Privacy Policy

[DRAFT] Account details (name, email), household composition, and every financial figure entered or imported — income, expenses, accounts, balances, goals, reserve funds.

[DRAFT] NOTE FOR DRAFTING: IP addresses are processed transiently by the rate limiters on the unauthenticated onboarding routes. Short-lived and in-memory, but it is still personal data and should be named.

[DRAFT] The onboarding spreadsheet is parsed in memory and never written to storage — file_imports records that an import happened, not the file itself. This is a genuinely strong claim and worth stating plainly, because most products cannot make it.

[DRAFT] Household financial figures are sent to Anthropic to generate the plan, the monthly review, and the top recommendation. This is the disclosure most likely to be missed and the one a reader most needs.

[DRAFT] State what is sent (aggregated figures and line labels), what is not, and that the AI never invents or alters the numbers — code owns the arithmetic.

[DRAFT] Supabase (database, authentication), Vercel (hosting), Anthropic (AI), Brevo (transactional email). Name each and what it touches.

[DRAFT] CONFIRM BEFORE PUBLISHING: the Supabase project region, and that AI processing happens outside Canada. Quebec Law 25 requires a privacy impact assessment for transfers outside Quebec — this section must be accurate, not aspirational.

[DRAFT] Phare records product events (onboarding completed, timeline opened, monthly review viewed) to understand whether the product helps. Household-scoped, and it SURVIVES an individual member deleting their account — events.user_id becomes null rather than the row being removed.

[DRAFT] The honest account: the login is destroyed and the name is replaced, but the household keeps the financial records that member entered, because they are the household's records. The member row survives, relabelled.

[DRAFT] MUST STATE: a deletion request record retains the departing member's email address as an audit trail. Do not claim deletion removes everything — it does not, and the code will contradict you.

[DRAFT] The other story: deleting the household destroys everything by cascade, including the deletion-request records and their retained emails. This is the branch where "everything is removed" is true.

[DRAFT] Access, correction, deletion, portability. Portability is already real — the CSV export. Deletion is already real — both cases above. Name the response window.

[DRAFT] Encryption in transit and at rest, row-level security scoping every query to one household, and the member cap. Avoid absolute guarantees.

[DRAFT] Authentication session cookies only. No advertising or third-party analytics cookies — state it plainly if it stays true.

[DRAFT] How revisions are published, and that a substantive change requires accepting again before continuing to use Phare.

[DRAFT] support@phare.money, and the privacy officer required under Quebec Law 25.