Privacy Policy

What we collect

• Account information: your username and email address. Your password is stored only as a one-way cryptographic hash — we cannot read it, ever.
• Your budget data: the amounts, locations, daily notes, deposits, withdrawals, archived cycles, and protective backups you create while using THE GRID.
• Technical records: like almost every website, our server records page visits (page name, IP address, browser type, referring page) and sign-in attempts (IP address and username). We use these only to keep the site working and to block break-in attempts.

What we never do

• We never sell, rent, trade, or share your personal information or budget data with third parties.
• We never send marketing email. We email you only for password resets, to answer a message you sent us, or for something you explicitly opted into.

Analytics

Signed-in pages (THE GRID, mobile GRID): no third-party analytics run — not Google’s, not anyone’s. Visits are counted only by our own private counter, stored in our own database and shared with no one.

Public pages (the homepage and information pages) use Google Analytics to measure basic traffic — pages visited, device type, approximate region. Google never receives your username, email, or anything from inside your budget. You can read Google’s privacy policy for how they handle analytics data.

Cookies and device storage

• A session cookie keeps you signed in.
• A security cookie (CSRF token) protects forms against forgery.
• Your browser’s local storage holds your display settings and, on mobile, an offline copy of your grid so the app works without a connection. This stays on your device.
• Public pages set Google Analytics cookies (see above).

Where your data lives

Your data is stored in our database on the servers of our web hosting provider — the company that physically runs the machines this site lives on. They process data on our behalf and have no right to use it for their own purposes. To protect you against data loss, we keep automatic backups of your grid for up to 90 days, and our hosting provider maintains routine server backups on its own schedule, which cycle out automatically.

Deleting everything

You can permanently delete your account and everything in it — grid, notes, archives, our backups, and your account details — at any time using the “Delete my account” link inside THE GRID. Deletion from our systems is immediate and we keep no copies; residual data in our hosting provider’s routine server backups is beyond our direct control and cycles out automatically. Deleting your account on one device deletes it everywhere — there is only one copy of your data.

Your rights

Under Canada’s privacy laws (PIPEDA and BC’s Personal Information Protection Act), you have the right to see the personal information we hold about you, correct it, and delete it. For access or correction, email us. If you believe we’ve mishandled your information, you may also contact the Office of the Privacy Commissioner of Canada.

When we would disclose data

Only if the law requires it — for example, a valid court order. That has never happened. There is no other circumstance in which your data leaves this server.

Changes to this policy

If our practices ever change, this page changes first, with a new date at the top. We will never quietly weaken these promises.

Contact

Questions about privacy or your data: support@13months.ca

← Back to 13months.ca