4 Enhanced measurement (form interactions, outbound clicks, site search) turned off in the Google property so analytics stays page-view only.

Signing in with an email code or Google is separate from product updates. See Product update email below.

If you choose Reject, the site still works and Google Analytics does not load. You can change your mind anytime via Cookie preferences in the footer or on the Cookie Policy page.

Product update email

Sign-in and product updates use an email address for different purposes. When you request an email code or continue with Google, FlintBoard uses that address to authenticate you. That step does not add you to product updates. The first time that address signs up, and mail is configured, we email hi@flintboard.ca that someone new signed up, including the address, whether it was an email code or Google, and the time. A later sign-in does not send that notice. The public demo and a shared sample are not a signup, and an account that already has a ledger does not send one. Signing up still completes if the notice is not sent.

Product updates are optional. The checkbox on the homepage footer and the sign-in page starts unchecked. We store an address only after you check Email me product updates and submit a valid email. We then keep the address in lowercase, the time you consented, whether you joined from the homepage or the sign-in page, and any plain campaign labels present on that page (utm_source, utm_medium, utm_campaign, utm_content, utm_term). Sign-in codes, session cookies, and magic-link tokens are not copied onto that list.

The list lives in its own database on the application host, separate from your financial workspace and from sign-in records. That database is not encrypted. This version stores the opt-in and does not send product-update email to you. When you join, and mail is configured, we email hi@flintboard.ca that you joined, including the address, where you joined, and the time. That notice uses the same mail service as sign-in. Your address is still saved if the notice is not sent. When product-update messages are sent, each one will include an unsubscribe link. After you opt in, the confirmation also gives you a link. That link is a random token we can recognize. A request that only names an email address does not remove you.

You can opt in again later. That records a new consent time. Deleting your workspace from Settings does not remove this opt-in. Use the unsubscribe link for that.

If FlintBoard is hacked

Someone who controls the live server can still read what the app can read. Sign-in records, the product-update list, shared FIRE snapshots, and feedback stay in separate databases that are not encrypted that way.

If a breach creates a real risk of significant harm, we will notify affected people and the Office of the Privacy Commissioner of Canada as required by law.

What we don't do: sell household financial data, use bank-login aggregation, or load analytics inside signed-in /app pages.

Security

We take reasonable steps to keep imported and workspace data private. Statements are stored with that account and encrypted. We do not sell them and we do not connect to your bank. See the import terms for upload-related limitations. Operators should still use HTTPS, access controls, and avoid logging raw statement bodies.

Retention and deletion

Workspace data remains until you delete it. Signed-in users can permanently remove their workspace from Settings (Delete my data). That action deletes this workspace database, uploaded statement files tied to it, this account's documents inbox, and share links you published. Bug reports and feature requests you sent stay in the host feedback store. The fictional demo and a read-only share sample cannot be deleted this way. After deletion you stay signed in with an empty workspace unless you sign out. Host deploy backups of that data directory are kept for the last 3 deploys and then removed, so a copy can remain briefly after you use Delete my data.

Optional AI cost estimates

The local history estimate runs on our server. Those numbers are not sent to anyone else. If you turn on optional AI estimates in Settings, this browser sends only the trimmed history (the tags you chose and the amounts and dates of matching past entries) to Anthropic with your own key from this browser. It does not send bank names, account names, account numbers, descriptions, or merchant text. That key stays in this browser's sessionStorage for this tab. If you check Remember on this device, it moves to localStorage. It is never sent to our server, never stored in a cookie, never written into a backup, and never included in analytics. Clearing site data or Clear key in Settings removes it. With AI off, or with no key, the rest of the app works as before and the local estimate stays on our server.

Feedback you send

If you use in-app Feedback, we store the text you submit (bug or feature, title, details, optional page, and optional reply email) in a host-level inbox on the application server — separate from your financial ledger, and not encrypted. Do not include account numbers, balances, or statement contents. When mail is configured, we also email a copy of that report to hi@flintboard.ca through the same mail service used for sign-in. We do not send this text to a third-party support desk. On the public demo and on a shared sample, other visitors cannot read the reports stored for that shared workspace. A signed-in household can still see the reports it sent. Deleting your workspace from Settings leaves those reports in place.

Your privacy rights

You can ask for a copy of the personal information we hold about you, ask us to correct it, or delete your workspace from Settings (Delete my data). Email the Privacy Contact below for access, correction, or deletion help. We aim to reply within 30 days. You can also complain to the Office of the Privacy Commissioner of Canada.

Contact

The person accountable for personal information is the Privacy Contact at privacy@flintboard.ca. Share removal requests and product feedback can also go to hi@flintboard.ca, or from signed-in or demo Feedback in the app.