Effective date: April 6, 2026
Canopy ("we", "our", "the app") is a portfolio tracking and market intelligence application. This policy describes what data we collect, why we collect it, and how it is protected.
Account data: When you create an account, we collect your email address. Passwords are hashed before storage — we never store a plaintext password.
Portfolio data: Holdings, transactions, and watchlists you enter or import are stored to enable core app functionality and optional cross-device sync. This data is yours.
AI interaction data: When you use Canopy AI, your query and limited portfolio context are sent to Anthropic's API. We keep server-side AI request and response logs for reliability, abuse prevention, and safety review. See our AI Policy for the full breakdown of what is sent, what is not, and how long data is retained.
CSV import data: Transaction CSVs you upload are parsed entirely on-device in your browser. The raw file is never transmitted to our servers.
What we do not collect: We do not collect your location, contacts, device identifiers, browsing history outside the app, or any data beyond what is listed above. We do not use third-party analytics SDKs (no Google Analytics, no Mixpanel, no Meta Pixel).
We do not sell, rent, license, or share your personal data with advertisers, data brokers, or any third party for marketing purposes.
Railway — Application hosting and managed Postgres database for Canopy account, portfolio, sync, and community data. Railway Privacy Policy ↗
Supabase — Legacy authentication and data provider during account migration. Existing accounts may be verified through Supabase before being moved to Canopy's Railway-backed system. Supabase Privacy Policy ↗
Yahoo Finance — Stock quotes, fundamentals, and historical price data. Your portfolio ticker symbols are sent as query parameters to retrieve this data. Yahoo Privacy Policy ↗
Anthropic — AI analysis via the Claude API. When you request a Deep Intelligence Analysis, the ticker and relevant context are sent to Anthropic's API. Anthropic Privacy Policy ↗
RevenueCat — In-app subscription management. When you subscribe or restore a purchase, your App Store transaction data is processed by RevenueCat to validate entitlements. RevenueCat does not receive your portfolio or financial data. RevenueCat Privacy Policy ↗
Google News RSS — Market news headlines are fetched from publicly available RSS feeds. No personal data is transmitted in these requests.
Cloud data is stored in Canopy's managed Postgres database. The server derives data ownership from your authenticated session and all connections use TLS in transit.
Portfolio data is also cached locally in your browser's localStorage for offline access. This local data never leaves your device unless you are signed in and cloud sync is enabled.
You may delete your account and all associated data at any time from Settings > Delete Account. Upon deletion:
Deletion is permanent and irreversible. Deleted account data is removed from active systems, subject only to limited provider backups and legal retention requirements.
Canopy is not directed at children under 17. We do not knowingly collect personal data from minors. If you believe a child has created an account, contact us and we will delete it promptly.
Under PIPEDA and applicable provincial legislation, you have the right to access the personal data we hold about you, correct inaccuracies, and request deletion. You can exercise all of these rights directly within the app or by contacting us.
We may update this policy periodically. Material changes will be communicated through the app. Continued use after changes constitutes acceptance of the updated policy.
For privacy inquiries or data requests: support@faldar.ca