Privacy Policy

This Privacy Policy explains how Road to A Million ("Road to A Million," "we," "us," or "our") collects, uses, discloses, and protects personal information when you use roadtoamillion.app, the installable web application, and related services (collectively, the "Service"). We are responsible for deciding how personal information is processed through the Service.

This policy does not cover third-party websites or services that we link to. Their own privacy policies apply when you use them. If you do not agree with this policy, please do not use the Service.

The information we collect depends on the features you use. We collect information directly from you, automatically from your browser or device, and from an identity provider when you choose social sign-in.

• Create and secure your account, authenticate you, and maintain sessions
• Provide projections, insights, check-in history, account tracking, milestones, reminders, and other requested features
• Send essential account and security messages and, according to your settings, check-in reminders, progress insights, and milestone alerts
• Process unsubscribes, bounces, and complaints so we respect your choices
• Respond to feedback, bug reports, feature requests, and support needs
• Diagnose failures, maintain security, prevent abuse, and improve the Service
• Create aggregate or de-identified statistics for internal planning
• Enforce our terms, protect rights and safety, and comply with law

We do not use your financial planning information to make decisions that produce legal or similarly significant effects. We do not sell personal information, share it for cross-context behavioral advertising, or disclose it to third parties for their own direct marketing.

Where applicable law requires a legal basis, we process information as necessary to perform our contract with you and provide the Service; with your consent, including for optional communications; to pursue legitimate interests such as securing, troubleshooting, and improving the Service where those interests are not overridden by your rights; and to comply with legal obligations or protect vital interests. You may withdraw consent at any time, without affecting processing that occurred before withdrawal.

We disclose only the information reasonably necessary for the following purposes:

• Supabase: database hosting, authentication, storage, scheduled jobs, and related backend infrastructure
• Lovable: application hosting, social-login orchestration, email delivery, error reporting, and operational logs
• Google: authentication when you choose Google sign-in
• Authorized administrators: a limited number of administrators may access account, planning, activity, feedback, and email-delivery records to operate, support, and secure the Service
• Legal and safety recipients: regulators, courts, law enforcement, professional advisers, or others when reasonably necessary to comply with law, enforce agreements, or protect rights and safety
• Business transactions: a buyer, investor, successor, or adviser in connection with a proposed or completed financing, reorganization, merger, or sale, subject to appropriate safeguards

These providers may use their own subprocessors to deliver their services. We do not make your account or financial planning data public, and the Service has no user-to-user social feed.

The Service uses essential browser storage and similar technologies, including local storage, session storage, a functional sidebar cookie, and a service-worker cache. These technologies keep you authenticated, remember preferences, preserve an onboarding draft within your browser, avoid repeating dismissed prompts, and make certain same-origin pages and assets available when a network request fails.

We do not currently use advertising cookies or third-party behavioral analytics. You can clear browser storage or block cookies in your browser, but doing so may sign you out or impair parts of the Service. Because we do not track you across unaffiliated services, Do Not Track and Global Privacy Control signals do not change the Service's current behavior.

Road to A Million uses formulas and rules to calculate projections, milestones, comparisons, and personalized planning insights from the information you enter. These outputs are informational and do not make legal, credit, employment, insurance, or other similarly significant decisions about you. The Service does not currently send your planning data to a third-party generative-AI provider.

We use reasonable technical and organizational safeguards appropriate to the sensitivity of the information, including encrypted connections, managed authentication, database access controls, Row-Level Security policies that restrict ordinary users to their own records, and limited administrative access. Passwords are handled by our authentication provider and are not stored by us in plaintext.

No internet transmission or storage system is completely secure. You are responsible for protecting your credentials and using the Service from a secure device and network.

We and our service providers may process information in Canada, the United States, and other countries where they or their subprocessors operate. Those countries may have privacy laws different from those where you live. Where required, we rely on recognized transfer mechanisms and contractual or other safeguards for international transfers.

We generally retain account and planning information while your account is active and then for only as long as reasonably necessary to complete deletion, meet legal obligations, resolve disputes, prevent abuse, and enforce agreements. Retention may vary by record type. For example, short-lived onboarding drafts remain in your browser session; operational and diagnostic logs are kept according to provider schedules; and a minimal suppression record may be retained after account deletion so we can continue to honor an unsubscribe, bounce, or complaint. Information in backups may persist until the applicable backup is overwritten.

Depending on where you live and subject to applicable exceptions, you may have the right to:

• Know whether we process your personal information and access a copy
• Correct inaccurate or incomplete personal information
• Request deletion of personal information
• Receive certain information in a portable format
• Restrict or object to certain processing
• Withdraw consent where processing is based on consent
• Appeal a refusal where local law provides an appeal right
• Not be discriminated against for exercising a privacy right

You can update profile and communication preferences in Settings and unsubscribe from optional emails using the link in the email. Account export and deletion are not yet self-service. To request access, portability, deletion, restriction, or another privacy right, email adrien@arkbytesolutions.com. We may need to verify your identity and authority before completing a request. We will respond as required by applicable law, and we may deny or limit a request where the law permits.

You may also complain to the privacy or data-protection regulator where you live. In Canada, this may include the Office of the Privacy Commissioner of Canada or the applicable provincial regulator.

We do not knowingly collect or solicit personal information from, or market the Service to, anyone under 18 years of age. The Service is not offered to anyone under 18, even with the permission or supervision of a parent or legal guardian. By using the Service, you represent that you are at least 18 years old.

If we learn that we have collected personal information from someone below the applicable minimum age, we will deactivate the account and take reasonable steps to promptly delete the information from our active records. If you become aware of data we may have collected from a person under 18, please contact us at adrien@arkbytesolutions.com.

In the preceding 12 months, the categories described in Section 2 may correspond to identifiers; personal and financial records; age and date-of-birth information; internet or network activity; inferences; and sensitive information such as account credentials and financial planning data. We collect these categories from you, your device and browser, and your chosen identity provider. We use and disclose them for the business purposes described in Sections 3 and 5.

We have not sold personal information, shared personal information for cross-context behavioral advertising, or disclosed personal information to third parties for their own direct-marketing purposes. We do not use sensitive personal information to infer characteristics about you. If an applicable US state law grants you additional rights, you may exercise them using the process in Section 11, including through an authorized agent where the law permits.

We may update this policy as the Service or law changes. We will post the revised policy here and update the date above. If a change is material, we may also provide a prominent notice in the Service or send an email when required or appropriate.

For privacy questions, requests, or complaints, contact the Privacy Contact for Road to A Million at adrien@arkbytesolutions.com. Please include enough detail for us to understand your request, but do not send passwords or other unnecessary sensitive information by email.

Mailing address:
Road to A Million
Bar Haven Street
St. John's, NL A1B 5G6
Canada