Privacy policy

1. Who we are, and who we are not

Ontario Immigrants Association is a community organization operating in Ontario, Canada.

Three things we want to be unambiguous about, because assuming otherwise could affect decisions you make:

We are not a health care provider. Our Mental Health and Empowerment programmes are general information, community groups and classes for the general public. We employ no clinicians. Nothing in this app is medical, psychological or clinical advice, diagnosis, treatment or counselling, and what is recorded here is not a health record.

We are not connected to any government. We are not a government body, not an agent of one, and not authorised to act for one. Nothing you do in this app affects any immigration, benefits, housing or legal matter, and nothing you tell us is reported to any government authority except where the law compels us (section 12).

We are not a legal, immigration or financial adviser. Information shared in classes and chats is general and educational.

2. Who this app is for

The app is closed. Every screen sits behind sign-in, and accounts are only created for people with an active membership.

All members are adults. We do not knowingly create accounts for anyone under 18, and the app is not directed at children.

3. What the app records

What you give us: your name, as you want it shown; a username; your password, stored only as a one-way cryptographic hash that we can neither read nor recover; your email address, used to send you a code if you forget your password or need to set up your account, and nothing else; your phone number if you give one, only so we can reach you about a class; and your language and appearance preferences.

What the app records as you use it: which classes you are enrolled in and when you joined or left; messages you send in class chats and direct messages, including voice notes and images; files you send to an instructor; whether you were present at a session (section 4); notifications queued for you and their contents; an identifier so notifications reach your phone and not someone else's; reports you make about a message; and a record of significant actions on your account.

From the membership system: when you join or renew, the app is told your membership identifier, the email you used, the plan name, whether it is active and when it ends. No payment details ever reach this app. We never see your card number.

4. Attendance, and why we keep it

When you attend a class, an instructor marks you present.

We keep that record because the association is building a documented account of what it delivers. That record is only worth anything if it is true, so we do not estimate it, we do not fill in gaps, and we do not adjust it to look better.

Attendance is visible to your instructor for that class and to the administrator. It is not visible to other members.

5. One account, one device

A membership is taken out by a person, for that person. To keep an account from being passed around, the app remembers the first phone you sign in on.

What this actually stores: a random identifier the app generates on your phone the first time it runs, the device model, whether it is iPhone or Android, and the dates it was first and last seen. That is all.

It is not a hardware address. It is not your phone number, not a serial number, and not an advertising identifier. It means nothing outside this app and cannot be matched against any other service.

If you change your phone, or it is lost or stolen, tell us and we will release the old one. There is no waiting period and no charge. If you genuinely need two devices, ask and we can allow it.

We will not use this to work out where you are or anything else about you. It answers one question: is this the same phone as last time.

6. Class recordings

Recordings of classes are held in the same Canadian storage as everything else, are available only inside the app, and only to members whose Premium add-on is active at the moment they press play. They are not downloadable, and the app asks the phone's operating system to block screenshots and screen recording while one is playing.

Two things we will not overstate. That block is strong on Android, where the operating system enforces it. On iPhone it relies on a technique Apple has never formally documented and could stop working in a future version of iOS. And neither stops someone pointing a second camera at the screen. No app prevents that.

If you appear in a recording: a class recording may contain other participants' voices, faces and names. We will not publish a recording you appear in without asking you first, and you may ask us to remove one at any time.

7. Who can see what

Access is decided by the database itself, not by what the app chooses to display. A member cannot reach another class's material by crafting a request.

Class chat, materials and announcements: the members enrolled in that class, its instructors, and the administrator. Files you send to an instructor: you, that class's instructors, and the administrator. Never other members. Direct messages: only you and the person you are writing to. The administrator cannot read them. Your name: members of classes you share, and instructors of those classes. Your email, phone and membership dates: only you and the administrator. Attendance: you, your instructor, the administrator. The video list: every member. Watching: only with an active Premium add-on. Your device identifier and model: only you and the administrator.

About direct messages specifically: they are private, which means we cannot moderate them before something goes wrong. If someone sends you something inappropriate, report it or block them — both controls are in every conversation. Reporting a message makes that message visible to the administrator.

Access ends by itself and on time. Chat closes 7 days after a class ends and materials close 30 days after. If your membership lapses, or your Premium add-on lapses, or you are removed from a class, access ends that day.

8. Where your information is held, and where it travels

At rest, your information is in Canada. The database, files and accounts are hosted by Supabase on Amazon Web Services in the Canada (Central) region, which is in Montreal, Quebec. We chose this deliberately.

Some processing necessarily happens outside Canada, and we would rather say so plainly than let you assume otherwise:

Apple and Google deliver notifications to your phone, including the notification's title and text — United States and elsewhere. Expo relays notifications to Apple and Google — United States. Resend sends the emails that carry your sign-up and password codes — United States. The membership system handles your membership and payment, under its own privacy policy. Zoom hosts live classes. Joining a class means using Zoom under Zoom's own terms.

Information held by a service provider in another country may be accessible to that country's courts and law enforcement under that country's law, regardless of where it originated. That is true of any service that uses foreign infrastructure, and it is true here.

We keep what crosses the border as small as we can. Notification text is the main thing that leaves Canada, which is why we keep it short and non-specific. If you would rather not have notification content leave Canada, turn notifications off in your phone's settings. Everything else keeps working.

9. How long we keep things

Class chat messages: deleted about 3 months after the class's materials window closes. Class materials: removed about 3 months after the materials window closes. Direct messages: kept until you or the other person deletes them, or either account is deleted. Notification records: 30 days. Used sign-up and reset codes: 90 days. Class recordings: kept as the association's own teaching record. Attendance and membership records: kept as the association's own record, de-identified if you delete your account. Device records: until the binding is released, or you delete your account. Account record: until you delete it.

These are enforced automatically by the system on a schedule, not by someone remembering.

10. Your rights

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) you may:

See what we hold about you. Ask, and we will provide it. Correct it if it is wrong. Withdraw consent and stop using the app. Some consequences follow — you cannot attend classes without an account. Complain, to us first and to the Office of the Privacy Commissioner of Canada if we do not resolve it, at priv.gc.ca or 1-800-282-1376.

11. Deleting your account

You can delete your account yourself, from inside the app: Account, then Delete my account. You will be asked to type DELETE, because it cannot be undone.

Permanently erased: your direct messages and their attachments, files you sent to instructors, your email address, phone number, the link to your membership, your notification devices, the record of which phone your account was bound to, and the content of everything you wrote in class chats.

Kept, with your identity removed: your attendance record and the history of your membership. Your name, username, email and phone are erased from them. What remains is a record that someone attended, not that you did.

Your sign-in is destroyed. Every session on every device ends immediately and the account can never be signed into again, by you or by us.

We are telling you what survives rather than promising a total erasure we would not deliver. If you want the anonymous records gone as well, ask us and we will consider it against our need to keep an honest account of what we delivered.

One honest limitation: if you saved a class material for offline use, the app deletes its copy when your access ends. If you moved that file somewhere else on your phone, we cannot reach it and cannot delete it. No app can.

12. When we would disclose information

We do not sell your information. We do not share it for advertising. We do not give it to anyone for their own purposes.

We would disclose it only to the service providers in section 8, who process it on our instructions and may not use it for anything else; where Canadian law requires it, such as a court order, a subpoena, or a lawful demand we are obliged to answer; and where we believe in good faith that there is a serious and imminent risk to someone's life or safety.

If we ever receive a lawful demand for your information, we will tell you unless we are legally prohibited from doing so.

13. Security, stated accurately

Your password is stored as a one-way hash. We cannot read it. All connections use encryption in transit. Data is encrypted at rest by our hosting provider. Files are held in private storage. Reaching one requires a link that is generated for you at that moment and expires shortly after. Access rules are enforced by the database, not by the app's screens, so a modified client cannot get past them. Sign-up and reset codes are stored hashed, expire in 30 minutes, work once, and stop working after five wrong guesses.

No system is perfectly secure, and we will not claim otherwise. If a breach occurs that creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner as PIPEDA requires.

14. Changes and contact

If we change this policy in a way that affects you, we will tell you in the app before it takes effect and ask you again. The version and date are at the top of this text.

For any privacy question or complaint, contact the association from the Messages section of this app. We answer privacy questions ourselves; they are not outsourced.