Privacy Policy

What we collect

Anonymous identifiers. An Operative ID (a random code name like Maple Eagle) is generated on first launch. A device fingerprint (a UUID our app makes up) stays on your device and is used to recognize you between launches without ever requiring an email.

Purchase records. If you upgrade to Full Citizen, we record that your device fingerprint has an active entitlement. We do not see your credit card number, your name, or your billing address.

Engagement signals (only with your consent). Page views, which section you used, your device type (web, iOS, or Android), aggregate region (country or province, derived from your connection), your language, and the day and time of use. Aggregated for product improvement and tied only to your random Operative ID and device fingerprint, never your name. We ask before turning this on, and you can opt out anytime — see Analytics and your choices below. We do not store your raw IP address for analytics.

Location data (only if you allow it). When you add a safehouse to the map, we store the coordinates of that safehouse. We do not track your live location otherwise.

Photo data (only if you upload one). If you photograph a safehouse, the photo is uploaded for moderation.

Push notification token.If you grant push permission, your device's OneSignal token is stored so we can send the daily briefing alert.

What we do not collect

• Your real name
• Your phone number
• Your live GPS location
• Your contacts
• Your photo library
• Advertising tracking identifiers

Analytics and your choices

We use two analytics tools: a first-party page-view beacon we run ourselves, and Vercel's cookieless web analytics. Both measure how the app is used, not who you are.

You decide. A small notice bar explains this on your first visit, and you can change your mind anytime from Privacy choices in the footer. Choices come in three buckets: strictly necessary (always on), analytics, and profiling (engagement and push audience tagging). Turn a bucket off and that collection stops immediately.

We honour the Global Privacy Controlbrowser signal: if your browser sends it, analytics and profiling switch off automatically, no clicking required. If you are browsing from Quebec, we apply Quebec's stricter Law 25 standard.

When you make an analytics choice we keep a short record of it as proof of consent, as the law requires. That record stores your choice, the date, and a one-way salted hash of your IP address — never your raw IP, and never your name.

Newsletter

If you subscribe to The Loonie Briefing, your email address is stored as a durable consent record and processed by our self-hosted Listmonk newsletter server, which relays delivery through Amazon SES (sub-processor). The purpose is newsletter delivery only. To prove you actually asked to subscribe, that record also stores the date, your IP address, and your browser's user-agent. You can unsubscribe at any time via the link in any email or by contacting BeingCanadianSupport@muskoka37.ca. Canadian anti-spam law (CASL) requires us to keep this consent proof for three years, so it is the one record that survives a deletion request.

Third parties

• Supabase (database hosting). Your operative records and entitlements live here. Supabase stores this data in the United States (US East region, Northern Virginia).
• Vercel — hosts the app and routes it to your device, and provides cookieless, aggregate web analytics (page views and performance). Vercel receives your IP address to route the request and work out your approximate region; it is never used for advertising and never sold.
• RevenueCat (purchase management). We send your device fingerprint to RevenueCat so it can look up your App Store / Google Play purchase status and confirm your Full Citizen access. RevenueCat never receives your name or payment details.
• Apple / Google (in-app purchases). They handle the payment.
• OneSignal (push notifications). Only if you grant push permission.
• Anthropic (briefing drafting). We send public news headlines to Claude for satirical rewriting. We do not send any user data.
• Amazon SES (email delivery). Newsletter emails are relayed through Amazon Simple Email Service. Amazon SES receives the recipient email address and the newsletter body for the sole purpose of delivery. Amazon Web Services is US-based and subject to the AWS Data Processing Addendum.

Cookies

We use a small number of functional cookies only. We do not use advertising or cross-site tracking cookies.

• bc-locale — remembers your language (English or French). Expires after one year.
• bc-full-citizen — remembers your subscription status so paid features stay unlocked. Refreshed automatically as long as your subscription is active.
• bc-consent — remembers your analytics and privacy choices so we don't ask again. Expires after one year.
• bc-jurisdiction — a short-lived note of your region (e.g. US, Quebec) so the right privacy rules apply. Expires after one hour.
• being-canadian-workshop-auth — used only by administrators to access internal tools.

Where your data is processed

Your data is stored and processed in the United States. Supabase, our database host, keeps it in its US East region (Northern Virginia); Vercel, RevenueCat, OneSignal, and Amazon SES (our email relay, a sub-processor for newsletter delivery) are also US-based. Your information may therefore be subject to US law. We use these providers only to run the app, never to sell your data. If you are in Quebec, this is the cross-border transfer Law 25 asks us to name.

How long we keep it

We keep your operative record as long as your device fingerprint is active. If you reinstall the app, a new operative is born and the old one is orphaned. Analytics records are aged out after about two years, and newsletter consent proof after three (the CASL minimum).

You can erase everything yourself anytime: use Delete my data at the bottom of this page. It wipes your operative, scores, badges, check-ins, and saved preferences on the spot. Public safehouse pins you added stay on the map but lose their link to you and their photo. The one thing we must keep is your newsletter consent record, for the three years CASL requires. You can also email BeingCanadianSupport@muskoka37.ca with your Operative ID and we will do it for you within 30 days.

Children

Being Canadian is not directed at children under 13. We do not knowingly collect data from them. If you believe a child has used the app, email support and we will purge the record.

Your rights

• Access: email support and we will export your records.
• Delete: use Delete my data at the bottom of this page, or email support with your Operative ID.
• Opt out of analytics: Privacy choices in the footer, or send Global Privacy Control from your browser.
• Opt out of push: Operative → Settings → Push.
• Opt out of location: iOS / Android system settings.

US state privacy rights

We do not sell your personal information. We do not sell, share for cross-context behavioural advertising, or otherwise disclose your personal information to third parties for monetary or other valuable consideration. This applies to all users, including residents of California, Virginia, Colorado, and other US states with applicable privacy laws.

Depending on the US state where you reside, you may have additional rights under applicable law, including:

• California (CCPA/CPRA): right to know what personal information we collect, right to delete, right to correct inaccurate personal information, right to opt out of sale or sharing (not applicable here — we do not sell), and right to non-discrimination for exercising your rights.
• Virginia (VCDPA): right to access, correct, delete, and obtain a copy of your personal data, and to opt out of targeted advertising (not applicable here).
• Colorado (CPA): right to access, correct, delete, and obtain a copy of your personal data, and to opt out of targeted advertising (not applicable here).

To exercise any of these rights, email us at BeingCanadianSupport@muskoka37.ca with your Operative ID and the right you wish to exercise. We will respond within the timeframe required by your applicable state law (45 days for California, Virginia, and Colorado, with one 45-day extension where permitted).

Changes

When we update this policy, we will change the "Last updated" date at the top and notify you in-app if the changes are material.

Contact

BeingCanadianSupport@muskoka37.ca