Privacy Policy

Same plain language as the terms, and the same caveat: this describes what actually happens, and it is not legal advice.

Horizon holds your household’s financial history. Not a summary of it — the transactions themselves, imported from your bank’s own files. This page says what that means, who else can see any part of it, and what you can make me do about it.

Who is responsible

Horizon is run by one person: DevLogik, 2843 Rue des Deux Rivières, Carignan, J3L 5A4, Quebec, Canada.

Privacy officer: DevLogik, support@horizonmoney.ca. Quebec’s Law 25 requires a named person to be responsible for protecting personal information and requires that person’s contact details to be published. That is the person.

For anything routine — a question, an access request, a deletion — support@horizonmoney.ca reaches me too.

What I collect

Your account. Your email address, your display name, a hashed password (never the password itself), your language, theme and time zone, and the dates you signed up and last signed in.

Everything your household puts in. This is the sensitive part, and I am going to be specific about it rather than call it “your content”:

• transactions, including bank transaction history imported from CSV, QIF or OFX/QFX files — dates, amounts, merchant names, descriptions and any memo your bank wrote;
• accounts and their balances, categories, envelopes and budget figures;
• recurring items, forecasts, debts and debt-payoff plans;
• investments: holdings, ticker symbols, units, trades and valuations;
• on Horizon Pro: simulated portfolios, sandbox orders, bots, their limits, and the audit trail behind each one;
• anything you typed into a note field.

Read together, that is a detailed picture of where you shop, where you bank, what you earn, what you owe, who you pay rent to, whether you gamble, and what you were doing on a given Tuesday. I hold it because the app cannot forecast anything without it. I do not want any more of it than that.

Payment details, but not your card. Stripe processes payments and holds your card. I see the last four digits, the brand, the country, the expiry, and whether a charge succeeded. Your full card number never touches my servers.

Technical logs. IP address, the requested path, a timestamp, an error and its stack trace when something breaks. Kept about 30 days, then discarded.

Email delivery records. Whether a message was sent, delivered, bounced or failed. Brevo holds these.

On the iOS app. A cached copy of what you last looked at, held on your device so the app still shows something with no signal, and the sign-in token in the iOS Keychain. If a future release ever registers your device for push notifications, that registration is a device token and nothing more — today Apple does not permit push at all for how the app is signed.

What I do not collect

• No bank credentials, ever. Horizon does not connect to your bank, has no Plaid or aggregation integration, and there is nowhere in the app to type an online banking password. If a page ever asks you for one, it is not Horizon.
• No advertising trackers, no ad networks, no data brokers, no fingerprinting.
• No selling, renting or sharing your data with anyone for their own purposes. Not now, and if that ever changes I will ask you first rather than announce it.
• Nothing you put into Horizon is used to train an AI model — not mine, not a vendor’s.
• I do not build a profile of you across other websites.

The marketing site uses no analytics at all — no Google Analytics, no tag manager, no pixel, not even a privacy-friendly counter. It ships no JavaScript, loads no fonts or scripts from anyone else’s server, and the only links that leave the page point at the app. I do not know how many people read it or where they came from. The app itself carries no third-party analytics.

Why I hold it, and on what basis

Under PIPEDA I need your consent, and you are giving it by signing up and putting data in. I use what I hold to:

• run the app and show you your own figures;
• authenticate you and keep households separate;
• take payment and prevent fraud on the payment side;
• send transactional email — verification, password reset, an invitation, a lapse warning, a security notice;
• fix bugs and keep the service standing up;
• meet tax and accounting obligations.

Marketing email, if I ever send any, is opt-in with an unsubscribe link, as Canada’s anti-spam law requires. A transactional email is not marketing and you cannot unsubscribe from a password reset.

Who else touches it

That is the whole list. There is no analytics vendor, no CRM, no support desk, no ad platform, no data warehouse.

The Yahoo problem, said out loud

Prices come from an undocumented Yahoo endpoint and Coinbase’s public endpoint. Both are free, neither is an official product, and I have no contract with either.

When a price refresh runs, the ticker symbols your household holds are sent to those endpoints along with your server’s IP address. Nothing else goes — no name, no email, no household id, no amounts, no units, no balances. But a list of symbols is not nothing: it says what you own, if not how much.

There are no terms of service covering this use, on either side. Yahoo does not offer this endpoint as a product to me, so nobody has promised anybody anything about what happens to that request. I cannot tell you how Yahoo logs it or how long they keep it, because I do not know and there is no document I could point you to.

This is why the daily price refresh is off by default. A one-time refresh you press sends the list once. A daily schedule sends it every day, and that is a switch you turn on knowing what it does. If you would rather send nothing at all, leave the feed off and type prices in by hand — every price in Horizon can be entered manually, and the app works fine that way.

The AI advisor, if you turn it on

The advisor is off unless you enable it, and it needs an Anthropic or OpenAI API key that you supply and you pay for.

When a bot runs, the model vendor is sent your simulated portfolio’s positions and cash, the closing prices on record, the bot’s own limits and stake, and the instructions the app wrote. It is not sent your name, your email, your bank transactions, your real accounts, your balances or your budget.

The vendor’s own privacy terms govern what they do with that request, including how long they keep it. That is a direct relationship between you and them, on your key and your bill. Read their terms; I cannot make promises on their behalf.

What I keep on my side is the audit trail: which model was asked, at what effort level, how many tokens it used, what it cost, a digest of what it was shown, and what it answered. That exists so you can always find out what a bot was reasoning from — and so a bill is explainable months later.

Connected apps and MCP tokens

If you mint a personal access token so an assistant like Claude can read your household, that token reaches exactly the household you scoped it to, with exactly the permissions you granted. Tokens expire (90 days by default) and you can revoke any of them at any moment from Connected apps.

While a token is live, whatever assistant is holding it can read your household’s figures, and what that assistant’s operator does with them is governed by their terms, not mine. Revoking is instant. If you are not sure what a token is for, revoke it — minting a new one takes ten seconds.

Where your data lives, and what crosses a border

The database and the app run in Azure Canada Central. Your household data sits in Canada.

Stripe, Brevo, Yahoo, Coinbase and the AI vendors are outside Quebec, and in most cases outside Canada. Law 25 requires me to assess a transfer outside Quebec before I make one, and to tell you what it involves. The table above is what leaves, to whom, and for what — the largest item by far is your email address going to Stripe and Brevo, and the most sensitive is the ticker list going to Yahoo. Your transaction history goes to none of them.

Data held in the United States can be reached by US authorities under US law. That is true of every service that uses a US processor, and I would rather say it plainly than hide it in a subprocessor list.

Security, without the adjectives

Here is what is actually in place:

• traffic runs over HTTPS;
• passwords are hashed with a modern algorithm and are not recoverable, by me or anyone;
• sign-in uses short-lived tokens; the refresh token is an HttpOnly cookie that rotates on every use;
• personal access tokens are stored hashed, and are shown to you exactly once;
• broker and AI credentials are encrypted with a key held in a managed key store, and are never returned by any endpoint after you save them — a key that changed has to be re-entered, because there is no way to read one back;
• every request is scoped to one household by a gate that every endpoint goes through, and an automated test refuses to let a new endpoint skip it;
• the database is encrypted at rest by the host.

Here is what is not:

• there has been no independent security audit and no penetration test;
• there is no SOC 2, no ISO 27001, and no compliance certification of any kind;
• it runs as a single instance in a single region, with no failover;
• I can read the database. One person operates this service, and that person has administrative access to fix things. I look at household data only when I need to for a problem you have told me about, or to keep the service running. Nobody else has access — because there is nobody else.

I will not describe any of this as bank-level or military-grade. It is careful work by one developer, and that is a different thing.

How long I keep it

• While your account is open: as long as you keep it.
• A lapsed household: kept, read-only, exportable, indefinitely — with one exception. After 12 months lapsed and untouched, you get an email; at least 30 days later, a second one; and if nobody signs in or exports after either, the household is deleted.
• If you delete your account or household: it is removed from the live database right away. Database backups roll off within about 7 days, and after that it is gone from those too.
• Payment records: Stripe keeps its own records, and I keep invoices for 6 years, as Canadian tax law requires. This is one thing a deletion request cannot erase.
• Server logs: about 30 days.
• Email delivery records: as long as Brevo keeps them under its own policy.

What you can make me do

Under PIPEDA and Law 25 you can:

• Ask what I hold about you, and get an answer within 30 days.
• Correct anything wrong. Most of it you can edit yourself; write to me for the rest.
• Take it with you. Seven CSV exports and a full JSON backup, in a structured, machine-readable format, available on every plan including a lapsed one. This is Law 25’s portability right, and it was in the product before it was in this policy.
• Have it deleted. Delete your household and it is gone, subject to the tax records above. There is no cooling-off period and no retention hold — deletion in Horizon is the one irreversible thing in the app, which is exactly what a deletion should be.
• Withdraw your consent, which in practice means closing your account.
• Complain. To me first, please — support@horizonmoney.ca — but you never have to go through me. In Quebec: the Commission d’accès à l’information du Québec (cai.gouv.qc.ca). Elsewhere in Canada: the Office of the Privacy Commissioner of Canada (priv.gc.ca).

No decision that affects you is made about you by automated means. The AI advisor proposes trades in a simulation; it does not decide anything about you, your account or your access.

If there is a breach

If personal information here is lost, exposed or accessed by someone who should not have it, and there is a real risk of serious harm, I will:

1. tell the Commission d’accès à l’information and the Office of the Privacy Commissioner as promptly as the law requires;
2. email everyone affected, describing what happened, what was in it, and what to do;
3. record the incident in the confidentiality-incident register Law 25 requires me to keep.

I will not sit on it while I decide whether it looks bad.

Children

Horizon is for adults. Do not open an account for a child. If you are teaching a teenager to budget, use your own household and your own login.

Cookies

Horizon sets a session cookie and a refresh-token cookie, both needed to keep you signed in, plus a small preference or two (your language, your theme). There are no advertising cookies and no cross-site tracking, so there is no consent banner to click past. The marketing site sets none at all: it is static pages with no JavaScript, so there is nothing running on it that could.

Changes

I will update this page and change the date at the top. If a change materially affects what I do with your data, you get an email at least 30 days before it takes effect — for a document like this, a silent edit would be the whole problem.

Contact

Privacy officer: DevLogik, support@horizonmoney.ca. Everything else: support@horizonmoney.ca.