Legal

Privacy Policy

Effective date: April 21, 2026 · Northern Dread Inc., operating as OffTilt

The short version: Your financial data is stored in Canada, never sold, never shared with third parties for advertising, and you can delete it any time. We use one session cookie, and Fathom Analytics for anonymous, cookieless page-view data. No personal data, no third-party tracking. That's the deal.

1. Who we are

OffTilt is a personal finance application operated by Northern Dread Inc., a Canadian company. Our contact email is Contact us.

2. What data we collect

We collect only what's necessary to run the app:

Account information: your name, email address, and hashed password.
Financial data you enter: accounts, transactions, budgets, goals, net worth entries, and mortgage details — all entered or imported by you.
Bank connection tokens: if you connect a bank via Plaid, we store an encrypted access token. We never store your banking credentials.
Session data: a single HTTP-only session cookie used to keep you logged in. No tracking cookies.
Analytics: We use Fathom Analytics to collect anonymous, aggregated usage data such as page views and session counts. Fathom is a Canadian company. No personal or financial data is included. No cookies are used for analytics.

3. How we use your data

Your data is used exclusively to provide the OffTilt service to you. We do not:

Sell your data to any third party
Share your data with advertisers
Use your financial data for profiling or targeting
Mine your data for any purpose other than running the app

4. Where your data is stored

All OffTilt user data is stored on servers located in Toronto, Canada (DigitalOcean TOR1 region). We do not transfer your data outside of Canada.

Encrypted backups are stored on a private NAS and in Backblaze B2 cold storage. Backups are encrypted at rest using AES-256 server-side encryption (SSE-B2).

5. Bank connections and Plaid

Bank sync is entirely optional. You can use OffTilt fully via manual entry or CSV import without ever connecting a bank account.

If you choose to connect a bank account, we use Plaid to facilitate that connection. When you connect a bank through Plaid:

Your banking credentials go directly to Plaid — OffTilt never sees them.
Plaid returns an encrypted access token that we store to retrieve transaction data on your behalf.
Plaid's own privacy policy applies to the data you share with them during the connection process. You can review it at plaid.com/legal.

We are transparent about this because we believe you deserve to know who handles your data. If Plaid's privacy practices concern you, use CSV import instead.

6. Data retention and deletion

You can delete all your financial data at any time from Settings → Delete All Data. This permanently removes your accounts, transactions, budgets, goals, mortgages, and all associated records.

Nightly backups are retained for 90 days. Encrypted offsite cold-storage backups are kept longer-term and pruned periodically. If you delete your account, your data is removed from active systems immediately, but may persist in encrypted backups until they're rotated out.

To request full account deletion including your user record, contact us at Contact us.

7. Security

We take security seriously because we handle real financial data:

Passwords are hashed using bcrypt — we cannot see your password.
Plaid access tokens are encrypted using AES-256-GCM before storage.
All connections use HTTPS with TLS. The session cookie is HttpOnly, Secure, and SameSite=Strict.
The database is not publicly accessible — it runs on localhost only.

8. Cookies

OffTilt uses exactly one cookie: offtilt_token, a session token used to keep you logged in. It is HttpOnly (not accessible to JavaScript), Secure (HTTPS only), and expires after 7 days.

We do not use tracking cookies, analytics cookies, advertising cookies, or any third-party cookies. We do load a script from Fathom Analytics, which is cookieless and collects no personal data.

9. Applicable law

This policy is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Canadian provincial privacy law. By using OffTilt, you consent to the collection and use of information as described here.

10. Changes to this policy

If we make material changes to this policy, we will notify registered users by email before the changes take effect.

11. Contact

Questions about this policy? Email us at Contact us.