Privacy Policy

Last updated: July 2026

Sched3 ("we," "us," "our") is a Canadian capital-gains calculation tool. We take data privacy seriously — especially because the information you share with us is financial in nature. This policy explains what we collect, why, and how we protect it.

1. Information we collect

Account information

When you create an account, we collect your email address and, if you choose, your name. Authentication is handled by Supabase Auth. We do not store passwords directly — authentication tokens are managed by Supabase's infrastructure.

Portfolio and transaction data

When you import CSV files or enter transactions manually, we store that data in your account so we can compute your adjusted cost base, detect superficial losses, and generate tax packages. This data belongs to you and is only used to provide the service.

Billing information

If you subscribe to a paid plan, payment processing is handled entirely by Stripe. We never see or store your full credit card number. Stripe provides us with a customer ID, the last four digits of your card, and your billing email for invoicing purposes.

Free calculators

Our free calculators (ACB, capital gains, superficial loss, etc.) run entirely in your browser. Nothing you type into them is uploaded, logged, or stored on our servers. They require no account and send no data anywhere.

2. How we use your data

Your data is used exclusively to:

• Compute your adjusted cost base and capital gains/losses
• Detect superficial losses across accounts
• Reconcile T5008, T3, and T5 slips against your records
• Generate Schedule 3-ready tax packages
• Process billing and manage your subscription
• Send transactional emails (password resets, billing receipts)

We do not use your data for advertising, profiling, or any purpose unrelated to providing the Sched3 service.

3. What we do not do

• We do not sell, rent, or share your data with ad networks or data brokers.
• We do not serve behavioral advertising or use tracking pixels.
• We do not provide "anonymized" data sets to third parties.
• We do not access your brokerage accounts or have the ability to place trades.

4. Third-party service providers

We use a small number of trusted providers to operate the service:

• Supabase — database hosting and authentication. Data encrypted at rest (AES-256) and in transit (TLS 1.2+).
• Stripe — payment processing. PCI DSS Level 1 certified.
• Vercel — application hosting and edge delivery.

Each provider processes data only as necessary to deliver their service to us and is bound by their own privacy and security commitments.

5. Cookies

Sched3 uses only essential cookies required for authentication and session management (set by Supabase Auth). We do not use marketing cookies, analytics trackers, or third-party advertising cookies. There is nothing to opt out of because there is nothing tracking you beyond your login session.

6. Data security

All data is encrypted in transit using TLS 1.2 or higher. Data at rest is encrypted using AES-256 on Supabase's managed infrastructure. Access to production systems is restricted and requires multi-factor authentication. We do not store raw credential material for any third-party brokerage.

7. Data retention and deletion

We retain your account and transaction data for as long as your account is active. You can delete your account at any time from your settings page, which permanently removes all associated data from our systems within 30 days. Stripe retains billing records independently per their own retention policies and legal obligations.

8. Your rights under Canadian privacy law

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Withdraw consent and request deletion of your data
• File a complaint with the Office of the Privacy Commissioner of Canada

To exercise any of these rights, contact us at hello@sched3.ca.

9. Children

Sched3 is not directed at individuals under 18. We do not knowingly collect personal information from children. If you believe a minor has created an account, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you via email or a prominent notice within the application. The "last updated" date at the top of this page reflects the most recent revision.

11. Contact

For privacy-related questions or requests:

Email: hello@sched3.ca

Or reach us via our contact page.