Privacy Policy

We collect only what is necessary to provide the Service:

• Email address — used to identify your account and for account-related communications.
• Password — stored as a one-way bcrypt hash. We cannot recover your password.
• Revenue entries — the amounts, dates, provinces, and optional descriptions you enter into the tracker. This data is scoped to your account.
• Usage data — basic server logs (IP address, browser type, pages visited) retained for up to 30 days for security and debugging purposes, plus aggregate, privacy-friendly page-view analytics (see Section 6).
• Billing information — if you upgrade to Pro, payment is handled by Stripe. Your card number never touches our servers; we store only your Stripe customer ID and subscription status.
• Newsletter / lead emails — if you request our free cheat sheet, we store the email address you provide so we can send it, along with occasional GST/HST tips. Every such email includes a one-click unsubscribe link.
• Bug reports and error data — if you submit a bug report, we store your message and the page it was sent from. When the app encounters an error, technical diagnostics (error details, browser type, IP address) may be sent to our error-monitoring service, Sentry. Session replay is disabled.

We do not collect bank credentials or social insurance numbers, and we never see your full payment card details.

We use your information to:

• Provide and operate the Service
• Authenticate you and protect your account
• Process subscription payments (via Stripe)
• Send you service emails (password resets, threshold alerts based on the revenue you log) and, unless you unsubscribe, onboarding tips and product updates
• Respond to support requests and bug reports
• Detect and prevent fraud or abuse
• Improve the Service

We do not sell, rent, or share your personal information with third parties for marketing purposes. Every marketing email we send includes an unsubscribe link, and we honour unsubscribes immediately, as required by Canada’s Anti-Spam Legislation (CASL).

Your data is stored in a PostgreSQL database hosted on Neon (neon.tech), with servers located in the United States. Data is encrypted in transit (TLS) and at rest. We apply industry-standard security practices, but no system is completely secure.

We retain your data for as long as your account is active. You may permanently delete your account and all associated data at any time from the Settings page. Deletion is immediate and irreversible.

Under Canadian privacy law, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Withdraw consent and request deletion of your data
• Export your revenue entries at any time (CSV export in the app)
• Unsubscribe from marketing emails at any time

To exercise these rights, email us at privacy@hsthero.ca or use the self-serve deletion option in Settings. That address also reaches the person responsible for the protection of personal information. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.

We use a single encrypted session cookie (iron-session) to keep you logged in. This cookie is strictly necessary for the Service to function. Your theme preference (light or dark) is stored locally in your browser. We do not use tracking or advertising cookies.

We use Vercel Analytics to understand aggregate site usage (page views, referrers, country-level location). It is cookie-free and does not build individual visitor profiles; visits are counted using an anonymized, rotating identifier.

We use the following sub-processors:

• Vercel — hosting, edge network, and aggregate analytics (United States)
• Neon — database (United States)
• Stripe — payment processing for Pro subscriptions (United States); Stripe receives your payment card details and billing information directly
• Resend — email delivery for account, alert, and marketing emails (United States)
• Sentry — error monitoring and diagnostics (United States)

Each of these providers has their own privacy policies and security practices. By using the Service, you consent to your data being processed in the United States. We share with each provider only what it needs to perform its function.

The Service is not directed at children under 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date above. Continued use of the Service after changes constitutes acceptance of the updated policy.

Questions or concerns about privacy? Email us at privacy@hsthero.ca.