Privacy Policy

Last updated: October 11, 2026

This policy explains what personal information Encore Years ("Encore Years", "we", "us") collects, why, who we share it with, and the rights you have over it under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). It's written to reflect exactly what the product does today — not a generic template.

1. What We Collect

We collect only what the service needs to function:

• Email address — to send you a sign-in link and identify your account. That's the only thing we ask for at sign-up.
• Saved plans — if you save a plan, we store the household figures you entered (ages, account balances, government benefit amounts, spending targets) and an optional name field you may fill in for each person. This is financial-planning data — we don't ask for or require a Social Insurance Number, home address, phone number, or date of birth. We also keep one yearly copy of each saved plan: the plan as you last saved it in each tax year, with the results the planner calculated for it then, so next year you can see what changed. Deleting the plan deletes these copies too.
• Subscription status — if you subscribe, we store your Stripe customer and subscription IDs, subscription status, and renewal date. We never see or store your card number; Stripe handles payment collection directly, and its Stripe Tax feature collects a billing address for tax-jurisdiction purposes directly on your Stripe customer record — we don't receive or store that address ourselves.
• Share links — if you create a share link for a saved plan, we store the link's code with that plan. Anyone who has the link can see the plan's name and everything in it (including later edits) until you replace the link, turn it off, or delete the plan. The viewer doesn't need an account, and the link never reveals your email address or account.
• Error reports — when something breaks in your browser (for example, the planning engine fails to start), your browser sends us the error message, where in our code it happened, the page path, and the app version, so we can fix it. Anything in the message that looks like a dollar amount is removed before it's stored, and the report carries no account, email, or plan data. Error reports are kept for 30 days.
• Questions you ask about your plan — if you use the optional AI features, the plan data relevant to your question (and, for the scenario-generation feature, your household configuration and summary) is sent to our AI provider to generate a response. We also record how many tokens each request used, per day, to enforce fair-use limits — we do not store the content of your questions or the AI's answers.

What we don't collect: our own application never records your IP address or browser user-agent. Our API host does: Google Cloud's standard request logs for our API record the IP address and browser type of each request, and are kept for 30 days for security and troubleshooting. We don't use them to identify or track you. For site analytics we use Umami, which sets no cookies and doesn't store IP addresses or build a profile of you: it counts page views and a handful of named actions (for example "Plan saved" or "Checkout started"), never what's in your plan or any amount. No Google Analytics, no advertising pixels.

2. How We Use It

• To authenticate you (send and verify sign-in links) and maintain your session.
• To save, load, and let you edit your household plan(s), and to show a plan to the people you've shared a link with.
• To process subscription payments and determine your feature access.
• To answer questions you ask about your own plan, and to generate scenarios you request.
• To operate, secure, and improve the service (e.g., diagnosing errors) — we do not use your plan data to train any AI model, and we do not sell, rent, or use your personal information for advertising.

3. Third-Party Service Providers & Cross-Border Disclosure

We use a small number of third-party providers ("sub-processors") to operate the service. Because these providers may process data on servers located outside Canada (including in the United States), your information may be subject to the laws of those jurisdictions, including lawful access by their governments. We only share what each provider needs to do its job:

• Stripe (payments) — receives your billing details and card information directly; we receive back only your customer/subscription IDs and status.
• Resend (email delivery) — receives your email address and the sign-in link content, to deliver the sign-in email.
• Umami (website analytics, hosted in the EU) — receives the page address (without anything after a "#"), referrer, page title, screen size and browser language of each visit and the name of the actions listed above; no cookies, no stored IP address, no plan data.
• Anthropic (the Claude API) — receives the plan data and question/instruction text needed to answer a question or generate a scenario, only when you use those optional, paid features.

We host our application infrastructure on commercial cloud providers (Google Cloud, Cloudflare); the specific data-processing region is an operational detail we haven't finalized in a way we can commit to here yet — this policy will be updated with that detail before public launch.

4. Cookies

We use one strictly-necessary session cookie to keep you signed in, and a short-lived cookie during the sign-in process itself to prevent login-link forgery. Neither contains personal information beyond an internal user ID and expiry — the cookie itself is a signed token, not a lookup key into a database of your data. We don't use any advertising, tracking, or third-party analytics cookies.

5. Data Retention

We keep your account and saved plans, including each plan's yearly copies, for as long as your account exists. Sign-in link tokens are deleted immediately after use, or automatically within 15 minutes if unused. AI usage token counts are retained to enforce daily limits. If you delete your account, we delete your plans and account record; some minimal billing records may be retained longer where we're legally required to keep them (e.g., for tax/accounting purposes).

6. Security

All traffic to Encore Years is encrypted in transit (HTTPS). Sign-in tokens are stored as one-way hashes, never in plain text. Your session is a stateless, cryptographically signed cookie rather than a database lookup. No security measure is perfect, but we design for a minimal footprint of sensitive data by default.

7. Your Rights Under PIPEDA

As a Canadian resident, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Withdraw your consent at any time by deleting your account (which removes your plans and account record).
• Ask us questions about how your information is handled.

To exercise any of these rights, email support@encoreyears.ca. If you're not satisfied with our response, you can file a complaint with the Office of the Privacy Commissioner of Canada.

8. Children's Privacy

Encore Years is a retirement-planning tool and is not directed at, or intended for use by, children. We don't knowingly collect personal information from children.

9. Changes to This Policy

If we make material changes to this policy — such as adding analytics or a new sub-processor — we'll update the "Last updated" date above and, where the change is significant, make a reasonable effort to notify account holders.

10. Contact

Questions about this policy or your data? Email support@encoreyears.ca.