Privacy Policy

Last updated: October 16, 2026

1. Information We Collect

Access to Borrowed Mind is by invitation. We hold:

• Your email address — on the invitation allowlist, used to verify your invitation, keep you signed in and, if you asked for it, send you the weekly letter.
• Server logs — IP address, time and page requested, kept for security (blocking abusive traffic).

We do not collect your name, phone number, physical address, payment information, or any financial account credentials.

2. How We Use Your Data

• To authenticate you and maintain your session.
• To verify your invitation when you sign in.
• To send the weekly letter, if you asked to receive it.

We do not use your data for advertising, profiling, or marketing purposes.

3. Data Storage & Security

Your data is stored on servers located in Canada (a self-hosted server and a Canadian-hosted backup server). We use:

• HTTPS encryption for all data in transit (TLS 1.2+).
• PostgreSQL with parameterized queries to prevent SQL injection.
• Encrypted offsite backups.
• Invite-only access: sign-in is limited to an allowlist of invited email addresses.

4. Third-Party Services

• Yahoo Finance (via yfinance) — we fetch public market data. No personal data is sent to Yahoo.
• Google Fonts — your browser loads typefaces from Google, which receives your IP address as part of that request.
• Zoho Mail (Canadian data centre) — hosts our email; if you write to us, your message is stored there.

We do not share, sell, or transfer your personal data to any other third party.

5. Cookies

We use strictly necessary cookies for authentication and session management. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. We count page views with a self-hosted, cookie-free analytics tool (Umami); that data stays on our servers.

6. Data Retention

Your email address stays on the allowlist while your invitation is active. When access ends, we remove it from the allowlist.

7. Your Rights

Under Canadian privacy law (PIPEDA and, for Québec residents, Law 25), you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Have your email address removed from the allowlist.
• Withdraw consent at any time.

To exercise these rights, write to the contact below.

8. Contact

The person responsible for the protection of personal information is the site owner. For any privacy-related questions or requests, contact info@borrowedmind.io.

9. Changes

We may update this policy from time to time. Changes will be posted on this page with an updated date.