Privacy Policy

1. Who We Are

DecodeETF (“we”, “us”, “our”) operates the website at decodeetf.com. We are based in Ontario, Canada. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

Analytics and ad cookies only turn on if you click Accept in the cookie bar. The research tools work either way.

2. Information We Collect

We collect the following categories of personal information:

Account information

When you create an account, we collect your email address and a securely hashed password. You may optionally provide a display name. This information is required to provide you with a personalized experience and to manage your subscription.

Portfolio data

If you use the Portfolio Tracker, we store the ETF and stock holdings, share quantities, purchase prices, and transaction history that you voluntarily enter. This data is stored securely and associated with your account. It is never sold or shared with third parties for marketing purposes.

Payment information

If you subscribe to a paid plan, payment processing is handled by Stripe. We do not store your credit card number or banking details on our servers. We receive a customer ID and subscription status from Stripe. Stripe's privacy policy is available at stripe.com/privacy.

Usage data

We automatically collect information about how you interact with the Site, including pages visited, features used, search queries, session identifiers, and approximate geographic location derived from your IP address. This data is used to improve the Site and is not linked to your identity unless you are signed in.

When you arrive through one of our ads or a campaign link, we save the campaign labels in your browser storage so we can tell which ad brought you here. If you create an account or start a paid plan, those labels are saved with your account and with our payment processor. We only use this to see which ads lead to signups and subscriptions. We don't store ad click IDs or search terms, and we don't send any of this to ad platforms.

When you run a report in Rate My Portfolio, we keep a daily count of the fund and stock symbols entered, with no amounts and nothing that links them to you, so we can decide which funds to add data for.

When you run a backtest or a portfolio report, we also keep the list of funds and stocks it covered (and a backtest's percentage mix), with nothing that links it to you, so we can check that our tools give correct results. We never record a report's amounts or values.

Cookies and similar technologies

These stay on no matter what you choose, because they keep the site working and help us see overall use:

• the cookie that keeps you signed in;
• your settings on this device, such as light or dark theme, a watchlist saved without an account, and your cookie choice;
• our own counts of visits and pages viewed, which use a random ID stored in your browser (see Usage data above);
• page view counts from our host, Vercel, which do not set cookies.

Three outside services wait until you choose Accept in the cookie bar at the bottom of the screen:

• Microsoft Clarity, which shows us how visitors use the site: where they click, how far they scroll, and recordings of browsing sessions. Pages that show your own portfolio, watchlist or account details are masked in those recordings. Clarity sets its own cookies; Microsoft's privacy statement describes how it handles that data.
• Google AdSense, which shows ads and may use cookies to choose and measure them.
• X (formerly Twitter), which tells us whether people who saw our ads on X later visited the site. X sets its own cookies; X's privacy policy describes how it handles that data.

If you choose Decline, or don't answer, none of them load. The research tools still work as usual.

To change your answer, use Cookie settings at the bottom of any page. If you switch from Accept to Decline, the page reloads so anything already running stops. In the rare case your browser refuses to save a Decline while an earlier Accept remains, a notice will explain that clearing this site's data and reloading turns those cookies off. Cookies that Clarity, Google or X set before then stay in your browser until they expire or you delete them. You can also block or delete cookies in your browser settings.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Site and its features;
• Authenticate you and maintain your account;
• Process subscription payments and manage billing;
• Respond to your inquiries and provide customer support;
• Send transactional emails (account confirmation, password reset, subscription receipts);
• Analyse usage patterns to improve the user experience;
• Display advertising through Google AdSense (public and free-tier users), if you allow it;
• Comply with legal obligations.

We do not sell your personal information to third parties. We do not use your portfolio data for advertising targeting.

4. Third-Party Service Providers

We share limited personal information with these service providers. They help run the site, measure its use, or show ads when you click Accept:

• Supabase: database and authentication hosting. Data is stored on servers in the United States.
• Stripe: payment processing. Handles all credit card data directly; we never see your card number.
• Vercel: website hosting and edge delivery. Processes request logs and performance data.
• Google AdSense: advertising network for free-tier users, loaded only if you choose Accept in the cookie bar. Google may use cookies to serve relevant ads. See Google's Privacy Policy.
• Microsoft Clarity: usage analytics, heatmaps and session recordings, loaded only if you choose Accept in the cookie bar. Pages showing your portfolio, watchlist or account details are masked. See Microsoft's Privacy Statement.
• X (formerly Twitter): measures visits from our ads on X, loaded only if you choose Accept in the cookie bar. See X's Privacy Policy.
• Upstash: Redis caching layer for performance. No personal data is stored in the cache.

Some of these providers process data outside Canada. Microsoft, Google and X receive browsing data from Clarity, AdSense and the X pixel only if you click Accept.

5. Data Retention

We retain your personal information for as long as your account is active, or as needed to provide you services. If you delete your account, we will delete your personal data and portfolio holdings within 30 days, except where retention is required by law (e.g. financial records related to payments, which are retained for 7 years as required by Canadian tax law).

6. Your Rights Under PIPEDA

Under PIPEDA, you have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate information;
• Withdraw consent to collection or use (where consent is the legal basis), which may limit your ability to use certain features;
• Request deletion of your account and associated personal data;
• File a complaint with the Office of the Privacy Commissioner of Canada.

To exercise any of these rights, contact us at contactus@decodeetf.com. We will respond within 30 days.

7. Security

We implement industry-standard security measures including encrypted connections (HTTPS), hashed passwords, row-level database security, and restricted API access. However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security of your information.

8. Children's Privacy

The Site is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email. The “Last updated” date at the top of this page reflects the most recent revision. We'll ask for a new cookie choice before adding another outside tracker.

10. Contact Us

For privacy-related questions, requests, or complaints, contact our privacy officer at:

DecodeETF
Ontario, Canada
contactus@decodeetf.com