What this policy covers
This policy applies to POp-wallet.ca (the "Service"), a free tool that helps Canadians compare credit cards and figure out which card in their wallet to use for different kinds of purchases. It covers what information we collect when you use the Service, how we use it, who we share it with, and the choices you have.
Information we collect
If you use the Service without creating an account, your profile, spending amounts, and wallet selections are stored only in your browser (via localStorage) and are never sent to our servers.
If you create an account, we collect and store:
- Account credentials: your email address and a password. Your password is never stored in plain text -- it's run through a one-way hashing algorithm (bcrypt) before it's saved, and even we cannot look up or recover your actual password.
- Profile information you choose to provide: name, province, income range, credit score range, financial goals, monthly spending estimates by category (groceries, dining, gas, etc.), and any retailer preferences you set.
- Your wallet: which cards from our database you've indicated you hold, and whether you've told us the annual fee is waived on any of them.
- Technical and security information: your IP address is temporarily recorded when you attempt to log in or submit the contact form, solely to detect and rate-limit abusive activity (like repeated password-guessing attempts). These records automatically expire and delete themselves after a short window (15 minutes for login attempts, 1 hour for contact-form submissions) -- we don't keep a permanent log of your IP address tied to your account.
- Contact form submissions: if you use our Contact page, we receive whatever email address, subject, and message you provide, in order to respond to you.
We do not collect: your actual credit card numbers, your real financial account balances, your Social Insurance Number, or any information from your actual bank or credit card issuer. Everything you enter is self-reported by you for the purpose of getting better recommendations -- we have no way to verify it, and don't ask you to prove it.
How we use your information
- To create and maintain your account, and let you sign back in.
- To save your spending profile and wallet so your recommendations are there the next time you visit, on any device.
- To calculate which of your cards earns the most for each spending category, and to suggest cards you don't currently hold that might earn you more.
- To send you account-related emails: verifying your email address when you sign up, password reset links, and one-time codes to confirm sensitive actions like changing your password or deleting your account.
- To detect and block abusive activity, such as automated login attempts or spam submissions through the contact form.
- To respond to you if you contact us directly.
We do not use your information to serve you ads, and we do not sell your information to anyone.
Who we share information with
We use a small number of third-party services to actually run the Service. Each only receives the specific information it needs to do its job:
| Service | What it's used for | What it receives |
|---|---|---|
| MongoDB Atlas | Database hosting -- where your account and profile data is stored | Everything described above, encrypted in transit and at rest |
| Resend | Sending transactional emails (verification codes, password resets) | Your email address and the content of the specific email being sent |
| Netlify | Hosting the website and running the backend | Standard web request data (e.g. IP address, as described above) |
| Google Analytics | Measuring site traffic -- only if you accept the cookie banner (see "Cookies and local storage" above) | Page views, referring site, approximate location, device/browser type -- never your account, profile, or wallet data |
We don't share your information with anyone else, and none of these providers are permitted to use your data for their own purposes -- they process it only to provide their service to us.
We may disclose information if required to by law, or to protect the rights, property, or safety of POp-wallet.ca, our users, or others.
How long we keep your information
We keep your account information for as long as your account exists. If you don't verify your email within 24 hours of starting to sign up, the incomplete registration is automatically deleted. Password reset links and one-time verification codes expire within a short window (10 minutes to 1 hour, depending on the action) whether or not they're used.
Your choices and rights
- Access and correction: you can view and update your profile information at any time by signing in.
- Deletion: you can permanently delete your account at any time from the account menu. This is a two-step process requiring your password and an emailed confirmation code, specifically so that no one else can delete your account on your behalf. Deletion removes your entire account record -- profile, wallet, and credentials -- in a single operation.
- Using the Service without an account: everything works without signing up at all; your data simply stays in your browser instead of being saved to our servers.
- Analytics cookie choice: you can accept or decline Google Analytics at any time via the cookie banner (see "Cookies and local storage" above); declining has no effect on how the tool works.
If you're a resident of Canada, these choices reflect the access, correction, and withdrawal-of-consent rights described under the Personal Information Protection and Electronic Documents Act (PIPEDA). If you're a resident of Quebec, the same rights are also guaranteed under Quebec's Act respecting the protection of personal information in the private sector (Law 25) -- see the section below for how to reach the person responsible for privacy compliance and what happens if a data breach ever occurs.
Security
We take reasonable technical measures to protect your information, including password hashing, encrypted connections (HTTPS) everywhere, rate limiting against automated attacks, and security headers that reduce the risk of common web vulnerabilities. No system is perfectly secure, but we treat this seriously and keep these protections under active review.
Quebec residents: privacy officer and data breach notification (Law 25)
Person responsible for the protection of personal information: as required under Quebec's Law 25, the person heading POp-wallet.ca is designated as the person responsible for ensuring compliance with the laws applicable to the protection of personal information, including this policy. You can reach them directly, for any privacy question, complaint, or request, via our Contact page (select "Privacy / data question") or by emailing popwalletca@gmail.com.
Confidentiality incidents (data breaches): if we become aware of an incident involving unauthorized access, use, or disclosure of your personal information, we assess the risk of serious injury it poses to you. Where that risk exists, we will: (1) notify the Commission d'accès à l'information du Québec (CAI) as required by law, (2) notify you directly if you're a person whose information was involved, and (3) keep a record of the incident, as Law 25 requires. We take this obligation seriously regardless of how few users are affected by a given incident.
Cookies and local storage
We use your browser's local storage to keep you signed in (a security token) and to remember your light/dark theme preference. If you don't have an account, local storage is also where your spending profile and wallet are kept.
We use Google Analytics, a cookie-based traffic-measurement tool, but only if you accept the cookie banner shown on your first visit to the site. Declining means no analytics cookie is ever set and no usage data is sent to Google. If you accept, Google Analytics sets first-party cookies (named _ga and _ga_<container id>) to recognize repeat visits, and collects page views, the referring site, an approximate location derived from a truncated IP address, and coarse device/browser type -- never your name, email, or anything from your account or wallet. This data is processed by Google LLC, a U.S. company, under Google's own privacy policy. You can change your choice at any time by clearing this site's cookies and local storage in your browser, which shows the consent banner again on your next visit.
Children's privacy
The Service is not directed at, or intended for use by, children. We don't knowingly collect information from anyone under the age of majority in their province of residence.
Changes to this policy
If we make a meaningful change to this policy, we'll update the "Last updated" date at the top of this page. We encourage you to check back periodically.
Contact us
Questions about this policy or your information? Reach out via our Contact page.