What this site collects, and what it does not

What this site collects

Three things, and this is the whole list. Reading these pages collects none of them: with scripting off, this site sets no cookies, loads nothing from another origin, and measures nothing at all.

• Your answer to the measurement question. The choice you make in the banner is kept in your own browser, in localStorage under acru.consent, with the wording version you were shown and the time you answered. It is not a cookie and it is not sent anywhere. Clearing your browser storage deletes it, and the question comes back.
• Measurement, if you allowed it. Nothing loads before you answer, and nothing loads if you decline. Allowing it loads Cloudflare Web Analytics, which counts page views without advertising cookies and without building a profile of you. The site behaves the same either way.
• What you type into the waitlist form. Your email address, the page you submitted it from, and — on a calculator — a permalink holding the inputs of the projection you ran. The consent wording you agreed to is recorded with it by version (2026-08-15.1 today), because an address without the text the person was shown is not the record CASL asks for.

No account exists to sign into, so there is nothing here that collects a name, an address, a phone number, or a financial detail — and the calculators do not send what you enter anywhere. A projection is computed in your browser, from numbers that stay in it.

What happens to a waitlist signup

It is used for the two things the consent wording names: telling you when the platform opens, and sending the permalink to a projection you ran. Every message identifies ACRU Technologies Inc. and carries a link to stop them, and you can withdraw consent at any time — by using that link, or by writing to privacy@acru.ca.

One mechanical detail worth stating plainly, because it changes who handles the message. Until the signup endpoint is reachable, the form does not post: it hands the message to your own mail client, addressed to waitlist@acru.ca, and you send it. It therefore travels through your mail provider like any other email you send, and it reaches us as mail. When the endpoint is live the form posts instead, and this paragraph goes with it.

Who else sees any of it

Nobody buys it, and nothing about you is passed to a bank, a broker, an advisor, or any other third party. Two service providers necessarily handle data on our behalf in the course of running the site: Cloudflare, which serves these pages and routes mail for the domain, and — only if you allowed measurement — Cloudflare Web Analytics. That is the entire set.

When the platform opens

The platform records financial transactions, which is materially more sensitive than an email address, so the rules it is engineered to are worth stating before it opens rather than after. They are the ones its engineering guidelines already bind the build to:

• Internal use first. What you record is there to run your own ledger and your own notifications. It does not flow outward as a side effect of being collected.
• No hand-off without a direct, affirmative act. Identifiable information reaches a partner bank or broker only after you have clicked through a disclosure that says what is being sent and to whom — and the consent, its timestamp, and the version of the disclosure text you agreed to are recorded when you do.
• Anything reported in aggregate is aggregated first. Removing a name while leaving a unique identifier or a unique combination of figures is not anonymisation. Cohorts below a minimum size are not reported at all, so a single household cannot be isolated out of a total.
• Consent is recorded by version, and a broader purpose is a new consent. Every consent is stored with the version of the wording you were shown, so what you agreed to can be identified afterwards rather than inferred. Using what you contributed for a broader purpose than the one you agreed to — publishing an aggregate rather than only reporting it internally, for instance — means asking you again, affirmatively. It is never done by editing this page, and never by treating an existing consent as covering the new purpose.
• Withdrawing consent excludes you from what comes next, not from what is published. Withdraw and your household is left out of every aggregate produced after that point. Figures already published stay published: a statistic that has been released cannot be recalled, and a consent that did not say so plainly would not be a meaningful one.
• Minimisation, deletion, and encryption. Only the attributes the ledger needs are collected. Deleting your account or withdrawing consent purges or irreversibly anonymises the personal financial data behind it. Data is encrypted in transit and at rest, and internal access to raw files is restricted to need-to-know.

Your rights, and how to use them

Under PIPEDA you may ask what personal information we hold about you, ask for it to be corrected, and withdraw a consent you have given. Write to privacy@acru.ca and say which of the three you want. An access request is answered with what is held; today, for almost everyone reading this, that is an address on a waitlist and nothing else. If you are not satisfied with how a request was handled, the Office of the Privacy Commissioner of Canada takes complaints about organisations subject to PIPEDA.

How this policy changes

It carries the date it last changed, at the top. A change that broadens what is collected or what it is used for is not applied to information already collected under the old wording — the earlier purpose stands until you agree to a new one.