Personal information governance policy
Version 1.0 · July 31, 2026 · privacy policy · Storage and limits · terms of use
A legal requirement. Section 3.2 of Quebec's Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) — the section brought in by the reform commonly called Law 25 — requires every business to establish and publish on its website a policy governing how it handles personal information. This is that policy, in plain language.
1. What we collect, and why
We apply the principle of minimization: we collect only what is strictly necessary, and nothing else.
| Information | Why | Where it is kept |
|---|---|---|
| Email address | Create the account, send the activation code, allow a password reset | Cloudflare KV |
| Chosen username | Identify the account | Cloudflare KV |
| Password hash (PBKDF2) | Authenticate you — the password itself is never kept | Cloudflare KV |
| Session token, device identifier | Keep the session open, and detect a token copied onto another device | Cloudflare KV, expires after 30 days |
| Membership state (plan, status) | Give access to the paid features | Cloudflare KV + Stripe |
| Case content (text) | Sync between devices, only if you switch it on | Cloudflare KV, 1 MB or less |
| Exhibits (photos, audio) | Backup, only if you switch it on | Cloudflare R2, end-to-end encrypted |
What we do not collect: no location data, no advertising trackers, no profiling, no resale, no sharing for commercial purposes. We use no third-party analytics service.
Payments: handled by Stripe. We never see and never keep a card number.
2. Exhibits are a special case: we cannot read them
The photos and recordings in a legal case are sensitive information. So we chose an architecture in which we are technically unable to reach them:
- the file is encrypted in your browser (AES-GCM 256) before anything is sent;
- the key is derived from a passphrase only you know (PBKDF2-SHA256, 310,000 iterations, with a salt unique to your account);
- the key is never transmitted, never stored, never logged;
- our servers hold nothing but encrypted bytes and their size — no file name, no file type, no capture date.
The trade-off we accept: if you forget your passphrase, your exhibits are permanently unrecoverable. We cannot restore them. That point is displayed prominently and has to be accepted explicitly before the feature is switched on. A back door for us would be a back door for an attacker: there is none.
3. Consent
- Consent is free, informed, and given for specific purposes.
- For sensitive information (the exhibits), it is express: three separate checkboxes, none pre-ticked, each carrying a precise statement, and the activation button stays inert until all three are ticked.
- Consent is time-stamped and kept; the passphrase never is.
- It is withdrawn in one click, which triggers the erasure of everything that was backed up.
4. Retention and destruction
| Data | How long |
|---|---|
| Account and email | As long as the account exists |
| Session | 30 days of inactivity, then automatic expiry |
| Activation code | 30 minutes |
| Synced content | Until you delete it, or 12 months after the account is closed |
| Encrypted exhibits | Until you delete them, or 12 months after the membership ends, with prior notice |
| Technical logs | No case content ever appears in them |
Deletion on request is immediate and free — including “erase everything”. That right does not depend on holding a membership.
5. Roles and responsibilities
- The Person in charge of the protection of personal information sees to the application of this policy, handles requests for access, correction and withdrawal, and keeps the register of incidents. Their contact details are published at the bottom of this page.
- Every new feature that touches personal information goes through a privacy impact assessment before it goes live — the encrypted vault did.
6. Privacy incidents
In the event of an incident, we:
- take immediate steps to reduce its effects and to keep it from happening again;
- assess the risk of serious injury — the term the statute uses — weighing sensitivity, the likelihood of malicious use, and the consequences that can be anticipated;
- if that risk exists, promptly notify the Commission d'accès à l'information — Quebec's privacy regulator — and the people affected;
- record the incident in the register, kept for at least 5 years.
Worth remembering: because the exhibits are end-to-end encrypted, an intrusion into storage would yield nothing but unreadable blocks — which lowers the risk of injury considerably, without removing our duty to assess it and to record it.
7. Your rights
Anyone may, free of charge:
- access the information we hold about them;
- have it corrected;
- withdraw consent to sync or to backup;
- ask for their data to be deleted;
- receive their information in a structured, commonly used technological format (portability) — the app already exports the complete case file;
- file a complaint with the Commission d'accès à l'information du Québec, the provincial privacy regulator.
We answer within 30 days.
8. Hosting and storage outside Québec
The infrastructure is provided by Cloudflare (compute, KV and R2 storage), and billing by Stripe. A privacy impact assessment was carried out before launch; it takes into account the end-to-end encryption of the exhibits, which means the most sensitive information is not readable by the host.
9. Updates
This policy is reviewed at least once a year, and whenever the service changes in a significant way. Any substantial change is announced in the app.
Version 1.0 · July 31, 2026
Person in charge of the protection of personal information : vieprivee@preuveenmain.ca · answer within 30 days. Recourse: the Commission d'accès à l'information du Québec, the provincial privacy regulator (its name is used in English as well).