Privacy Policy

To run an audit and keep your account working, we collect only what is necessary:

• Account identity. Your name and email address, provided when you register or sign in, so your wallet and saved statements are associated with your account.
• Password-account security records. If you create a password account, Dracit stores a one-way password hash, not your plaintext password. For email verification and password reset, Dracit's account-action database stores a one-way hash of the one-time token, its purpose, an email snapshot, and creation, expiry, and use timestamps. The delivered link necessarily exists in the local email-delivery path and may remain in your mailbox. Expiry prevents later use of the token; it does not by itself delete the database record.
• Cards you add. A supported card's name when you add it to your wallet. Not its number.
• Statement data you upload. Dracit receives the complete CSV or PDF while parsing it. It stores the supplied filename, statement metadata, and parsed transaction descriptions, amounts, dates, categories, and transaction types. The current flow does not intentionally persist the original CSV or PDF file after parsing.

• Online banking credentials. Dracit has no bank connection and no field that asks for them.
• Card-number entry, CVV, or expiry fields. The math only needs a card name and categorized amounts. A file you choose to upload may still contain identifiers placed there by you or your issuer.
• Account balances or the ability to move money. There is no account linking and no payment rail.

We use this information to authenticate you, maintain your wallet, store and review uploaded statement transactions, calculate rewards, provide support, and secure the service. We do not use statement data for advertising or sell it.

Google sign-in is used for identity only. It confirms you are you when you return. It does not grant Dracit access to Gmail, Google Drive, contacts, or any financial account.

Google sign-in is optional. Dracit also supports a password account with email verification, and linking Google to an existing password account requires a recent password check in the signed-in browser.

You can remove an uploaded statement in Statements. This deletes its statement record and associated transactions from the active database. Self-service account deletion is not currently available. You can request account deletion by emailing the Dracit Privacy Lead at support@dracit.ca. We will verify the request before acting. Backup and log retention is separate from self-service statement deletion; no owner-approved retention schedule is currently configured, and limited information may remain where reasonably necessary to protect the service, resolve a request, or comply with law. Dracit will not retain personal information merely because the law would permit it.

We do not sell your personal information. Dracit is self-hosted on Dracit-controlled hardware; no cloud hosting provider receives statement data. Google OAuth receives the information needed for sign-in but does not receive statement data. Information may also be disclosed where required by law.

Depending on where you live and how your information is handled, Canadian privacy laws may include British Columbia's Personal Information Protection Act, the federal Personal Information Protection and Electronic Documents Act, or another applicable provincial law. These laws may give you rights to ask for access to or correction of personal information and to withdraw consent, subject to lawful exceptions. You may also ask us to delete your account; we will explain any information we must retain and why.

We use essential authentication and session cookies. The current application does not use advertising or product-analytics cookies.

If we make material changes, we will update the date at the top of this page and, where appropriate, notify you in the app.

The designated privacy-responsible role is the Dracit Privacy Lead. Email the monitored support@dracit.ca mailbox for access, correction, consent-withdrawal, account-deletion, or privacy questions. Do not include a password, bank credential, card number, or full statement in email. We may need to verify your identity before acting.