Privacy Policy

Privacy Policy

Last updated September 23, 2026

Nimblewit (https://nimblewit.app) is a personal investment-portfolio tracker based in Ontario, Canada (“Nimblewit”, “we”, “us”). This policy explains what information we collect, why, where it is kept, who it is shared with, and the choices you have. We handle personal information in line with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

The short version

  • We collect only what is needed to run your account and your ledger.
  • We do not sell your information, show you ads, or use your data to train AI models.
  • Your portfolio data is stored in Canada and is visible only to your own account.
  • You can ask for a copy of your data, or for it to be deleted, at any time.

Information we collect

  • Account information. Your email address, and a password if you choose to set one (stored only as a secure hash — we never see it).
  • Information from Google, if you choose “Continue with Google”. Google shares your name, email address and profile picture with us. We request only these basic profile details (the openid, email and profile permissions). We do not request, and cannot access, your Gmail, contacts, Drive, calendar or any other Google data.
  • Portfolio information you enter or upload. Account names and types, transactions, holdings, cash balances, notes, settings and any statement files you import.
  • Technical information. Standard server logs (such as IP address, browser type and the time of a request) kept by our hosting provider for security and troubleshooting, and analytics data from Google Analytics (pages visited and actions such as creating an account or finishing an import, never your holdings, balances, transactions or account names), and the cookies described below.

How we use it

  • To sign you in and keep your account secure.
  • To store your portfolio and calculate the figures, charts and observations you see.
  • To fetch market prices for the securities you hold.
  • To send account emails you ask for, such as sign-in links, confirmations and password resets.
  • To diagnose problems and protect the service from abuse.

We do not use your information for advertising or profiling, and we do not sell or rent it to anyone.

Google user data

When you sign in with Google, the name, email address and profile picture Google provides are used only to create and identify your Nimblewit account and to show who is signed in. This information is not shared with third parties, is not used for advertising, and is not transferred or sold. Nimblewit’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Nimblewit’s access at any time from your Google Account’s security settings.

Where your information is stored, and who processes it

We use a small number of service providers to run Nimblewit. Each receives only what it needs:

  • Supabase — our database and sign-in provider. Your account and portfolio data are stored in its Canada (Central) region.
  • Vercel — hosts the website and runs the application. Requests may be processed on servers outside Canada, including in the United States.
  • Google — only if you choose to sign in with Google.
  • EODHD, Marketstack and Twelve Data — our market-price providers. They receive ticker symbols only (for example “XIC”), never your name, email, balances or holdings.
  • Anthropic — only when you import a PDF statement, a screenshot or photo, or a spreadsheet whose layout Nimblewit doesn’t recognize. The file is sent to Anthropic’s Claude API to read out the transactions, which you then review before anything is saved. Anthropic does not use this data to train its models. CSV and Excel files in a recognized layout are read entirely in your browser. If a PDF or screenshot cannot be read (the read fails or finds no transactions), we keep a copy of that file in private storage, visible only to Nimblewit administrators, so we can fix the problem. We do not keep files that are read successfully.
  • An email delivery service — to send account emails to your address.

Where information is processed outside Canada it may be subject to the laws of that country. We choose providers that protect information with safeguards comparable to our own.

How we protect it

All traffic is encrypted in transit (HTTPS). Database rules ensure every account can read and change only its own records. Access to the underlying systems is limited to authorized Nimblewit personnel. No system is perfectly secure, so we will notify you and the Privacy Commissioner of Canada as required if a breach creates a real risk of significant harm.

Cookies and analytics

Essential cookies keep you signed in. Your light/dark theme choice is saved in your browser’s local storage.

We also use Google Analytics to understand which parts of Nimblewit get used, which sets its own cookies in your browser. It records pages visited and actions like creating an account or finishing an import. It never receives your holdings, balances, transactions or account names.

If you are in Quebec, the United Kingdom or the European Economic Area, we ask before any analytics cookie is set. Everywhere else, analytics is on by default and you can turn it off at any time under Usage analytics in Settings. We do not use advertising or cross-site tracking cookies.

How long we keep it

We keep your information while your account is open. If you ask us to delete your account, we delete your account and portfolio data within 30 days, except where the law requires us to keep something longer. Server logs are kept for a short period by our hosting provider and then removed.

Your choices and rights

You can ask to access or correct your information, ask for a copy of your data, withdraw consent, or ask for your account to be deleted by emailing hello@nimblewit.app. We will respond within 30 days. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

Children

Nimblewit is intended for adults and is not directed at anyone under 18.

Changes to this policy

If we change this policy we will update the date at the top of this page, and let you know by email or in the app if the change is significant.

Contact

Questions or requests about privacy: hello@nimblewit.app.