Privacy Policy

Last updated August 2026

[LEGAL ENTITY NAME] operates CleanWhispers. This page says what we collect, why, who else can see it, and how to get it back or get rid of it. It is written to be read.

The short version

We collect your email address and the watchlists you choose to build. We use them to run the tool and for nothing else. There is no analytics, no advertising, no tracking pixels and no third-party cookies anywhere on this site. We do not sell your data, and we never tell an issuer, a filer or anyone else who is following them. Two companies process it on our behalf — Supabase and Cloudflare — and you can have all of it deleted by asking.

What we collect

When you make an account:

• your email address;
• a password, which is hashed by our authentication provider before it is stored. We never see or hold your actual password;
• if you choose Sign in with Google instead, Google tells us your email address and basic profile identity. We do not receive your Google password and we ask Google for nothing else.

What you enter into the tool:

• the filers and issuers you follow, and the names you give your watchlists;
• your alert settings — what you want to be told about, and how often;
• any notes you attach to a filer or a trade.

What you watch says something about what you hold or intend to, so we treat it as sensitive. It is why watchlists are readable only by the account that created them, enforced in the database itself rather than by application code — and why we do not publish aggregate "most followed" figures, which leak the same information one step removed.

Automatically, by being on the internet:

• our host records ordinary web server logs, including IP addresses, for delivery, security and abuse prevention;
• our authentication provider records sign-in events and timestamps, which is how a suspicious login can be spotted at all.

What we do not collect

No name, address or phone number. No social insurance number. No date of birth. No brokerage account numbers, no brokerage credentials and no positions — this tool never connects to your broker and never asks what you own, so there is nothing to steal. No payment card details; if paid subscriptions begin we will use a payment processor and card details will go to them, not to us, and this page will be updated before that happens.

And no analytics of any kind. No Google Analytics, no tag manager, no advertising pixels, no session recording, no fingerprinting, no third-party cookies. This is verifiable — view the page source.

Why we collect it

• Your email: to identify your account, to let you sign in and reset your password, and to send the service messages you cannot opt out of and still have an account — a password reset, a security notice, a change to these terms.
• Your watchlists: to show you the filings you asked to be shown and to send the alerts you asked for. That is the whole purpose.
• Logs: to keep the site up and to deal with abuse.

We do not use your data for anything else. If we ever wanted to — to improve the product in aggregate, say — we would ask you first, separately, and a no would cost you nothing.

We do not send marketing email. If that changes it will be opt-in, and unsubscribing will be one click.

Who else touches it

We keep this list short on purpose. Every one of these is a service provider acting on our instructions.

• Supabase — the database and the authentication system. It holds your email, your hashed password and everything you enter. It also sends the transactional emails (confirm your address, reset your password). Your data is stored in [SUPABASE REGION — e.g. Canada (Central) or US East].
• Cloudflare — serves the site and holds the server logs described above.
• Google — only if you choose to sign in with Google, and only for that. Google will know you signed in to this site. If you would rather they did not, use an email address and password instead.

Where a provider stores or processes data outside Canada, that data can be subject to the laws of that country, including lawful access by its authorities. We use contractual protections with our providers, but we cannot promise a foreign government will never compel access. This is true of every service that uses foreign infrastructure; we would rather say it than leave you to work it out.

We may also disclose information if the law requires it, or to protect our rights or someone's safety. If a court orders it and we are permitted to tell you, we will.

If the business were ever sold or reorganised, your data could transfer as part of it. The buyer would be bound by this policy, and we would tell you before it happened.

Cookies and what is stored in your browser

One thing: when you sign in, your session token is kept in your browser's local storage so you stay signed in between visits. It is strictly necessary for the site to work and it is not used to track you. Signing out removes it, and so does clearing your browser data.

There are no advertising cookies, so there is no cookie banner. That is deliberate.

How long we keep it

Your account data is kept while your account exists, because it is what the tool works on. If you close your account we delete your watchlists, alerts, notes and account records within [RETENTION PERIOD — e.g. 12 months].

Backups roll off on their own schedule, so a copy may survive slightly longer in one — it is not accessible through the product and is overwritten in the ordinary course. Server logs are kept for a short period for security purposes. Where we are required by law to keep something (a record of a payment, say) we keep that and nothing else.

Your rights

Write to [PRIVACY CONTACT EMAIL] and we will act on any of these. There is no charge and you do not need a reason.

• See it. Ask what we hold about you and we will tell you, in a usable format.
• Take it. You can export your watchlists from the app at any time without asking.
• Fix it. Most of it you can edit yourself. Anything you cannot, we will correct.
• Delete it. Ask and we will delete your account and its data, subject to the retention note above.
• Withdraw consent. You can withdraw it at any time. For most of what we hold that means closing the account, because without your email and your watchlists there is no service left to give you.

We will respond within 30 days. If we cannot do what you asked we will say why. If you are not satisfied you can complain to the Office of the Privacy Commissioner of Canada, or to your provincial privacy regulator where one has jurisdiction, and you do not need our permission to do so.

How it is protected

• Everything travels over HTTPS.
• Passwords are hashed by our authentication provider. Nobody here can read yours, which is also why nobody here can recover it — a reset is the only route.
• Access to your rows is enforced by the database, per row, against your authenticated identity. A bug in our application code cannot hand your watchlists to another user, because the application is not what decides.
• Access to production data is limited to those who need it to run the service.

No system is perfectly secure and we will not pretend otherwise. If a breach creates a real risk of significant harm to you, we will notify you and report it to the Office of the Privacy Commissioner of Canada, as the law requires, and we keep records of breaches whether or not they meet that threshold.

Children

This is not for children. Do not use it if you are under the age of majority where you live. We do not knowingly collect information from children, and if we learn we have we will delete it.

Which laws apply

We aim to meet the Personal Information Protection and Electronic Documents Act (PIPEDA) and the provincial privacy legislation that applies to us, including Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25. Where a province gives you a stronger right than this page describes, you have the stronger right.

Changes

If we change this page we will change the date at the top. If a change materially affects how we handle your data we will tell you before it takes effect, by email or in the app, and where the law requires fresh consent we will ask for it rather than assume it.

Contact

[LEGAL ENTITY NAME] — [PRIVACY CONTACT EMAIL]. Privacy questions, access requests and complaints all go to the same address, and it is read by a person.

See also the terms of service and the disclaimer.