Tureasury

This is a draft. Some of what a policy has to state is a fact about this deployment rather than about the software, and it has not been set yet. Each one appears below in square brackets. Until they are filled in, treat this page as unfinished:

Tureasury:Legal:OperatorName
Tureasury:Legal:ContactAddress
Tureasury:Legal:PolicyReviewedOn
Tureasury:Legal:GoverningLaw

Privacy policy

Last reviewed against the code: [not yet decided: the date this text was last checked against the code]. Accountable for the personal information here: [not yet decided: who runs this instance], reachable at [not yet decided: where to write about your data].

What is collected, and why

A username, an optional display name and a password, so there is an account to sign into. No email address is asked for or stored, because nothing here sends mail.
Whatever you enter or import into the ledger: accounts, balances, dates, amounts, payees, memos, budgets and bills. This is financial information about your household and is treated as sensitive.
An authenticator secret and recovery codes, if you turn on two-factor authentication.
A security log of sign-ins and account changes. Your IP address is truncated to a network range before it is stored -- the last octet of an IPv4 address is dropped -- and your browser is recorded as a name such as 'Firefox on Windows' rather than as a full user-agent string.

Accounts are created by invitation only. An invitation is a one-time link; there is no email sender here, so whoever invites you passes the link on by whatever means you already trust.

This deployment does not read documents with an AI model, does not work out tax returns, and does not connect to any broker or exchange. Those features are not merely hidden -- the code for them is not registered in this process and their addresses answer 404, so no API key for an outside service is held or asked for.

Imported files

The bank export files you upload are not kept. Once a statement has been made from one, the file is discarded and what remains is its name, its size and a SHA-256 checksum -- enough to recognize the same file if it is uploaded again, and not enough to reconstruct it. An upload you never apply loses its bytes after 7 day(s).

Who it is shared with

Members of your own household, limited to the accounts you or they have been granted. Categories are shared across the household.
An account only you hold stays private until you share it on the Sharing screen: either a few totals you pick, or its entries. Stopping takes effect on the other person's next look; it cannot take back what they already saw or downloaded.
Nobody in any other household. Isolation is enforced in the database layer rather than per query, and it is tested.
Whoever operates this server has direct access to the database and its backups. This is stated plainly because it is true: the data is not end-to-end encrypted, and no arrangement in this software prevents the operator from reading it. The operator role inside the app grants no access to any household's books, but that is a limit on the application, not on the person holding the database password.
No advertising, no analytics, no third-party trackers, and nothing sold or shared for marketing. The only outbound request this deployment makes is to the Bank of Canada for published daily exchange rates, which carries nothing about you.

Where it is held

Hosting: OVHcloud - Oregon, United States. The country the data sits in decides which authorities can compel access to it, which is why this is stated rather than left to be inferred.

Your data is held outside Canada. It is stored and backed up in United States. While it is there it is subject to that country's law, and its authorities may be able to compel the hosting provider to hand it over, through a process you would not necessarily be told about and that Canadian law does not govern. This is a transfer outside Canada and it is stated here because you are entitled to know it before you put a household's financial history on this server.

How long it is kept

The ledger: until you delete it. Nothing here removes a transaction on a timer.
The security log: 90 day(s).
Backups of the database: about 30 day(s), after which they rotate out.

Deleting your account removes it from the live database immediately. It does not reach into backups already taken: a backup that is edited after the fact is no longer a reliable copy of anything. A deleted account therefore persists in backups until they age out within the window above.

What you can do

Take a copy of your data as a zip, from Your data, at any time.
Correct anything yourself -- every figure in the ledger is editable by whoever can write to the account it belongs to.
Delete your account, from Your data. A household with other members keeps its books; a household nobody else is in is erased with you. The screen shows which is which before you confirm.
Ask a question or complain, to the contact above. If you are not satisfied, the Office of the Privacy Commissioner of Canada takes complaints about private-sector organizations.

If there is a breach

If personal information here is lost or accessed by somebody who should not have it, and it is reasonable to believe that creates a real risk of significant harm, the operator will notify you as soon as feasible with what happened, when, what was involved and what to do about it, and will report it to the Office of the Privacy Commissioner of Canada. A record is kept of every breach, whether or not it meets that threshold. Reach the operator about a suspected breach at [not yet decided: where to write about your data].

How you would be told: a notice at the top of every page in this application, and on the sign-in page where the operator marks it so -- because being unable to sign in may be the whole problem. There is no email sender here and no email address on file, so that notice and whatever way the operator already contacts your household are the two channels there are.

Privacy · Terms