Privacy Policy

Scope and Accountability

NUMIO INC. is responsible for personal information under its control in the Numio websites, applications, household budgeting workspace, and related features. A named Privacy Owner maintains our purpose, jurisdiction, Processor, rights, retention, deletion, and incident records.

Questions, verified rights requests, complaints, and privacy or security reports may be sent to legal@numio.ca or mailed to Toronto, Ontario, Canada. Our internal response target for a verified access, correction, deletion, or portability request is 15 calendar days, subject to applicable law, identity verification, confidentiality, and a recorded lawful extension or refusal.

Information and Purposes

We collect the minimum information needed for a recorded service, security, legal, or support purpose. We provide layered notice at Admission, first financial collection, Household acceptance, representation of another person, export, and a material purpose or Processor change.

• Identity and Admission data: name, verified email, authentication link, majority and ordinary-residence attestation, accepted notice version, and current private-alpha grant.
• Household authority: Household settings, Membership tenures, Invitations, represented-person authority and decisions, consent evidence, and attributable Activity History.
• Manual financial authority: Plan Items, Recurring Plan Values, Monthly Plans and amounts, Accounts, Debts, Financial Events, Postings, Actual and Progress Allocations, relations, Balance Observations, reconciliations, Month Reviews, and corrections.
• Operational data: content-free security, authentication, reliability, job, deadline, and incident records; support correspondence; and a theme preference or other necessary browser state.

Household Sharing and Representation

A Household is the shared planning and financial-data boundary. Every active Member can view and edit shared financial authority; the Owner additionally administers Invitations, Membership, ownership, and Household deletion. Leaving or removal ends access but does not erase shared records or attribution.

A Member may identify a non-member only after attesting adult permission or lawful parent or guardian authority. Representation grants no Numio access. A later Member must explicitly link, reject, or keep the identities separate; Numio does not match people automatically by name or email.

Processors and Cross-Border Processing

Clerk processes authentication data, Convex processes application and file-storage data, and Vercel hosts application delivery. We approve a Processor only after recording its role, entity, locations and subprocessors, purpose restrictions, safeguards, incident route, and return or deletion path.

These Processors may handle information outside your country, including in Canada or the United States. Courts, law enforcement, or regulators in a processing jurisdiction may obtain lawful access. We do not add another vendor path until the required review is complete.

Cookies, Telemetry, and Secondary Use

Clerk uses necessary cookies or similar technology for authentication and session security. Functional browser storage may retain a theme preference. Authenticated financial content is not placed in browser persistence as a fallback.

Private-alpha telemetry is content-free and limited to security, availability, latency, safe result classes, retries, jobs, deadlines, and environment integrity. The alpha performs no advertising, no sale or sharing for advertising, no nonessential analytics, no model training, no sensitive-trait inference, and no behavioral or economic profiling.

Retention

Retention is purpose-limited and these periods are maximums. A narrow legal hold or active dispute may pause only the identified deletion, remains access-restricted, and is reviewed every 90 days.

• Household financial content and Activity: active Household life; primary and Processor purge within 30 days after final deletion; backup expiry within 90 days.
• Admission evidence and Household-sharing acceptance: the relevant grant or Membership life plus 24 months.
• Represented-person authority and mapping: authority or purpose life plus 24 months, with direct identity removed within 30 days when no longer needed.
• Pending Invitation: seven days; terminal raw non-User contact: 30 days; hashed permission, delivery, or stop evidence: three years.
• Identifiable former-member display mapping: Membership end plus 24 months, then Household-scoped pseudonymization.
• Household Export grant: 15 minutes; generated server artifact: no more than 24 hours.
• Raw first-party operational telemetry: 30 days; non-identifying aggregate: 90 days; security and authentication logs: 12 months.
• Rights, complaints, corrections, withdrawal, deletion, privileged-access, and export audit evidence: closure or event plus 24 months; privacy or security incident records: five years.

Deletion and Recovery

An Owner's Household deletion request starts a 30-day reversible window, revokes pending Invitations, and blocks ordinary work. Finalization ends Memberships; primary, export, and Processor deletion completes within the following 30 days and backup deletion within 90 days. Finalized deletions are replayed before restored backups can serve traffic.

A Sign-in Account change is not Numio User deletion. A User deletion request also has a 30-day reversible window. Before it starts, each owned Household must be transferred or placed into deletion. Continuing shared Household authority remains; personal attribution is pseudonymized under the retention rules.

Your Rights and Portability

Subject to applicable law, you may request access, correction, deletion, portability, withdrawal where available, or submit a complaint. The authenticated application provides self-service privacy controls, and you may also contact the Privacy Owner. We verify identity and protect other people's information before responding.

A Household Export is a shared Household snapshot for active Members, not an individual-rights response, import, or backup. It is integrity-signed, may be explicitly partial, and excludes credentials, global identity identifiers, private operator records, and unrelated evidence. A former Member uses the separately verified individual-rights process and does not regain Household access.

Safeguards and Operator Access

We use authorization, Household isolation, revisioned writes, audit history, encryption and provider controls appropriate to sensitive financial information. No internet service can promise absolute security.

Production financial-content access is denied by default. Approved support or emergency access must have a named purpose, least privilege, approval, a maximum four-hour grant, immutable audit, second-person review within 24 hours, and notice unless a documented lawful or safety exception applies.

Age and Capacity

A participating account holder must have reached the age of majority where they ordinarily reside. The private alpha has no child-account or parent-consent account flow. A minor or dependent may appear only as an authorized Represented Person without access.

Changes and Contact

We will update the effective date and provide additional notice before a material change takes effect where required. An optional purpose is not bundled into core service acceptance.

Contact legal@numio.ca or write to NUMIO INC. at Toronto, Ontario, Canada. You may also contact the privacy regulator available in your jurisdiction if you are dissatisfied with our response.