Privacy Policy
Last updated: August 2026
1. Introduction
iFin.ca is owned and operated by Galaxy Fortune Inc. In this policy, "we" and "us" refer to Galaxy Fortune Inc. We are the controller of your personal information and are accountable for the handling of information described in this policy.
Operating entity: Galaxy Fortune Inc
Address: 85 Enterprise Blvd #306, Markham, ON L6G 0B5
Privacy contact: David Liu (Director)
Email: [email protected] WeChat: davidliudong
This Privacy Policy explains how we collect, use, store, and protect your personal information, and what rights you have. This website complies with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's Anti-Spam Legislation (CASL), and applicable provincial privacy legislation.
2. Data We Collect
Analytics data: When you visit this website, we automatically collect the following information through analytics tools (including but not limited to Google Analytics and Cloudflare Analytics):
Internet Protocol (IP) address, geographic location, operating system type and version, browser type, the pages you visit, time spent on the site, click behaviour, and referral source. This data helps us understand visitor behaviour and improve the site's content, functionality, and user experience.
We do not actively identify you personally — analytics data is aggregated, anonymized, or pseudonymized.
Account data (only if you choose to register): The calculators on this website can be used in full without registering. Only if you actively choose to create an account — so that what you enter can be saved and reloaded later — do we collect your email address, along with the content you enter into a calculator and actively choose to save. See Section 5 below.
3. Cookies and Tracking Technologies
This website may use cookies and similar tracking technologies. These technologies are used to:
Improve site functionality and user experience; carry out visit analytics; and potentially serve relevant advertising or content.
You can control cookies: Most browsers allow you to refuse cookies or to be warned when a cookie is being set. You can also delete existing cookies through your browser settings. Please note that disabling cookies may affect the normal operation of some site features. For detailed instructions, please consult your browser's help documentation.
4. Third-Party Services
This website may integrate the following third-party services, which may collect, process, or store your data:
Analytics services: Google Analytics, Cloudflare Analytics, and similar, used for website traffic analysis.
Advertising or marketing services: This website may display advertising or use related tracking services.
Market data services: Some pages embed market chart components provided by TradingView, which may collect device or browsing information under its own privacy policy. Interest rate, inflation, and exchange rate data is drawn from the Bank of Canada Valet public data service, which does not collect your personal information.
Email service: Account sign-in links and (where you have consented) newsletter emails are sent via Resend, which processes your email address in order to deliver them.
Infrastructure: Website hosting and the account database are provided by Cloudflare (Pages and D1).
Other third-party scripts or tools: Used for site operation, optimization, or functional support.
Each third-party service has its own privacy policy. We recommend reviewing the privacy terms of the relevant services to understand how they handle data. We are not responsible for the privacy practices of third parties.
5. Accounts and Saved Calculator Data
Registration is entirely optional. All content and calculators on this site can be used in full without registering, with no features removed.
Registration serves two purposes, and you may choose only one of them: opting in to email updates to receive our articles and financial news (entirely optional), and saving the values you enter into a calculator so you can load them again next time instead of re-entering everything.
One account works across the site. If you register on any page, you can use the same account on any other page that offers a save function; data saved by each tool is stored separately and does not interfere with the others. Each page indicates whether a save function is available, and we may adjust that scope as features develop.
What we collect:
(1) Your email address — this is the only identifying information we collect. We do not collect your name, phone number, or address.
(2) Calculator content you actively save — this is uploaded only when you click "Save current data," and it is encrypted in your browser before it is uploaded (see below). This content may include financial information such as income, assets, debts, coverage amounts, and the ages of family members.
Sign-in methods: Email and password sign-in is supported, and a one-time email sign-in link is retained as an alternative. Passwords are stored using a strong hashing algorithm; the server does not store plaintext passwords.
Your email address: we cannot see it without your consent
This is not merely a promise — it is enforced by the system's design:
If you have not checked the box consenting to be contacted, your email address exists in our database only as an irreversible one-way hash (HMAC-SHA256), with no plaintext copy whatsoever. That hash can only be used to locate your account the next time you sign in; it cannot be reversed back into an email address. As a result, the operators of iFin can neither see your email address nor contact you — even if we wanted to, we could not.
Only when you actively check the consent box do we store your email address in plaintext, recording at the same time the timestamp and source of that consent (this is what Canada's Anti-Spam Legislation requires as evidence of "express consent").
Unsubscribing takes effect immediately and is irreversible: You may unsubscribe at any time, in three ways — click the dedicated unsubscribe link at the bottom of any of our emails (no sign-in required, one click); click the native "Unsubscribe" button at the top of the message in Gmail or Outlook; or sign in and uncheck the box on a calculator page. Once you unsubscribe, the plaintext copy of your email address is deleted from the database immediately, and we can never see it again, nor contact you. Your account and any saved data are unaffected and continue to work normally. If you later wish to resubscribe, you will need to enter and confirm your email address again (because we genuinely no longer have it).
With your consent, we may send you content, articles, or market updates related to financial planning. We will not sell, rent, or provide your email address to any third party.
The financial data you save: the database holds only ciphertext
When you click "Save data," the content is first encrypted in your own browser using AES-256-GCM, and only then uploaded. The key that decrypts it is derived in your browser from your sign-in password using PBKDF2, and that derived key stays on your device — it is never uploaded with the data. Our database therefore holds a string of ciphertext, and there is no administrative interface capable of listing or viewing another person's data.
Important points about your password:
(1) Signing in is all that is needed to save and load your data; there is no separate recovery code to write down. When you switch devices or browsers, signing in with the same email address and the same password will load your data back.
(2) Forgetting your password means you can recover your account, but not your data. Click "Forgot password" on the sign-in form and we will send a verification code to your registered email address; once verified, you can set a new password and your account itself continues to work normally. However, previously saved data was encrypted with the old password and cannot be decrypted with the new one — we hold no backup key, so we cannot recover it on your behalf either. After resetting, you can clear that now-unreadable data with one click in the account area and enter and save it again.
(3) For this reason, please choose a password you will remember over the long term, and keep your own separate copy of any important information.
We distinguish honestly between several things — please note the differences:
· Your email address (when you have not consented to contact) — we are unable to see it. The database holds only a one-way hash, which is mathematically irreversible back to an email address. This is not a promise; it is a technical fact.
· The financial data you save — the server holds only ciphertext, and the key was never uploaded. We have no interface for viewing it, and in normal operation we do not hold the key required to decrypt it.
· But we do not claim this is "technically impossible," because that would not be true. First, when you sign in, your password itself must be sent to the server for verification, and at that moment the site operator is in principle capable of deriving your data key from it. Second, the code that performs the encryption is delivered to your browser by our own server, and the site operator is technically capable of altering it. This is not the same as end-to-end encryption of the kind used by Signal, which users can independently verify. Every web application shares this limitation; we choose to state it plainly rather than market ourselves as "end-to-end encrypted."
Accordingly, please do not enter information into the calculators that you would be unwilling for any third party to learn. If this concerns you, you are entirely free not to register — no calculator loses any functionality, and without an account everything you enter stays in your own browser and is never uploaded.
Important: we do not undertake to store your data long term
The account and save features are a free convenience provided by this site — they are not a data hosting, backup, or archival service. Please understand the following before using them:
(1) We reserve the right to change, suspend, or discontinue these features, and to clear saved data, at any time. Reasons may include changes to our technical architecture, operating costs, security incidents, changes of service provider, or regulatory requirements. Where practical, we will try to post advance notice on the website, but we make no guarantee of this.
(2) Please keep your own copies of source material. Content saved on this site is intended only to spare you from re-entering the same figures next time; it should not be your only record. Please export, print, or otherwise save important results to your own device.
(3) We accept no liability for compensation should saved data be lost due to feature changes, data clearing, technical failure, or any other cause. Results produced by these tools are for learning and research reference only and do not constitute financial, tax, insurance, or legal advice.
(4) The above terms do not affect your statutory rights under PIPEDA, and do not relieve us of our legal obligation to notify you and the relevant regulator in the event of a personal information security breach.
Data retention and deletion:
Subject to the above, account data is retained until you delete it. On any page with an account area you can click "Delete account," and your account together with all saved data will be permanently deleted from our database immediately, with no recovery and no backup copy retained. You may also click "Delete saved data" only, and keep the account. In addition, if an account is not signed into for 24 consecutive months, the system will automatically delete that account and its data.
Please note: because we do not hold the encryption key, what we delete is the ciphertext itself. The key temporarily held on your device is cleared when you click "Sign out" or close the browser tab.
6. Data We Do Not Collect
Whether or not you register, this website does not collect, store, or use the following information:
Social Insurance Number (SIN), bank account numbers, credit card numbers, passwords or sign-in credentials for any financial institution, or personal medical records. No field in any calculator asks you for this information; please do not enter it into any input box.
7. Data Storage and Security
Storage location: Analytics data is stored on the servers of third-party analytics platforms (such as Google and Cloudflare). Account data is stored in Cloudflare's database service (D1). These servers may be located outside Canada.
Security measures: The entire site uses HTTPS encrypted transmission; sign-in tokens and session identifiers are stored in the database only as hashes (so that even if the database were read, it could not be used to impersonate a signed-in user); calculator content you save is stored as ciphertext; and sign-in endpoints are rate-limited to prevent abuse.
Please note: Transmission over the internet is not inherently secure. Although we take the reasonable measures described above, absolute security cannot be guaranteed. In the event of a security incident involving your personal information, we will notify you and report to the relevant regulator as required by PIPEDA.
8. Future Updates to This Policy
When we add new features that involve personal information, we will update this Privacy Policy accordingly and, where necessary, seek your express consent.
9. Your Rights and How to Reach Us
Your privacy rights (PIPEDA):
You have the right to know what information we have collected about you; to request access to the personal information we hold about you; to request correction of inaccurate information; to request deletion of your information (registered users can do this themselves with one click on a calculator page, with no waiting); to withdraw consent to contact previously given; and to raise a privacy question or complaint with us.
How to exercise these rights: Please contact us by:
Email: [email protected]
WeChat: davidliudong
We will respond within 30 days of receiving your request.
If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). Residents of Quebec may also contact the Commission d'accès à l'information du Québec (CAI).
10. Minors
This website is intended for adults and is not directed at individuals under 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us using the details above and we will delete it as soon as possible.
11. Effective Date and Changes
This policy takes effect in August 2026 and was most recently updated in August 2026 (adding Section 5, "Accounts and Saved Calculator Data"). We reserve the right to amend this policy at any time. Material changes will be announced on the website or communicated by email. Continued use of this website indicates your acceptance of the updated policy.
This English version is provided for the convenience of English-speaking readers. In the event of any discrepancy, the Chinese version governs.