Privacy Policy

Last updated: July 2026

Level It Down is built on a simple principle: the less of your data we hold, the less can go wrong. This policy describes what we actually collect and why — it's short because we collect little.

Using the planner without an account

All calculations run in your browser. The debts and budget you enter are stored only in your browser's local storage on your device. They are never transmitted to our servers, and we cannot see them. Clearing your browser data erases them.

If you create an account

We store: your email address and a securely hashed password (handled by Supabase authentication); the debts, budget, plans, and payment records you choose to save; your reminder preferences and timezone; and an audit history of changes to your own records (visible to you). Optional fields — display name, province, credit score — are stored only if you enter them. All data is encrypted in transit (TLS) and protected by database row-level security so it is readable and writable only by your account.

What we never collect

Bank logins or account numbers. Credit-card numbers. Social Insurance Numbers. Government ID. We do not connect to your bank, and we will never ask for these.

Emails

If you opt into payment reminders, we send them to your account email through our email provider (Resend). Reminder emails contain the debt name and planned amount you configured. "Mark as paid" links use single-use, expiring tokens; the link cannot log into your account or expose other data. Every reminder has an unsubscribe link, and you can turn reminders off in Settings.

Analytics

We record basic product events (for example, "a plan was generated", "a payment was marked") with coarse properties only — never balances, interest rates, incomes, or any dollar amount. We use no third-party analytics or advertising scripts, no fingerprinting, and no cross-site tracking. Anonymous usage is keyed to a random identifier stored in your browser.

Where your data lives

Account data is stored with Supabase (PostgreSQL) in their us-east-1 region. The website itself is served from Cloudflare's network. Reminder email delivery goes through Resend. These providers process data on our behalf and cannot use it for their own purposes.

Your rights and controls

Settings → Your data lets you export everything we hold about you as JSON, at any time. Settings → Delete account permanently and immediately deletes your account and every associated record — debts, budget, plans, payments, history, reminder preferences, and tokens. There is no retention period and no soft delete; deleted means deleted.

What we don't do

We do not sell, rent, or share your personal information. We do not show ads. We do not use your financial data to market lending products to you. We do not train AI models on your data — plan explanations are computed arithmetic, not machine learning.

Contact

Questions about this policy or your data can be raised through the Help page. If you believe your privacy rights under PIPEDA have not been respected, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).