01Who we are
Fiscit (“Fiscit”, “we”, “us”) is a personal finance dashboard operated from Montréal, Québec, Canada, at fiscit.com and app.fiscit.com. This policy explains how we handle personal information under Québec’s Act respecting the protection of personal information in the private sector (as amended by Law 25) and Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
Person in charge of the protection of personal information: Privacy Officer, Fiscit — privacy@fiscit.com. Contact this person for any question, request or complaint about your information.
02What we collect
- Account: email address, display name, password (stored only as a bcrypt hash — we never see it), and your Google account ID if you sign in with Google.
- Bank data, through Plaid: account names and types, balances, and transactions (date, amount, merchant/description, category). We receive an access token from Plaid; we never receive or store your bank username or password.
- Other connections you choose to add: your Wise API token and profile ID; public crypto wallet addresses and the coin amounts you enter; investment account platform, type and balance you enter.
- Brokerage connections (optional, read-only): if you connect a broker, we receive your investment accounts, balances and holdings (symbols, quantities, prices). Depending on the method, we store a read-only token or key you generate (Questrade, Interactive Brokers Flex, Kraken “Query Funds”) or a per-user secret from SnapTrade. We never receive your brokerage password and these connections cannot place trades or move money.
- Google Calendar (optional): if you connect it, read-only access to your calendar events so they can appear in Fiscit’s calendar.
- Information you create in the app: categories, rules, budgets, and optional trackers (gym, meals, habits, calendar events). Most of these are stored only in your browser.
- Technical data: session cookies, and standard server logs kept by our hosting providers (IP address, browser type, request time) for security and debugging.
We do not collect your social insurance number, and we do not use analytics, advertising or tracking cookies.
03Why we use it
We use your information only to:
- create and secure your account, and verify your email address;
- show your balances, transactions, net worth, budgets, savings rate and other features of the dashboard;
- categorize transactions and compute summaries for you;
- send you service emails (verification, security notices) and, only if you opted in at sign-up, product updates you can unsubscribe from at any time;
- keep the service secure, prevent abuse, and fix problems;
- comply with the law.
We never sell your personal information, never rent it, and never use your financial data for advertising. We do not use your data to train third-party AI models.
05Storage outside Québec
Our hosting providers store and process data on servers located mainly in the United States, so your information may be communicated outside Québec and Canada. We use providers that apply industry-standard safeguards, including encryption in transit and access controls. Information stored outside Canada may be accessible to authorities of that country under its laws.
06How we protect it
- All traffic is encrypted with HTTPS/TLS.
- Passwords are hashed with bcrypt; sessions use signed, HTTP-only cookies.
- Access tokens and API keys for your banks and brokers are encrypted in our database.
- Bank connections are read-only: Fiscit cannot move money, make payments or change anything at your bank.
- Access to production systems is restricted to the people who operate Fiscit.
No system is perfectly secure. If a confidentiality incident presents a risk of serious injury, we will notify you and the Commission d’accès à l’information du Québec as required by law, and keep a register of incidents.
07How long we keep it
We keep your information while your account is open. When you delete your account (Settings → Delete account), we immediately revoke Fiscit’s access at Plaid and SnapTrade and permanently delete your account, connections, tokens, balances and investment entries from our database. You can also disconnect a single brokerage at any time from the Investments page. Information stored only in your browser is cleared from that browser at the same time.
Server logs kept by our hosting providers are deleted on their own schedules, typically within 30 days.
08Your rights
You can, at any time:
- access the personal information we hold about you and ask how it is used;
- correct information that is inaccurate or incomplete;
- withdraw your consent — disconnect a service, or delete your account entirely from Settings;
- ask for your information in a structured, commonly used technological format (portability);
- ask us to stop disseminating your information or to de-index it, where the law allows.
Email privacy@fiscit.com. We answer within 30 days. If you are not satisfied, you can complain to the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada.
09Google user data
Fiscit’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Calendar data is used only to show your events inside Fiscit, is never sold, never used for advertising, and is not read by people except with your consent, for security purposes, or to comply with the law.
11Age
Fiscit is intended for people 18 and older. We do not knowingly collect information from minors.
12Changes to this policy
If we make material changes, we will update the date above and let you know by email or in the app before they take effect.