Privacy Policy
This Privacy Policy explains how PayPixel ("we", "us", or "our"), operated by Chris Nickel, collects, uses, and protects your personal information. We are committed to complying with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario privacy legislation.
1. What We Collect
Account information: Your email address and hashed password when you register. If you use a third-party login (e.g. Google), we receive only the email address and profile name provided by that service.
Household and budget data: The household name, earner names, expense names, paycheque amounts, and monthly plan data you enter into the Service. This information is provided by you and used solely to operate the Service.
Invitation data: Email addresses of people you invite to your household.
Usage and technical data: Server-side logs (request paths, timestamps, error traces) used for debugging and security. We do not use third-party analytics or advertising trackers.
2. How We Use Your Information
We use your information only to provide and improve the Service: authenticating your account, displaying your budget data, sending transactional emails (invitations, account notifications), and providing customer support. We do not sell, rent, or share your personal information with third parties for marketing purposes.
3. Third-Party Services
Resend — transactional email delivery. Your email address is transmitted to Resend when we send you a notification. Resend's privacy policy applies to their handling of that data.
Stripe — payment processing for paid subscriptions. Stripe collects payment card information directly; we do not store card numbers. Stripe's privacy policy applies.
No other third parties receive your personal information.
4. Cookies
We use only strictly necessary cookies:
.AspNetCore.Identity.Application — an encrypted session cookie that keeps you logged in. It expires when you log out or your browser session ends (or after 14 days if you choose "Remember me").
.AspNetCore.Antiforgery.* — a security token that protects against cross-site request forgery (CSRF). It is deleted when your browser session ends.
We do not use advertising, analytics, or tracking cookies. No consent banner is required for strictly necessary cookies.
5. Data Retention
We retain your data for as long as your account is active. When you delete your account, all associated data — including household records, budget plans, earner and expense data, and pending invitations — is permanently deleted. Some information may remain in encrypted backups for up to 30 days before being purged.
6. Your Rights
Under PIPEDA you have the right to:
Access: Request a copy of the personal information we hold about you.
Correction: Update your email address and account details via Account Settings.
Erasure: Delete your account and all associated data via Account → Delete personal data. Deletion is immediate and permanent.
To exercise these rights or ask questions about your data, contact us at chris@nckl.ca.
7. Security
We use industry-standard measures to protect your data: passwords are hashed with ASP.NET Core Identity's PBKDF2 algorithm; connections are encrypted via TLS; access to production systems is restricted. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
8. Children
The Service is not directed at children under 18. We do not knowingly collect personal information from children.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you by email or in-app notice at least 14 days before changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.
10. Contact
Privacy questions or requests? Contact us at chris@nckl.ca.
