What we hold, and who can see it.

Version 2026-09-21 · draft

Draft, not yet reviewed by a lawyer. It is accurate — every line below describes what the app actually does today — but it has not been through the privacy and consent review that has to happen before this is open to anyone outside the pilot. The [highlighted bits] are the parts still waiting on a person.

Short version: we hold your first name, your email, what you type into the seven days, and almost nothing else. Your coach never sees what you wrote. We don't track you, we don't advertise to you, and we never ask for a balance, a password or an account number.

1. Who we are

Money Launch Week is a seven-day money challenge for Canadians aged about 16 to 20. It is made by Preet Banerjee and Cheryl Hickey. We are the ones who decide what happens to the information described here.

Questions, corrections, complaints, or "please delete my account" — email hello@moneylaunchweek.com and a person reads it.

Privacy officer: Preet Banerjee, hello@moneylaunchweek.com.

2. What we collect, exactly

Not a category list — the actual fields, every one of them. Read down it: if a thing isn't on this list, we don't hold it.

If you're a coach

Your email address.
Your first name.
That you're the coach, and which household you're in.
Your timezone, as your browser reported it when you signed up.
Your household's join code, the last time it was regenerated, and how many learners it can hold (four).
Your pledge, if you make one: the amount in dollars or your own words, whether you asked us to keep it a surprise, when you made it, when you last changed it, and whether you've marked it done — and when.
The record that you ticked the email consent box and agreed to the terms: which version of those words was on your screen, and when.
The moment you unsubscribed, if you did.
A log of your course email: which message, when it was due, when it went out, whether it went at all, and the id our email provider gave it.

If you're a learner

Your email address.
Your first name.
That you're a learner, and which household you joined.
Your timezone, as your browser reported it when you joined.
The day you chose to start, the time of day you asked to be reminded, when you chose them, and when you finished the week.
What you enter on each day's tool and decision screens. The options you pick from the lists; the amounts you type, unless you tick "keep my amount private" — then we store the literal text Private 🔒 and never the number.
And what you write in your own words. Six days ask for a line of your own, and here is every one of them:
- Day 1 — "One sentence: why does starting now matter to you?"
- Day 2 — "My savings rule, in my own words." This is the one the day won't let you skip.
- Day 3 — "One opening step I still need (or 'none')."
- Day 4 — your credit rule "…or in my own words", if you write one instead of picking from the list.
- Day 5 — "My 90-day reason (one real thing)."
- Day 7 — "For my final debrief with my coach — what I'd like from them."
Day 6 asks you to choose from lists and stores no writing of yours.
Which days you finished, and when.
The days you asked your coach for a huddle, the time you asked, and the time your coach was told. Never any text: there is nowhere in our database to put a message from you, on purpose.
The record that you ticked the email consent box: which version of those words was on your screen, and when.
The moment you unsubscribed, if you did.
The same log of course email.
If a coach has made you a pledge, your copy of it — the amount or the words, whether it's a surprise, and whether it's been marked done.

Either way

The day your account was made, and the last time you signed in or saved a day — that second one is the clock both rules in §6 run on, and the first stands in for it until you have signed in once.
Whether your account has been closed, and when. A coach can close a learner's — §6.
While a sign-in link is live, a one-way scramble of that link's code. The code itself exists in your inbox and nowhere else. The link stops working after fifteen minutes or one use, whichever comes first, and the record of it is cleared about a day after it expires.
A random code that makes your unsubscribe link work without signing in.
A random internal id for every row above, so our database can join them up. They mean nothing outside it.
One cookie in your browser, mlw_session, which says you're signed in. It's signed so it can't be edited, scripts on the page can't read it, and it lasts ninety days. That is the only thing this site puts on your device — no analytics, no tracking pixels, nothing saved in local storage.

Never

Balances.
Passwords. There aren't any — you sign in with a link to your email.
Account numbers, card numbers, or anything you'd type into a bank.
Your IP address. Our server is set up not to write one down, and there is no column anywhere in our database to keep one in.

3. Who can see what

This is the part we care most about, so here it is flatly.

Your coach sees which days you finished, and which days you asked them for a huddle. That's the entire list.
Your coach never sees your answers, your amounts, or your "why." Not with your permission, not if they ask, not ever. There is no screen that shows it and no setting that turns it on — we built it so that there is nothing to switch.
Learners in the same household can't see each other, including how far the other one got.
One thing travels the other way: the pledge your coach makes. If your coach chose to tell you up front, you'll know from the start that one is waiting — but what it is, an amount or their own words, you see only when you finish Day 7. If they kept it a surprise, you find out then.
When you tap "ask for a huddle," the email that goes to your coach carries your first name and the day number. Nothing else of yours can reach it.

Running this service doesn't involve reading what you wrote. There's no report, no dashboard, and no email that contains it. We can reach the database directly, the way anyone who runs a website can — but nothing about the week asks us to, and we don't go looking.

4. Email

Two different kinds, and they behave differently on purpose.

Sign-in links. You ask, we send a link. These keep coming even if you've unsubscribed from everything else — otherwise unsubscribing would lock you out of your own account.

Course email. If you're a learner: one short email a day for the seven days, at the hour you picked. If you fall two days behind, one of those is swapped for a single gentle "come back" note instead — once, not over and over. If you chose "no reminders," none of it is scheduled at all.

If you're a coach: at most three. A nudge if nobody has used your join code after a few days; one midweek note — or, if nobody has started yet, a gentler one instead; and one when the week is finished. Plus a heads-up each time your learner asks you for a huddle.

Unsubscribing is easy and free. Your mail app's own unsubscribe button does it in one press, without opening anything. The link at the bottom of every course email opens a page with a single Unsubscribe button — it asks first, deliberately, because some corporate mail filters open every link in a message before you see it, and we're not having a filter unsubscribe you. Either way: no signing in, effective straight away, and sign-in links keep working afterwards.

We do not track opens or clicks. That is switched off at our email provider for this domain, not just left unused.

Every course email carries our mailing address, because Canada's anti-spam law requires one. It is printed here from the same setting the email footer uses, so the two can never drift apart: Moneygaps Ltd., Office 15, Bramley House 2A, Bramley Road, Long Eaton, Nottinghamshire NG10 3SX, United Kingdom

5. Where your data lives

The database is hosted by Neon, on AWS in us-east-1 — Northern Virginia, in the United States. Neon has no Canadian region, which is the whole reason it is there.
Email is sent by Resend, also in the United States (us-east-1).
The application itself runs on Fly.io in Toronto. Nothing of yours is stored there — it holds your data only for the moment it takes to answer a request.
Both are service providers working to our instructions, under their own terms. The formal data-processing agreements are being put in place before this opens beyond the pilot: [data-processing agreements — Neon and Resend, to be accepted and recorded]
Everything travels encrypted, between you and us and between us and them.
Nobody else loads anything. No analytics company, no advertising network, no font host, no content network, no video platform. Every page here loads only from this site, and the course videos are served from here too — not embedded from a platform that would see you watching.
Mail you send us takes a different road, and you should know it. If you write to hello@moneylaunchweek.com, Cloudflare's email routing relays your message into a Google (Gmail) inbox that we read. So whatever you put in that email is held by Cloudflare in transit and by Google after it lands — which is worth knowing before you put something personal in one. Nothing about your account or your answers travels that way; it's only what you choose to write to us.

Because that is a transfer outside Quebec, Quebec's Law 25 asks us to assess it first. We have written that assessment; it is a draft under review, along with this page.

6. How long we keep it

Until you ask us to delete your account, or until twelve months go by without you signing in or saving a day — whichever comes first.

Some accounts are on a shorter clock: thirty days. An account can only be on it if nobody has ever signed in on it, or it is a learner's and no day was ever saved on it. A coach who has ever signed in is never on the short clock, and neither is a learner who has ever saved a day: a coach's one visit, or a learner's one saved day, and it is the twelve months like everybody else. For an account nobody ever signed in on, the thirty days run from the day it was made; for a learner who signed in and saved nothing, from their last visit.

And the short clock is about a household, not one person. It only applies when every account in the household is on it, nobody in the household has signed in or saved a day for thirty days, and no start date or planned email is still ahead. So a coach who set the household up and never signed in themselves stays as long as their learner is going, one saved day anywhere in the household keeps everyone in it, and nobody is deleted before the week they picked has begun. We would rather not hold your address for a year to find out there was never anything in it — and we are not going to delete a family that is still getting started.

Both sweeps run on their own, and each is a real delete rather than a flag: the account goes, and your answers, your progress, your consent record, your pledge and your email history go with it.

To delete sooner: email hello@moneylaunchweek.com from the address on your account and we delete it within 30 days — your answers, your progress, your consent record, everything attached goes with it. There is no delete button in the app yet, and no way to export your own copy first. We would rather say that plainly than imply a button that isn't there.

A coach can remove a learner from their household. That closes the learner's account — they're signed out and the emails stop — but the rows stay until one of the sweeps above reaches them, so that re-joining with the same code brings their week back rather than starting them over. A learner who never saved a day has no week waiting, so theirs is the thirty-day clock — thirty days from the last time they signed in, and only once the rest of the household has gone quiet too.

7. Your choices

Keep any amount private. Tick the box on the screen and we store the literal text Private 🔒 instead of the number. The number never leaves your browser.
Unsubscribe from course email at any time — see section 4 for how. It doesn't delete anything and it doesn't touch your sign-in links.
Ask what we hold about you, or ask us to correct it. Email hello@moneylaunchweek.com from the address on your account and we'll answer. There's no self-serve page for this yet; a person does it by hand.
Ask us to delete your account. Email hello@moneylaunchweek.com from the address on your account and we delete it within 30 days — your answers, your progress, your consent record, everything attached goes with it.
Complain. Tell us first if you can — but you can take a privacy complaint to the Office of the Privacy Commissioner of Canada, or, in Quebec, to the Commission d'accès à l'information.

The week is written for people aged about 16 to 20, and a learner signs themselves up: their own email address, their own tick of the consent box, with a join code handed to them in person by their coach. We don't ask anyone's date of birth, so we are relying on the coach handing the code to the right person. We don't market this to children.

8. This is education, not advice

The course teaches. Nothing in it is financial, tax, investment or legal advice for your particular situation, and nobody here is acting as your advisor. The numbers in the tools are illustrations — the projection screen says so on the screen: "Illustration only, not a guarantee." Rates, tax brackets and the steps inside banking apps change; the pattern is what the lesson is teaching, not the figure.

9. Changes to this page

Every version is dated at the top. The wording you agreed to when you signed up is recorded against your account by version, so we can always say exactly what was on your screen on the day — not a summary of it, the words themselves. If we ever want to do something with your information that you haven't agreed to, we ask again first.