Privacy Policy

1. Scope and Accountability

This policy applies to the Squadz mobile app (iOS and Android), the Squadz web app at squadz.ca, and the supporting APIs and backend services operated by Squadz Inc.

Squadz Inc., located in Montreal, Quebec, Canada, is the organization responsible for personal information under its control. In accordance with PIPEDA Principle 1 (Accountability), Squadz has designated a person responsible for privacy compliance, complaint handling, and access requests. You can reach this person at privacy@squadz.ca.

Squadz remains accountable for personal information that is transferred to service providers for processing on our behalf.

2. Personal Information We Collect

Account and identity: first and last name, username, email address, date of birth, profile photo, and language preference.

Authentication credentials: Firebase Authentication identifiers. You may also sign in using your Google Account or Apple ID, in which case we receive limited profile information from those providers.

Location: exact GPS coordinates (latitude and longitude) when you enable location features for event discovery. We also store a preferred discovery location and search radius that you configure. You can disable location access at any time from your device settings.

Event and community data: events you create or attend, participation status, RSVP records, reviews and ratings you submit (up to 500 characters), badges earned, and your popularity score.

Communications: chat messages (text, photos, and voice recordings) exchanged inside event chats, support ticket content and attachments, and complaint descriptions you file against other users or events.

Payment and billing: your subscription plan (Free or HOSTER+), Stripe customer identifier and connected account identifier, billing history, and payout records. Full payment card details are processed and stored exclusively by Stripe and are never stored on Squadz servers.

Device and technical data: device identifier, platform (iOS / Android / Web), app version, push notification token, online status, last-seen timestamp, and app diagnostics.

Usage and analytics: interaction logs, search queries and filters, page views, click events, and aggregated city-level discovery signals collected via PostHog. Analytics data is linked to your account or device but is used in aggregated form for product improvement.

Trust and safety signals: host risk score, fraud indicators, dispute counts, and complaint history used to maintain platform integrity.

Camera and microphone: if you grant permission, the app accesses your camera to take or upload profile and event photos, and your microphone to record voice messages in chats. Media is processed and stored on our servers.

Operating system permissions: features that require camera, microphone, location, contacts, or push notifications use the standard iOS and Android permission prompts. You may grant, deny, or revoke any of these permissions at any time through your device settings without losing access to other parts of the app.

In accordance with PIPEDA Principle 4 (Limiting Collection), we collect only the personal information that is necessary to operate the features described in this policy and do so by fair and lawful means.

3. How We Use Personal Information

To operate Squadz: create and manage your account, power event discovery, process ticket purchases and subscription billing, facilitate payouts to event hosts, and deliver in-app and push notifications.

To personalize your experience: generate event recommendations based on your location, preferences, and participation history, and suggest friends based on shared event activity.

To communicate with you: send transaction confirmations, event reminders, cancellation notices, and support responses. Marketing and promotional messages are sent only with your consent and always include an unsubscribe option.

To ensure safety and trust: detect fraud, calculate host trust scores, manage disputes, enforce platform policies, and respond to complaints.

To improve the platform: conduct analytics, monitor performance, fix bugs, and test new features.

To comply with the law: fulfill legal, regulatory, tax, accounting, and audit obligations.

4. Consent and Legal Grounds

We collect, use, and disclose personal information only for purposes that are reasonable given the nature of the Squadz platform and that a reasonable person would consider appropriate in the circumstances.

Following the OPC Guidelines for Obtaining Meaningful Consent (2018), we seek consent in a way that highlights the key elements: what personal information is collected, who it is shared with, the purposes of collection, and any meaningful risks of harm. The form of consent varies with the sensitivity of the information.

We rely on express consent (an affirmative action by you, such as enabling a permission or opting in) for sensitive processing — including precise location, payment information, content of private messages, and any processing of children's data.

We rely on implied consent for non-sensitive processing where the purpose would be obvious to a reasonable person in context — for example, using your account email to send transactional notices about an event you booked.

You may withdraw consent for optional processing (such as marketing emails or product analytics) at any time through your notification or account settings, or by contacting privacy@squadz.ca. Withdrawing consent for core service data (such as payment processing) may limit your ability to use paid features.

Where consent is not the legal basis (for example, fraud prevention, legal obligations, or completion of a transaction you requested), we rely on the corresponding ground permitted under PIPEDA, Quebec Law 25, or other applicable law.

5. Accuracy of Your Information

In accordance with PIPEDA Principle 6 (Accuracy), we strive to keep personal information as accurate, complete, and up-to-date as is necessary for the purposes for which it is used.

You can review and update your profile information, email address, language preference, and notification settings at any time from within the app. If you cannot update a piece of information directly, contact privacy@squadz.ca and we will correct it where appropriate.

6. Sharing and Disclosure

We share personal information with the following categories of service providers who process data on our behalf under contractual obligations:

Firebase (Google LLC, USA) — user authentication, push notification delivery, and crash reporting.

Stripe, Inc. (USA) — payment processing, subscription billing, host payout processing, and connected account identity verification (KYC).

PostHog, Inc. — product analytics and usage event tracking.

Mapbox, Inc. (USA) — map rendering and location-based event discovery.

Email delivery service — transactional emails (confirmations, reminders, support) and marketing communications.

MongoDB Atlas / cloud infrastructure — encrypted database hosting and file storage.

We do not sell your personal information to third parties.

We may disclose information to law enforcement, courts, or regulators when required by a valid legal obligation, to protect the rights, safety, or security of users or the public, or to enforce our policies.

If Squadz is involved in a merger, acquisition, or asset sale, relevant information may be transferred as part of that transaction under applicable legal safeguards, and you will be notified of any change in control that affects your data.

7. Interprovincial and International Transfers

Because we use US-based service providers (including Google/Firebase, Stripe, Mapbox, and PostHog), your personal information is transferred to and processed in the United States.

We use contractual protections and data processing agreements with these providers designed to maintain a level of protection consistent with Canadian privacy law.

Consistent with the OPC position on cross-border transfers and the Supreme Court of Canada decision in R. v. Spencer (2014 SCC 43), we inform you that information transferred to the United States may be accessible to US courts, law enforcement, or regulators under US law.

8. Retention, Deletion, and Anonymization

We retain your personal information for as long as your account is active, and for as long as necessary to fulfill the purposes described in this policy, comply with legal obligations (tax, accounting, anti-fraud), and resolve disputes.

When you delete your account, we initiate deletion of your personal information within a reasonable timeframe. Some data may be retained in anonymized form for aggregate analytics or as required by law.

Certain records — such as payment history, fraud flags, and dispute outcomes — may be retained for up to seven years for financial compliance and legal purposes.

9. Security Safeguards

We apply administrative, technical, and physical safeguards proportional to the sensitivity of the data, including encrypted data transmission (HTTPS/TLS), hashed passwords, role-based access controls, and server-side monitoring.

Payment card data is never stored on our servers; it is tokenized and held by Stripe under PCI-DSS standards.

No system is perfectly secure. If you believe your account has been compromised, contact support@squadz.ca immediately.

10. Your Privacy Rights

Depending on applicable law, you may have the right to: access the personal information we hold about you; request correction of inaccurate information; request deletion of information where legally permitted; withdraw consent for optional processing; and receive a portable copy of certain data.

Quebec residents have additional rights under the Act respecting the protection of personal information in the private sector (Law 25), including the right to portability of information collected by automated means, the right to de-indexation of certain content, and the right to know when automated decisions are made about you.

To exercise any of these rights, email privacy@squadz.ca. We may verify your identity before completing sensitive requests. We will respond within 30 days.

If you have unresolved concerns, you may contact the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca, or the Commission d'accès à l'information du Québec (CAI) at cai.gouv.qc.ca, as applicable.

11. Children and Youth Privacy

Squadz is intended for users who are at least 14 years old. The platform is not designed for, marketed to, or intended for use by children under 14, and we do not knowingly collect personal information from anyone under 14.

The minimum age of 14 is consistent with Quebec's Law 25, which recognizes 14 as the age at which a minor can provide their own consent for the processing of personal information. Users between 14 and the age of majority in their jurisdiction may use Squadz, but should review this policy with a parent or guardian.

If we learn that we have collected personal information from a user under 14, we will delete the account and associated data promptly. Parents or guardians who believe their child has created a Squadz account can contact us at privacy@squadz.ca.

12. Marketing Communications and Anti-Spam

Commercial electronic messages (promotional emails, marketing push notifications) are sent only with your express or implied consent, in compliance with Canada's Anti-Spam Legislation (CASL).

Every marketing message includes a clear unsubscribe mechanism. You can also manage notification preferences (including marketing) directly in the app under Settings > Notifications.

Transactional messages — such as event confirmations, booking reminders, and payment receipts — are not marketing messages and may be sent regardless of your marketing preferences.

13. Confidentiality Incidents and Breach Response

We maintain an incident response process covering detection, containment, risk assessment, remediation, and documentation, as required by PIPEDA Sections 10.1 to 10.3 and Quebec Law 25.

Where a breach of security safeguards involving personal information creates a real risk of significant harm (RROSH) — assessed by reference to the sensitivity of the information and the probability of misuse — we will report the breach to the Office of the Privacy Commissioner of Canada and, in Quebec, to the Commission d'accès à l'information du Québec, and we will notify affected individuals as soon as feasible.

We retain a record of every breach of security safeguards involving personal information for at least 24 months, in accordance with PIPEDA Section 10.3.

14. Changes to This Policy

We may update this policy to reflect changes in our services, technology, or applicable law. When we make material changes, we will post the updated policy and revise the Last Updated date at the top.

We will provide advance notice of material changes through the app or by email where required by law. Continued use of Squadz after an update takes effect constitutes acceptance of the revised policy.

15. Contact Us

For privacy questions, access requests, or complaints: privacy@squadz.ca

For general support: support@squadz.ca

Mailing address: Squadz Inc., Montreal, Quebec, Canada