Privacy Policy

Last updated: October 25, 2026

This Privacy Policy describes the personal information Pilot Wealth collects, the purposes for which it is processed, and the rights and choices available to users.

1. Introduction

This Privacy Policy applies to the Pilot Wealth website and personal-finance application (the "Service"). Pilot Wealth ("we", "us", or "our") is responsible for personal information under its control, including information processed on its behalf by service providers.

Pilot Wealth collects, uses, and discloses personal information for the purposes described in this policy, with consent where required or as otherwise permitted by applicable law. The applicable legal framework includes Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial privacy legislation where applicable.

Account information required for authentication is necessary to maintain an account. Bank connections, AI conversations, stock watchlists, and the province and age fields described below are optional. Declining information required for a particular feature may prevent that feature from operating; participation in unrelated optional features is not required.

2. Information We Collect

2.1 Information Provided by Users

Pilot Wealth processes the following information when users register for or use the Service:

• Account and profile information. We process names, email addresses, usernames, profile photographs, and account preferences supplied through account registration or profile settings.
• Financial information. We store financial information entered into the Service, including account names and balances, budgets, custom categories, income, expenses, transaction descriptions, assets, debts, financial goals, investment holdings, and stock watchlists.
• Settings and activity records. We store notification preferences, dashboard settings, onboarding responses, course and lesson progress, quiz answers, Pilot Coins balances and transactions, and referral records.
• Communications. We process support requests, feedback, and other messages submitted to Pilot Wealth. Sections 2.3 and 2.8 describe AI conversations and reply ratings.
• Authentication and security information. Clerk manages login credentials and sessions. If optional two-factor authentication is enabled, Pilot Wealth stores an encrypted authenticator secret, hashed backup codes, verification records, and information needed to detect repeated or unsuccessful verification attempts.

2.2 Information Collected Automatically

Use of the Service generates technical and usage information, including IP addresses, request timestamps, browser and device information, pages visited, interactions with features, error records, and performance measurements. This information supports operation of the Service, security monitoring, abuse prevention, and usage analysis.

Cookies and browser storage may contain authentication identifiers, preferences, and campaign attribution information. Sections 6.3 and 11 describe analytics and tracking technologies.

2.3 AI Interaction Data

When an AI feature is used, Pilot Wealth sends the submitted message and recent conversation history to xAI to generate a response. For requests involving personal finances, we also prepare a financial summary from the user's Pilot Wealth records. General educational questions that do not require personal financial information, such as a request to define a TFSA, are sent without a newly prepared financial summary.

The financial summary may contain the following information:

• It includes account names and balances, debts and payment obligations, income sources, assets, stock holdings, budgets, and related financial totals and projections.
• It includes bill and subscription names, amounts, and due dates, including upcoming obligations during the current month. It also includes detected recurring charges that have not been dismissed, with merchant names, usual amounts, payment frequencies, and the dates of the latest charges.
• It includes current spending, spending pace and projections, and category totals for up to 12 months. Categorization information includes transaction counts and monetary totals by category source, such as bank-provided categories, keyword rules, the categorization model, or user corrections, together with the number requiring review.
• It includes up to 25 recent transactions and their dates, descriptions, amounts, and categories. Descriptions identified as person-to-person transfers, including certain Interac e-Transfer descriptions, are replaced with neutral labels before transmission; their dates, amounts, and categories remain included.
• For paid plans, it includes the Pilot Score, its seven component scores, and their underlying financial measurements. Status descriptions accompany five components; the two net-worth components exclude descriptions that compare the user with an age group.

The automatically prepared summary excludes the user's name, email address, user ID, province, and age. Messages submitted by a user may nevertheless contain identifying information, and transaction or account descriptions may contain personal information that automated filtering does not recognize.

Pilot Wealth uses xAI's Zero Data Retention setting for AI request and response content. Under that setting, xAI processes requests without retaining their content or the generated responses. xAI states that it does not use API data to train its models without permission. These arrangements concern xAI's processing; Pilot Wealth separately stores encrypted conversation history and reply information as described in section 2.8.

We record message and token usage to administer plan limits and monitor AI processing costs. Operational error and usage records are distinct from the encrypted conversation history.

2.4 Bank Connection Data

Bank connections on PRO and PREMIUM plans use Plaid. Before the Plaid connection interface opens, users must authorize the connection through a consent checkbox. Pilot Wealth records the authorization date and the version of the consent notice.

• Plaid handles bank login credentials directly. Pilot Wealth receives connection identifiers, account names, balances, and transaction history, and PREMIUM investment features may also receive investment holdings.
• For credit cards, lines of credit, loans, and mortgages, we receive minimum payments, interest rates or annual percentage rates, and next payment due dates where the financial institution provides them. We do not store other liability details provided through that interface, such as statement history, loan servicer details, or mortgage property addresses.
• When synchronization is available, financial information may refresh in response to notifications from Plaid or a user-initiated synchronization request.
• Pilot Wealth encrypts Plaid access tokens at the application level. When a connection or account is removed, we request revocation through Plaid before deleting the locally stored token. A provider error can prevent confirmation of revocation; deletion of our token does not by itself establish that Plaid has revoked the connection.

Plaid also processes financial information under its End User Privacy Policy. Users may disconnect a bank connection without deleting their Pilot Wealth account.

2.5 Province and Age

Province or territory and age are optional profile fields collected during setup or through Settings. Users may select "Prefer not to say", change either response, or clear it. We convert a stated age into a birth year and encrypt both profile fields using a dedicated encryption key.

• The province or territory supplies a default for new income sources and their tax estimates. Users may select a different province for each income source.
• The birth year determines the age-based net-worth benchmarks used by Pilot Score, based on Statistics Canada information and a savings guideline. When no age is available, Pilot Score uses a common benchmark.
• We do not display these profile fields to other users, sell them, use them for advertising, or include them in the financial summary sent to xAI. Our hosting and database providers process the stored fields as part of operating the Service.

Both fields are included in the user's data export and deleted when the account is deleted.

2.6 Stock Tracker and Watchlists

The PREMIUM Stock Tracker stores up to 25 watchlist ticker symbols per user and the date each was added. Watchlist entries identify securities a user follows and do not indicate ownership.

Our servers request quotes for held and watched securities from Yahoo Finance and obtain currency conversion rates from the Bank of Canada. These requests identify a ticker symbol or currency code and originate from Pilot Wealth's servers; they do not include a user's name, email address, or user ID.

Users who enable stock alerts receive a consolidated email identifying securities that moved by at least their selected threshold of 2%, 3%, 5%, or 10% during the latest trading session. The email includes security names, prices, daily movements, and the user's overall return on held securities. Resend processes the email address and message content to deliver these alerts.

Pilot Wealth stores the selected threshold and the last trading session reported for each security to prevent duplicate alerts. Users may disable alerts or change their frequency and threshold in Settings. Watchlists and alert settings are included in data exports and deleted on account deletion; they are not displayed to other users, sold, or used for advertising.

2.7 Recurring Charge Detection

Pilot Wealth analyzes transaction descriptions, amounts, and dates from approximately four months of a user's transaction history to identify recurring charges and suggest bill entries. This analysis occurs on our servers using that user's records, without combining transaction histories across accounts belonging to different users.

Confirmed charges and charges that meet the detection criteria may be treated as recurring bills in financial calculations and in the AI summary described in section 2.3. The summary also includes detected charges that are not yet bills, unless the user has dismissed them.

Confirmation and dismissal choices are stored with a normalized merchant description in budget settings. These records are included in data exports and deleted on account deletion.

2.8 AI Reply Sources, Charts, and Ratings

AI replies may cite sections of a user's financial records, include a chart derived from spending, debt, or net-worth information, or provide links to dashboard sections. Replies may also cite official information hosted on canada.ca, cmhc-schl.gc.ca, and osfi-bsif.gc.ca.

Pilot Wealth saves source references, charts, dashboard links, the reasoning setting, and the model identifier with each reply. Message content and this accompanying information are encrypted using the dedicated chat encryption key. Official external links open only when selected by the user; Pilot Wealth does not send financial records to those sites, and the resulting visit is subject to the destination site's privacy practices.

Users may rate a reply positively or negatively. Negative ratings may include a reason selected from "wrong numbers", "wrong source", "not helpful", or "other". We store the rating, reason, reasoning setting, model identifier, source and chart identifiers, submission date, and a reference to the rated reply. The rating record does not duplicate the message text or financial figures. A later rating replaces the previous rating for the same reply.

We aggregate ratings across users to identify sources and reasoning settings associated with poor responses. These statistics are not provided to xAI or other third parties. The founder of Pilot Wealth may review a rated reply and the question it answered to investigate and correct errors, particularly following a negative rating. This review uses the encrypted messages already stored for conversation history and does not send those messages to xAI or disclose them beyond the infrastructure providers that process them for Pilot Wealth.

Conversation history, accompanying reply information, and ratings are included in data exports. Clearing chat history or deleting an account deletes these records and ends their availability for quality review. Individual replies and ratings cannot currently be deleted separately through the application; requests for individual removal may be submitted to the contact address in section 15.

3. How We Use Personal Information

Pilot Wealth processes personal information for the following purposes:

• We operate account, budgeting, transaction, investment, educational, and other financial-management features requested by users.
• We authenticate users, manage sessions, and protect accounts against unauthorized access.
• We calculate personalized financial summaries, tax estimates, Pilot Scores, recurring-payment suggestions, and other insights using the records relevant to each feature.
• We deliver AI responses and assess their quality as described in sections 2.3 and 2.8. Section 4.1 separately describes the shared transaction categorization model.
• We administer subscriptions, process payments through Stripe, apply plan limits, and maintain billing records.
• We provide requested notifications, stock alerts, service updates, and support, and send marketing communications where consent has been obtained.
• We analyze usage, attribution, and operational information to evaluate campaigns, identify defects, and improve the Service.
• We prevent fraud and abuse, investigate security events, comply with applicable law, and enforce the Terms of Service.

4. AI and Automated Processing

Pilot Wealth uses xAI to generate financial explanations, analysis, and recommendations. Section 2.3 identifies the information supplied for this processing, and section 2.8 describes storage and quality review of replies.

AI-generated content may contain inaccurate or incomplete information. It is provided for educational and informational purposes and does not constitute financial, legal, or other professional advice. Users remain responsible for decisions made using that content. The Terms of Service contain the applicable conditions for use of AI features.

4.1 Automated Transaction Categorization

Pilot Wealth categorizes transactions using bank-provided category information, keyword rules, and a machine learning model operated on our infrastructure. This categorization model is separate from the xAI service.

To improve categorization across the Service, we train the model on transaction descriptions and their categories from multiple users. Training examples are drawn from supported bank-assigned categories and user corrections. User-defined category names are excluded.

• Training examples contain a transaction description and its category. Names, account numbers, user IDs, and transaction amounts are not added as separate training fields. User IDs are used temporarily to remove repeated examples before the training dataset is prepared and are excluded from that dataset.
• Descriptions recognized as person-to-person transfers, including certain Interac e-Transfer descriptions, are excluded because they may identify another individual. Automated filtering may not recognize all personal information contained in free-text descriptions.
• The trained model stores a vocabulary and aggregate word-to-category statistics. It does not store a table of individual transactions or link training examples to user accounts.
• Deleting an account removes its transaction records and prevents their inclusion in future training. Deletion does not retroactively change model versions trained before the account was deleted. We retain only the three most recent trained versions.

The Data Retention Policy describes retention of transaction records and trained models. Questions or requests concerning this processing may be submitted under section 8.

5. Data Storage and Security

Pilot Wealth applies administrative and technical safeguards to personal information, including encrypted connections, access restrictions, authentication controls, rate limiting, security logging, and vulnerability review. Our hosting and database providers supply infrastructure safeguards, including encryption at rest.

Pilot Wealth applies additional encryption to Plaid access tokens, authenticator secrets, AI conversation content and reply information, and the optional province and birth-year profile fields. Separate encryption keys protect each of these data domains. Backup authentication codes are stored as hashes. Additional information is available in our Security Policy.

6. Third-Party Service Providers

Pilot Wealth uses the providers below for the stated purposes. The information a provider processes depends on the features used. Provider privacy policies describe their own processing obligations and practices; Pilot Wealth remains responsible for personal information under its control.

6.1 Account, Payment, and Infrastructure Providers

• Clerk processes account and authentication information to manage registration, sign-in, and sessions. Its Privacy Policy applies to that processing.
• Stripe processes payment information, customer identifiers, and billing records for subscriptions. Its Privacy Policy provides further information.
• Plaid processes information required for authorized bank connections and related financial data as described in section 2.4 and its End User Privacy Policy.
• Supabase hosts the production database containing Service records. Its Privacy Policy provides further information.
• Render hosts the application and processes requests, application data, and operational logs. Its Privacy Policy provides further information.
• Resend processes recipients' email addresses and message content, which may include financial information in requested alerts and summaries, to deliver Service emails. Its Privacy Policy provides further information.
• Cloudflare processes website traffic, IP addresses, request information, and security cookies through its content delivery and security infrastructure. Its Privacy Policy provides further information.

6.2 AI Provider

xAI processes messages, recent conversation history, and the financial summary described in section 2.3 to generate AI replies. Its API security and data-handling documentation describes API retention and model-training practices, which differ from its consumer services. Section 2.3 describes the Zero Data Retention setting used for request and response content.

6.3 Analytics and Operational Monitoring

We use Google Tag Manager to load Google Analytics 4 on public pages and in the application after sign-in. Analytics records page views and browser interactions, including scrolls, outbound clicks, and registration events. Available registration attribution includes campaign source, medium, name, content and term, advertising click identifiers, and the referring page.

The bank-connection interface also records connection progress events and makes the institution name, interface view, and connection-session identifier available to our analytics configuration. These events describe connection activity rather than account balances or transaction details. Section 11 describes browser storage used for attribution.

Operational monitoring records may include request identifiers, account identifiers, authentication failures, and error information. Where Better Stack (Logtail) is configured, it receives these structured logs. Logging filters redact credentials and certain sensitive values; operational logs are not intended to contain full financial records.

Further information is available in the Google Privacy Policy and Better Stack Privacy Policy. Browser privacy settings and analytics-blocking extensions can limit analytics collection. Requests concerning consent or other privacy choices may also be submitted under section 8.

6.4 Market Data Providers

Yahoo Finance supplies security quotes in response to ticker-symbol requests from Pilot Wealth's servers. The Bank of Canada supplies exchange rates in response to currency-code requests. Neither request includes the user's name, email address, or user ID. Bank of Canada exchange-rate data is available free of charge at bankofcanada.ca.

7. Data Retention

We retain personal information for the period required to provide the Service and meet the purposes described in this policy, subject to applicable legal requirements. The principal retention periods are as follows:

• Account and financial records. We retain these records while the account exists and delete them through account deletion, subject to the exceptions below.
• AI conversations and ratings. We retain conversation history, reply information, and ratings until the user clears chat history or deletes the account. Section 2.8 describes individual removal requests.
• Billing records. We retain subscription and billing records for seven years after account closure to support Canadian tax and accounting obligations. Stripe separately maintains payment records under its own requirements.
• Security and access logs. These records are retained for up to 30 days under the operational retention schedule described in the Data Retention Policy, subject to any preservation required by law.
• Database snapshots. We do not operate automated database backups. A one-off encrypted snapshot may be taken before a major database change and is deleted within 14 days. Information deleted from the active database may remain in a previously created snapshot for that period.
• Trained categorization models. We retain the three most recent versions as described in section 4.1. Account deletion does not alter a previously trained version.

Users may export data and request account deletion through Settings or by contacting Pilot Wealth. Account deletion removes application records, requests cancellation of an active Stripe subscription and revocation of Plaid connections, and deletes the Clerk login account. Provider failures can delay completion; records already deleted remain deleted. Support-assisted deletion requests are handled within 30 days, subject to applicable legal requirements.

The Data Retention and Disposal Policy contains the detailed retention schedule and deletion procedures. Service providers may retain records under their own legal obligations and policies.

8. Privacy Rights and Choices

Privacy rights depend on the applicable law and may be subject to legal exceptions. Pilot Wealth also makes self-service data export and account deletion available to all users.

8.1 Rights Under PIPEDA

• Users may request access to their personal information and information about its use and disclosure.
• Users may request correction of personal information that is inaccurate or incomplete.
• Users may withdraw consent, subject to applicable legal or contractual restrictions and reasonable notice. If withdrawal affects the provision of a feature or the Service, we will explain the consequences.
• Users may raise a privacy complaint with Pilot Wealth or the Office of the Privacy Commissioner of Canada.

8.2 Provincial Privacy Rights

Residents of Alberta, British Columbia, and Quebec may have rights under their province's private-sector privacy legislation, including access, correction, withdrawal of consent, and deletion where applicable. Quebec law also provides rights to receive qualifying computerized personal information in a structured, commonly used technological format and to request cessation of dissemination or de-indexing in specified circumstances.

Pilot Wealth does not publish public user profiles or financial records. Requests concerning dissemination or de-indexing will nevertheless be assessed under the applicable law. Complaints may be submitted to the appropriate provincial privacy regulator.

8.3 Additional Rights for Users Outside Canada

We extend privacy-request options equivalent to access, correction, deletion, portability, restriction, and objection to users outside Canada, including users in the European Union and California. Users may request restriction of specified processing, object to processing based on legitimate interests where applicable, or opt out of the sale of personal information. Pilot Wealth does not sell personal information.

These options do not limit rights that apply directly under the GDPR, CCPA, or other applicable legislation. Requests are assessed in light of the relevant right, any applicable exception, and the processing involved.

8.4 Exercising Privacy Rights

Settings provides a data export in structured JSON format and an account deletion function. Exported records include the personal and financial information held for the account; live authentication secrets, bank access tokens, and security hashes are excluded. Detailed Stripe invoices and payment history are available through the billing portal.

Privacy requests, including requests that cannot be completed through Settings, may be sent to support@pilotwealth.ca. We may require information necessary to verify identity and prevent unauthorized disclosure or deletion. We respond within 30 days of receiving a request, or within another period required by applicable law. Where a lawful extension is necessary, we provide notice and an explanation within the applicable deadline.

If a request cannot be fulfilled in whole or in part, we explain the reason and available complaint or review options.

9. Users Under the Age of Majority

9.1 Minimum Age and Consent

The minimum age for use of Pilot Wealth is 14. Users aged 14 to 17 may use the Service subject to applicable consent and legal-capacity requirements. Age alone does not establish the ability to provide valid consent; that consent must satisfy the requirements of the law governing the user.

We do not knowingly collect personal information from children under 14. If we learn that an account belongs to a child under 14, we will promptly delete the account and associated personal information, subject to any legal retention requirement. Suspected accounts may be reported to the contact address in section 15.

9.2 Information Relating to Minor Users

For users known or reasonably believed to be under 18, we limit collection to information necessary to provide the Service. We do not use that information for targeted advertising or disclose it to third parties for their marketing purposes. AI content remains educational and informational and does not constitute financial advice.

9.3 Bank Connection Features

When available, bank connection features require authorization to access the connected account and are restricted to users who have reached the age of majority in their province or territory. The age of majority is 19 in British Columbia, New Brunswick, Newfoundland and Labrador, Nova Scotia, the Northwest Territories, Nunavut, and Yukon, and 18 elsewhere in Canada. Users below the applicable age may use manual financial-management and educational features without a bank connection.

10. International Processing and Transfers

Pilot Wealth and its service providers may process and store personal information outside Canada, including in the United States. The providers identified in section 6 may therefore process information under laws that differ from those in the user's province, territory, or country.

Information processed abroad may be subject to lawful access by courts, law enforcement, or national security authorities in that jurisdiction. Contractual and technical safeguards cannot override applicable foreign law.

Pilot Wealth remains accountable for personal information under its control and is required to use contractual or other means to provide a comparable level of protection when service providers process it on our behalf. Consent and other transfer requirements apply where required by the law governing the processing.

11. Cookies and Browser Storage

We use cookies and similar browser technologies for authentication, session management, security, preferences, and analytics. Authentication cookies are necessary for protected account functions; preference storage retains selected settings, and analytics technologies measure use of the Service.

Browser storage also records first-touch campaign information when available, including UTM parameters, advertising click identifiers from Google, Meta, or Microsoft links, and the external referring page. During registration, available recent attribution information is sent to Pilot Wealth and made available to Google Tag Manager for the registration event described in section 6.3. Pilot Wealth stores registration attribution with the account.

Browser settings can restrict or delete cookies and local storage. Disabling essential authentication storage may prevent sign-in or other account functions. Blocking analytics technologies can limit analytics collection without deleting account records already held by Pilot Wealth.

12. Legal Disclosure

We may disclose personal information where required or permitted by applicable law, including to comply with a valid court order or other legal process, respond to a lawful regulatory request, enforce the Terms of Service, investigate fraud or unlawful activity, or protect the rights and safety of Pilot Wealth, users, or others.

We notify affected users of legal requests unless notification is prohibited by law or would compromise an investigation.

13. Marketing and Service Communications

With consent, we may send product announcements, educational material, and promotional offers. Users may withdraw marketing consent through the unsubscribe link in a marketing email or the communication preferences available in Settings.

Security alerts, billing notices, and other communications necessary to administer an account are service communications and may continue while the account exists.

14. Changes to This Privacy Policy

We may revise this policy to reflect changes in the Service, processing practices, or applicable law. The revised policy will identify its latest update date.

For material changes, we publish the revised policy and provide an in-application notice. Significant changes also receive email notification. Where a new purpose or disclosure requires consent, we obtain that consent before undertaking the processing; continued use of the Service does not replace consent required by law.

15. Privacy Contact