Privacy Policy

1. Who We Are

DecodeETF (“we”, “us”, “our”) operates the website at decodeetf.com. We are based in Ontario, Canada. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

By using the Site, you consent to the practices described in this Policy. If you do not agree, please do not use the Site.

2. Information We Collect

We collect the following categories of personal information:

Account information

When you create an account, we collect your email address and a securely hashed password. You may optionally provide a display name. This information is required to provide you with a personalized experience and to manage your subscription.

Portfolio data

If you use the Portfolio Tracker, we store the ETF and stock holdings, share quantities, purchase prices, and transaction history that you voluntarily enter. This data is stored securely and associated with your account. It is never sold or shared with third parties for marketing purposes.

Payment information

If you subscribe to a paid plan, payment processing is handled by Stripe. We do not store your credit card number or banking details on our servers. We receive a customer ID and subscription status from Stripe. Stripe's privacy policy is available at stripe.com/privacy.

Usage data

We automatically collect information about how you interact with the Site, including pages visited, features used, search queries, session identifiers, and approximate geographic location derived from your IP address. This data is used to improve the Site and is not linked to your identity unless you are signed in.

Cookies and similar technologies

We use cookies and local storage for authentication (to keep you signed in), preference storage, and analytics. Third-party advertising cookies may be set by Google AdSense when ads are displayed. You can control cookie preferences through your browser settings or our cookie consent banner.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Site and its features;
• Authenticate you and maintain your account;
• Process subscription payments and manage billing;
• Respond to your inquiries and provide customer support;
• Send transactional emails (account confirmation, password reset, subscription receipts);
• Analyse usage patterns to improve the user experience;
• Display advertising through Google AdSense (public and free-tier users);
• Comply with legal obligations.

We do not sell your personal information to third parties. We do not use your portfolio data for advertising targeting.

4. Third-Party Service Providers

We share limited personal information with the following trusted service providers, solely to operate the Site:

• Supabase — database and authentication hosting. Data is stored on servers in the United States. Supabase is GDPR-compliant.
• Stripe — payment processing. Handles all credit card data directly; we never see your card number.
• Vercel — website hosting and edge delivery. Processes request logs and performance data.
• Google AdSense — advertising network for free-tier users. Google may use cookies to serve relevant ads. See Google's Privacy Policy.
• Upstash — Redis caching layer for performance. No personal data is stored in the cache.

Some of these providers are located outside Canada. By using the Site, you consent to the transfer of your information to these providers in accordance with this Policy.

5. Data Retention

We retain your personal information for as long as your account is active, or as needed to provide you services. If you delete your account, we will delete your personal data and portfolio holdings within 30 days, except where retention is required by law (e.g. financial records related to payments, which are retained for 7 years as required by Canadian tax law).

6. Your Rights Under PIPEDA

Under PIPEDA, you have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate information;
• Withdraw consent to collection or use (where consent is the legal basis), which may limit your ability to use certain features;
• Request deletion of your account and associated personal data;
• File a complaint with the Office of the Privacy Commissioner of Canada.

To exercise any of these rights, contact us at contactus@decodeetf.com. We will respond within 30 days.

7. Security

We implement industry-standard security measures including encrypted connections (HTTPS), hashed passwords, row-level database security, and restricted API access. However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security of your information.

8. Children's Privacy

The Site is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email. The “Last updated” date at the top of this page reflects the most recent revision. Continued use of the Site after changes are posted constitutes your acceptance of the revised Policy.

10. Contact Us

For privacy-related questions, requests, or complaints, contact our privacy officer at:

DecodeETF
Ontario, Canada
contactus@decodeetf.com