Privacy and optional analytics
Updated 11 November 2026.
Your financial plan
Private planning uses Google-managed cloud storage under the cloud terms accepted through the disclosed Google or email sign-in action. Cloud availability is checked in the workspace. A restored sign-in session alone does not create a new terms acceptance. Without completing sign-in, users may explore temporary samples; there is no new local-only saving option. Existing device files are not uploaded or deleted. Local migration is not part of this release.
Private planning requires accepting the versioned cloud account terms through the disclosed Google or email sign-in/create-account action beside the linked terms and privacy notice. This acceptance is recorded before financial writes. It is not inferred from a restored sign-in session and is not requested again for each new plan. Local migration is not included in this release; existing files remain untouched.
Cloud storage and access
Sign in with Google or email and password. Firebase Authentication handles passwords, verification and reset emails. A verified email is required before private cloud access. Firebase may associate verified Google and password sign-ins using the same email; plan access remains tied to the authenticated account UID. The credential-entry page does not load analytics or TrustedSite.
Cloud plans use Google-managed encryption in transit and at rest. Authorized project operators can access their contents; this is not end-to-end encryption. The same ArthaCanvas account and its verified sign-in method restore access to cloud plans on another device, without a mandatory account recovery code.
Cloud plans may contain financial values, household or client details, notes and contacts. This release does not migrate existing local or legacy-device plans. Those files are not uploaded or deleted. Sample plans are not uploaded merely by signing in.
Security checks
When cloud access is enabled, checking or opening your signed-in cloud account uses Google App Check/reCAPTCHA security verification. Google processes security-verification information for these checks, which may occur before a financial-plan upload. Cloud access does not send plan contents to Gemini. Optional product-help explanations require the disclosed Send question to Gemini action; sign-in does not enable them.
Recovery, retention and deletion
Downloaded encrypted backups use a separate recovery code that you must keep safely. That code is not used for ArthaCanvas account recovery. Ordinary PDF, JSON, XML and CSV exports contain readable financial information.
Cloud Trash is recoverable storage, not permanent erasure. Up to ten prior checkpoints remain available while retained; restoring one preserves the current saved version within that same limit. Trash does not expire automatically. To delete your ArthaCanvas account, open Account → Delete ArthaCanvas account (also linked from Privacy & clients). When this service is enabled, review the irreversible scope, verify recent account access if requested, and explicitly confirm. Account deletion removes live cloud planning data and the Firebase Authentication record used to sign in to ArthaCanvas. It does not delete your Google account, local/downloaded copies or billing/legal records. A queued request is not completed deletion; the receipt reports planning-data cleanup and ArthaCanvas sign-in-record deletion separately. Keep this tab open or download the private deletion receipt before leaving. After signing out, use Account → Open a private deletion receipt to check it. The receipt remains available while cleanup is pending and expires seven days after completion; expiration or closing the browser does not cancel cleanup. Never share this secret receipt. Signing in later may create a new account; it does not undo deletion. The database is configured for daily managed backups retained for seven days and seven-day point-in-time recovery. Deleting live plans does not immediately remove retained backup copies. Controlled recovery must honor completed and pending erasure requests; no recovery or erasure timeline is promised. Minimal erasure-control records, containing account/profile identifiers, creation generations and timestamps rather than plan contents, may be retained longer to prevent erased data from returning during recovery. Keep independent encrypted downloads.
Local imports are processed on the device; accepted records become part of the selected plan and will be uploaded when that plan is saved in cloud mode. The disclosed Google or email sign-in action accepts required cloud terms. Gemini and analytics remain optional and are not enabled by sign-in. These controls are not a certification or a blanket privacy-law compliance guarantee.
Analytics is your choice
Optional Google Analytics is off until you select it. Signing in does not enable analytics. Use Allow usage analytics in Account or the analytics controls on this page to opt in. These optional choices apply to the verified account in this browser and can be withdrawn in Account preferences. They are not transferred to another signed-in account. Public pages also have Analytics preferences. Turning analytics off there revokes earlier analytics grants in this browser, including the workspace; a later explicit account grant can enable it again for that account. Global Privacy Control keeps analytics off, and the workspace also respects Do Not Track. Declining optional services does not prevent private planning after required sign-in.
With permission, we measure visits to named public pages or workspace sections, sign-in attempts and completion, setup progress, plan creation and saving, scenario comparisons, report exports and walkthrough-video milestones. We send only fixed event names and category labels. We do not send financial amounts, balances, account or client IDs, names, email addresses, financial-plan contents, form text, file names, full page URLs, query strings, fragments or referrers.
What Google receives
Google Analytics receives the allowed interaction events and technical information such as browser/device information and pseudonymous cookie identifiers. Google may also generate technical session and engagement events from these visits. Your network IP address is involved in connecting to Google. This is pseudonymous measurement, not anonymous data. Advertising storage, advertising personalization, Google signals, enhanced conversions and automatic enhanced measurement are disabled for this integration.
Analytics cookies are configured for 30 days without extending their expiry on each page view. Your consent choice is stored in this browser until you change it or clear site data. Google processes analytics data under its service policies. See Google’s privacy policy and how Google uses information from partner sites.
TrustedSite website verification
The homepage loads TrustedSite’s official floating badge separately from optional Google Analytics. TrustedSite checks for known malware, phishing and blacklist issues. This is not a full security audit, a guarantee against future threats or a certification of financial advice. The free badge can appear for up to 500 visits per month, then stops displaying until the next month.
To display and verify the badge, your browser contacts TrustedSite’s content service (cdn.ywxi.net), its site-configuration file on Amazon S3 (s3-us-west-2.amazonaws.com) and, when you open the badge, trustedsite.com. These connections expose your IP address and browser/device information to those services. The badge stores a 24-hour visit marker in a cookie and local storage, plus a five-minute cookie that remembers its animation. These help count visits and control the display. Turning Google Analytics off does not turn off the badge.
If you open the verification popup, TrustedSite also loads its own analytics and monitoring services, including Google Analytics, Customer.io, Hotjar and Pingdom. These services may receive technical and interaction data and use additional cookies under TrustedSite’s policies. They are controlled by TrustedSite and are separate from ArthaCanvas’s optional analytics choice.
We load this third-party script only on the homepage, not inside the planner. We do not provide it with financial inputs or enable conversion tracking. Like other scripts running on the same website origin, it could technically access browser storage, including encrypted local vault records and sign-in storage. Keeping it off the planner does not isolate that storage from the homepage. See TrustedSite’s privacy policy and live verification details.
Changing your choice
Turning analytics off blocks further analytics events, clears this integration’s Google Analytics cookies for this site and disables collection by the loaded tag. The tag is no longer loaded on later page visits. Other open tabs apply the changed choice when they receive the browser’s storage update. It does not delete data already received by Google. Clearing site data removes browser choices and may remove legacy device-only files; unsaved edits can also be lost when the page closes. It does not delete successfully saved cloud plans: sign in again with the same ArthaCanvas account with its verified sign-in method to reopen them. Keep an independent encrypted backup and its separate recovery code.
Limits of measurement
Reports cover consenting visitors whose browsers allow analytics. They are not complete visitor counts. A recorded feature action does not reveal the contents of a plan or explain why a visitor left. No certification or legal-compliance guarantee is made by this notice.