Privacy Policy

Last updated: May 17, 2026 · Effective: May 17, 2026

The short version: DuoBudgets is funded by users, not advertisers. We do not sell your data, share it with advertisers, or use it for any purpose other than running your budget app.

1. Who We Are

DuoBudgets is operated by Simpsons AI Solutions Inc., Saskatoon, Saskatchewan, Canada. Contact: [email protected].

2. Information We Collect

Account information: Name and phone number for authentication. Optional email for account recovery.
Budget and financial data: Entries, amounts, debts, subscriptions, investments, and savings goals you enter.
Bank transaction data (optional): Via Plaid — transaction names, amounts, dates, merchant info. We never see your bank credentials.
Biometric authentication (optional): A cryptographic public key only. Your biometric data never leaves your device.
Session data: A secure session token expiring after 24 hours.
SMS consent: Date and time of consent, retained as required by CASL.

3. How We Use Your Information

Solely to provide and operate DuoBudgets. We do not sell your data, share it with advertisers, or use it for any purpose outside the service.

4. Bank Connection and Plaid

If you connect a bank, DuoBudgets uses Plaid. Your credentials go directly to Plaid — we never see them. The connection is read-only. You can disconnect at any time from Settings. Plaid's privacy policy: plaid.com/legal.

5. Cookies

We use one strictly necessary session cookie (connect.sid) with HttpOnly, Secure, and SameSite=Lax properties. No advertising cookies, no tracking pixels.

6. Data Security

HTTPS/TLS encryption in transit, HttpOnly/Secure/SameSite session cookies, PIN brute-force protection, WebAuthn for biometric login. Sessions are stored in a managed PostgreSQL database and expire after 24 hours. Receipt images are stored in Cloudflare R2 with private-only access. You can sign out all other active devices at any time from Settings. In the event of a breach posing real risk of harm, we will notify affected users and the Office of the Privacy Commissioner of Canada as required under PIPEDA.

7. Third-Party Providers

Twilio — SMS delivery
Resend — Email delivery
Plaid — Bank connectivity
DigitalOcean — Hosting and PostgreSQL database (Toronto, Canada)
Cloudflare R2 — Receipt image storage

8. Your Rights Under PIPEDA

Access, correction, deletion, withdrawal of consent. Contact [email protected]. We respond within 30 days.

9. Contact

DuoBudgets · Simpsons AI Solutions Inc. · Saskatoon, Saskatchewan, Canada · [email protected]