TotsPal Privacy Policy

1. Definitions

• “Personal Information” means any information about an identifiable individual, as defined under PIPEDA and applicable law.
• “Child Data” means information about a child enrolled or waitlisted through the Service (name, date of birth, gender, special needs, allergies, medical information).
• “User” means any individual who creates an account on the Service, including Parents, Childcare Providers, and Job Seekers.

2. Information We Collect

2.1 Information You Provide Directly

2.2 Information Collected Automatically

• Device Location: With your explicit permission, we access your device's precise location (GPS) to enable provider search, map display, and the “On The Way” estimated-arrival feature.
• Device Information: Device type, operating system version, app version, and unique device identifiers for push-notification delivery.
• Usage Analytics: Screen views, feature interactions, session duration, and crash reports, collected through Firebase Analytics. TotsPal also collects its own usage records tied to your account — which areas of the app you visit (as page names only, never the content you enter) and when you last used TotsPal — used solely to operate, support, and improve the service; these records expire automatically after about 90 days and are never shared with other users or used for advertising.
• Advertising Measurement (website only): When we run ads for TotsPal, the Google Ads tag on totspal.com records that a visit or a sign-up followed an ad click, so we can tell which ads bring families to TotsPal. It sets a cookie holding a click identifier and reports the page address, the time, and general device and browser details to Google. It does not receive your name, email, phone number, address, or anything about your children, and we do not use it to build advertising audiences or to show you TotsPal ads elsewhere on the web. This applies to the website only — the iOS and Android apps contain no advertising code. See Sections 5.2.2 and 12.
• Push-Notification Token: A Firebase Cloud Messaging (FCM) device token used solely for delivering in-app notifications.

2.3 Information from Third Parties

• Google Sign-In: If you choose to sign in with Google, we receive your Google account email address, display name, and profile photo URL. We do not access your Google contacts, calendar, or other Google data.

2.4 Camera and Photo Library

3. How We Use Your Information

We use Personal Information for the following purposes:

1. Account Creation & Authentication: To create, secure, and manage your account.
2. Service Delivery: To connect Parents with Childcare Providers and Job Seekers; to facilitate waitlist management, enrollment, attendance tracking, classroom management, and employee management.
3. Location-Based Search: To display nearby Providers on a map and calculate proximity for search results.
4. “On The Way” Feature: To share real-time estimated arrival time between Parents and Providers. Location data is cleared when the session ends.
5. Messaging: To facilitate direct, private communication between Users, including group chats, broadcast announcements, and staff-room conversations created by Providers.
6. Subscription & Billing: To manage TotsPal Pro subscriptions for Providers, process payments through our payment processor (Stripe), and enforce plan limits.
7. Notifications: To send push and in-app notifications about messages, attendance events, waitlist updates, job applications, authorization requests, and system alerts.
8. Attendance & Reporting: To generate attendance reports for Providers and Parents.
9. Employee Management: To manage employee invitations, timesheets, and employment records.
10. Safety & Security: To detect and prevent fraud, abuse, and unauthorized access.
11. Service Improvement: To analyze aggregate, de-identified usage data to improve app performance and features.
12. Legal Compliance: To comply with applicable laws, regulations, and legal processes.

4. Legal Basis for Processing (PIPEDA & Applicable Law)

• Consent: You provide express consent when you create an account, submit profile information, grant device permissions, and use features that share data with other Users.
• Contractual Necessity: Processing is necessary to deliver the Service you requested.
• Legitimate Interest: We may process data for fraud prevention, security, and service improvement.
• Legal Obligation: We retain certain records as required by Canadian childcare regulations and tax law.

5. Information Sharing and Disclosure

5.1 With Other Users

• Provider profiles are visible to Parents and Job Seekers (subject to provider privacy controls).
• Job Seeker profiles are visible to Parents and Providers posting jobs.
• Parent and child information is shared only with Providers who have an active enrollment or waitlist entry.
• Messages are visible only to conversation participants. Group chats, broadcasts, and staff rooms are visible to all members of that conversation.
• Spotlight posts are visible to other Users in the community feed.

5.2 Third-Party Service Providers

5.2.1 Bot Protection (Google reCAPTCHA Enterprise)

Our web application uses Google reCAPTCHA Enterprise to protect authentication flows (sign-up, sign-in, and password reset) from automated abuse such as fake account creation and credential-stuffing attacks. When you visit pages that include reCAPTCHA, Google may collect hardware and software information — including device and application data, browser type, language, and the results of integrity checks — and send it to Google for fraud analysis. reCAPTCHA does not collect the contents of any forms you submit. Use of reCAPTCHA is subject to Google's Privacy Policy and Terms of Service.

5.2.2 Advertising Measurement (Google Ads)

We advertise TotsPal so that families and childcare providers can find us. Our website includes the Google Ads tag, which tells us whether a visit or a sign-up followed one of our ads. It reads a click identifier from the link you arrived on, stores it in a cookie in your browser, and reports to Google the page address, the time, and general device and browser details.

What it never receives: your name, email address, phone number, home address, account contents, messages, or any information about your children. We report conversions as counts — Google is not told who you are.

What we do not do: we do not build remarketing or advertising audiences, we do not show TotsPal ads to you elsewhere on the web based on your activity here, and we do not let any advertiser target you using data from TotsPal. The tag is on the website only; the iOS and Android apps contain no advertising or tracking code of any kind.

You can stop this measurement at any time by blocking third-party cookies or using an ad or tracking blocker in your browser, and you can manage how Google uses data for ads at Google My Ad Center. Google's handling of this data is governed by Google's Privacy Policy. Blocking it has no effect on your TotsPal account or on any feature of the Service.

5.3 Legal & Safety Disclosures

We may disclose Personal Information if required by law or to protect the rights, property, or safety of TotsPal, our Users, or the public.

6. Data Storage and Security

• All data is stored on Google Cloud / Firebase infrastructure in the United States and Canada.
• All data in transit is encrypted using TLS/SSL.
• Data at rest is encrypted using Google-managed encryption keys.
• Passwords are hashed by Firebase Authentication; we never store plaintext passwords.
• Firestore Security Rules restrict data access to authorized Users.
• Uploaded images are compressed, limited to 10 MB, and stored with path-based security rules.

7. Your Rights and Choices

7.1 Rights Under PIPEDA (Canada)

• Access: Request a copy of the Personal Information we hold about you.
• Correction: Request correction of inaccurate or incomplete Personal Information.
• Withdrawal of Consent: Withdraw consent at any time (subject to legal restrictions).
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada.

7.2 Rights Under U.S. State Privacy Laws (CCPA/CPRA)

• Know: Request disclosure of categories and specific pieces of Personal Information collected.
• Delete: Request deletion of your Personal Information, subject to legal exceptions.
• Opt-Out of Sale or Sharing: We do not sell Personal Information, and we do not share it for cross-context behavioural advertising. Our website measures ad conversions (Section 5.2.2); you can switch that off in your browser by blocking third-party cookies or using a tracking blocker, or email us and we will confirm your preference in writing.
• Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• Data Portability: Request your data in a portable, machine-readable format.

7.3 How to Exercise Your Rights

• In-App Data Export: Export your data from Settings > Account > Delete Account > Export Data (JSON format).
• Account Deletion: Initiate from Settings > Account > Delete Account. Includes a 30-day grace period.
• Device Permissions: Revoke camera, location, and notification permissions through device Settings.
• Email Requests: Contact support@totspal.com. Response within 30 days (PIPEDA) or 45 days (CCPA/CPRA).

7.4 Provider Privacy Controls

• Address Visibility: Choose full, partial, or hidden address display.
• Phone Display: Choose whether your phone number is visible publicly.
• Email Display: Choose whether your email is visible publicly.

8. Data Retention

9. Children's Privacy

• Child Data is collected only as provided by a parent or legal guardian for childcare enrollment and attendance.
• Child Data is shared only with the specific Provider(s) with whom the child is enrolled or waitlisted.
• We do not use Child Data for advertising, analytics profiling, or any purpose other than facilitating childcare services.
• Parents may access, correct, or delete their children's information at any time.
• If we learn that information has been collected from a child under 13 without parental consent, we will delete it promptly.

10. Location Data

• Permission Required: Precise location is requested only for provider search, map features, or “On The Way” ETA. You can deny or revoke this at any time.
• How It's Used: Coordinates calculate distance to Providers and estimate travel time.
• “On The Way”: Location updates every 10 seconds during an active session and is automatically cleared when the session ends.
• No Background Tracking: We do not track your location in the background.

11. Push Notifications

• We use Firebase Cloud Messaging to deliver notifications about messages, attendance events, waitlist updates, job applications, authorization requests, and system announcements.
• You can disable push notifications at any time through device or app settings.
• FCM device tokens are used solely for notification delivery, not for advertising or tracking.
• We also send email notifications (e.g., welcome emails and activity updates). Every such email includes a one-click unsubscribe link, and you can turn email notifications off in your profile settings at any time.

12. Cookies and Tracking (Web Application)

• Essential Cookies: Firebase Authentication session cookies required for login.
• Firebase Analytics: De-identified usage data. You can opt out via browser “Do Not Track” settings.
• Advertising Measurement Cookie (Google Ads): When you arrive from one of our ads, a cookie stores the click identifier so we can tell that the visit, and any sign-up that follows, came from that ad. It expires on its own and carries no personal details. Details in Section 5.2.2.

We do not use retargeting or remarketing technologies, we do not build advertising audiences from your activity, and we do not allow third parties to place their own advertising trackers on TotsPal. The measurement cookie above is the only advertising-related cookie we set, it exists on the website only, and blocking it costs you nothing — every feature of TotsPal works exactly the same without it.

13. International Data Transfers

TotsPal Solutions Inc. is operated from Saskatoon, Saskatchewan, Canada. Our infrastructure is hosted on Google Cloud / Firebase servers in the United States and Canada. By using the Service, you consent to the transfer and processing of your data in these jurisdictions.

14. Do Not Track Signals

TotsPal does not currently respond to “Do Not Track” browser signals as there is no industry standard for compliance. We do not engage in targeted advertising, retargeting, or profiling of you across other websites. The one exception to “no tracking at all” is the conversion measurement described in Section 5.2.2, which records that a visit followed one of our ads; blocking third-party cookies or using a tracking blocker stops it.

15. Account Deletion and Data Portability

1. Data Export: Export all your data in JSON format from the app's Settings screen before deletion.
2. Initiate Deletion: Go to Settings > Account > Delete Account. Re-authentication is required.
3. Grace Period: A 30-day grace period begins. Log in during this time to cancel deletion.
4. Permanent Deletion: After 30 days, all personal data is permanently deleted. Storage files are removed. Messages are anonymized. Attendance and employment records are anonymized and archived for regulatory compliance (up to 6 years).
5. Data Transfer: Providers can request transfer of records to a successor provider before deletion, subject to parent consent.

16. Security Incident Response

In the event of a data breach that poses a real risk of significant harm to Users:

• We will notify affected Users as soon as feasible.
• We will report the breach to the Office of the Privacy Commissioner of Canada as required by PIPEDA when there is a real risk of significant harm.
• We will notify applicable U.S. state authorities as required by applicable state breach notification laws.
• We will take immediate steps to contain and remediate the breach.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will update the “Last Updated” date, notify you via in-app notification or email for significant changes, and your continued use constitutes acceptance of the updated policy.

18. Contact Us