Privacy Policy

DRAFT — not reviewed by legal counsel and not legal advice. To be reviewed against Quebec's Act respecting the protection of personal information in the private sector (Law 25) and PIPEDA before launch.

1. Who is responsible

[Operator legal name] is responsible for personal information collected through this website. Our person in charge of the protection of personal information is [name / title], reachable at [privacy contact email].

2. What we collect and why

• Account details: username, email address and password (stored only as a one-way Argon2id hash). Used to create and secure your account and to contact you about it.
• Consent records: which version of our agreements you accepted, when, and a keyed hash of your IP address. Used to prove consent and meet legal obligations.
• Age affirmation: confirmation that you meet the minimum age, and when. Used to apply our eligibility rules.
• Security records: sign-in events, keyed hashes of IP addresses and your browser identifier (user agent). Used to protect accounts and detect abuse.
• Content you publish: contributions, comments and any profile information you choose to share. Used to operate the community; published content is public.

We do not store raw IP addresses. We do not sell personal information or use it for advertising.

3. Cookies

We use one essential cookie to keep you signed in. It is HttpOnly and cannot be read by scripts. We do not use advertising or tracking cookies.

4. Service providers

We use providers to host the website and database and to send email: [hosting provider], [email provider], and, if enabled, Cloudflare Turnstile for bot protection. Some may store information outside Quebec. [Counsel: privacy impact assessment required by Law 25 before communicating personal information outside Quebec.]

We do not send unpublished writing to third-party AI or moderation services. If that changes, we will update this policy first.

5. Retention

• Account information: while your account exists, then deleted or anonymised as described in the Terms of Service.
• Security records: [e.g. 12 months].
• Consent records: for as long as needed to demonstrate consent, including after account deletion where the law permits.

6. Your rights

You may request access to, correction of, or deletion of your personal information, withdraw consent, and request a copy of information you provided in a structured format. Contact [privacy contact email]. You may also complain to the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

7. Minors

The website is not intended for people under the minimum age stated at registration.

8. Changes

We will post changes here and, for significant changes, notify members.