Privacy Policy

This Privacy Policy explains how Canada's Finest ("Canada's Finest," "we," "us") collects, uses, shares, and protects personal information in connection with our Community Management System ("CMS"), our Discord server, and our roleplay community operations (together, the "Services").

Canada's Finest is based in Quebec, Canada. This policy is written to meet Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Act respecting the protection of personal information in the private sector("Law 25"), which applies in addition to PIPEDA and is, in places, stricter.

If you disagree with any practice described here, please don't use the Services. Questions can be sent to privacy@canadas-finest.ca or through a ticket in our Discord server.

Summary

• We collect what you give us directly (account details, application answers, roster and community records) and a small amount automatically (basic technical/log data).
• We do not sell personal information, and we do not use it for advertising.
• We do not knowingly collect sensitive personal information (e.g. health, biometric, or financial data).
• Discord account information is only received if you choose to sign in with or link Discord.
• Access to community records inside the CMS is restricted by role, permission, and department.
• You can request access to, correction of, or deletion of your personal information at any time.

1. What Information We Collect

Information you give us

When you create an account, apply to join or transfer within the community, or use the CMS, we may collect:

• Your name and/or display name
• Email address and password (if you sign up with email)
• Discord account information, if you sign in with or link Discord — your Discord user ID, username, display name, avatar, and email address if Discord provides it
• Application answers — the responses you submit on a membership, transfer, reserve, or division application, which may include your stated age or date of birth, prior experience, and free-text answers
• Community and membership records — department, rank, callsign/unit number, section, training and certification records, patrol/attendance logs, and administrative or disciplinary notes created by staff as part of running the community
• Leave of Absence requests — the reason and dates you submit when requesting time off from a department's patrol-hour requirement, and staff's decision on it
• Event RSVPs — whether you've indicated you're going, maybe going, or not going to a community event
• In-app notifications — status updates about your own applications, LOA requests, and similar, shown to you inside the CMS
• Communications — messages you send us (e.g. a support request or a data request)

We do not knowingly collect sensitive personal information (health information, biometric or genetic data, government identification numbers, or similar) and ask that you not include it in free-text answers or notes.

Information collected automatically

Like most web services, our hosting and infrastructure providers automatically log basic technical information when you use the Services — IP address, browser/device type, pages visited, and timestamps. This is used for security, troubleshooting, and keeping the CMS running, not for tracking you across other sites.

2. How We Use Your Information

• Account creation and authentication — creating and securing your account, whether you sign in with email or Discord.
• Applications — receiving, reviewing, and deciding on membership, transfer, reserve, and division applications, and notifying you as your application moves through review.
• Community administration — maintaining rosters, ranks, departments, permissions, training records, certifications, patrol logs, Leave of Absence requests, event scheduling and RSVPs, and related records needed to run the community.
• Safety and rule enforcement — investigating reports, maintaining disciplinary and administrative records, and enforcing our rules and this policy.
• Communication — sending account, application-status, LOA-decision, and service-related notifications by email, in-app notification, and/or Discord message, to the address or account you've linked.
• Accountability — keeping an internal record of who made a given permission, application, roster, or disciplinary decision, so those actions can be traced back if ever questioned.
• Security — detecting and preventing unauthorized access, abuse, or attempts to circumvent restrictions.
• Legal compliance — meeting our legal obligations, including responding to a valid legal request.

3. Our Legal Basis for Processing (Canadian Residents)

We process personal information based on your express or implied consent, or where necessary to provide the Services you've asked for (e.g. reviewing an application you submitted). You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice — see Section 8.

If you're located outside Canada (for example in the EU, UK, or elsewhere), we also rely on these same grounds and, where applicable, our legitimate interest in operating a safe, well-run community — for example maintaining accountability, preventing abuse, and resolving disputes.

4. When and With Whom We Share Information

We don't sell your personal information. We share it only:

• With service providers who run the Services on our behalf — currently Supabase (database, authentication, and file storage), Discord (account linking, sign-in, and the automated messages described in Section 5), Vercel (hosting), and Resend (application and account notification emails). Each only receives what it needs to do its job.
• With other members, where the CMS is designed to show it — e.g. your roster entry, rank, and activity status are visible to staff with the relevant department access; disciplinary and other restricted records are visible only to authorized staff. Some events (like a new member being onboarded) automatically post a summary to a designated Discord channel, which may be visible to a wider group than the CMS itself, depending on who has access to that channel.
• For legal reasons — if required to comply with a valid legal request, or to protect the rights, safety, or property of Canada's Finest, our members, or others.
• In a business transfer — if the community's operations or assets were ever transferred (e.g. to new ownership), your information may transfer as part of that.

5. Discord Account Linking

If you sign in with or link Discord, we receive limited Discord account information (your Discord user ID, username, display name, avatar, and email address if Discord shares it) to authenticate you, connect your roster and permission records to your account, and support Discord-based features like our /onboard command. We don't control how Discord itself handles your information — see Discord's own privacy policy for that.

Certain events we describe elsewhere in this policy — being onboarded to a department, for example — can automatically trigger a message posted to a staff-configured Discord channel and/or a direct message to you from our bot, in addition to (or instead of) an email. These are configured by Command Staff and may include your name, department, rank, and similar roster details.

6. Cookies and Similar Technologies

We use cookies and similar technologies only for authentication (keeping you signed in), security, and basic site functionality — not for advertising or cross-site tracking. Most browsers let you block or remove cookies; doing so may prevent parts of the Services from working correctly.

7. International Data Transfers

Our service providers (Supabase, Discord, Vercel, and our email provider) may store or process information in the United States or other countries outside Quebec and Canada. Under Quebec Law 25, before using a service provider outside Quebec we consider whether personal information will receive protection equivalent to what Quebec law provides, and we choose providers with established security and privacy practices for this reason. You can ask us for more detail on this assessment by contacting us — see Section 13.

8. How Long We Keep Information

We keep personal information only as long as reasonably necessary for the purposes described in this policy, or as required by law:

• Account and roster records — while your account or membership is active, and afterward only as reasonably necessary for administrative, security, or recordkeeping purposes.
• Applications — for as long as reasonably necessary to process the application and maintain a record of the decision.
• Leave of Absence requests and event RSVPs — for as long as reasonably necessary to administer the request or event, and afterward as part of your ordinary community record.
• In-app notifications — kept until you've read them and a reasonable time afterward, then periodically cleared.
• Disciplinary, security, and audit records — may be kept longer where reasonably necessary for community safety, dispute resolution, or legal compliance.

When information is no longer needed, we delete or anonymize it, or, where that isn't immediately possible (e.g. backups), we secure it and restrict further use until deletion is possible.

9. How We Protect Your Information

We use reasonable technical and organizational safeguards to protect personal information — including access restricted by role and permission, and industry-standard hosting and database providers. No system is 100% secure, and we can't guarantee against all unauthorized access, but we take reasonable steps to reduce that risk and will notify affected individuals as described in Section 11 if a breach creates a real risk of harm.

10. Your Privacy Rights

Subject to applicable law, you have the right to:

• Request access to the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information, subject to legitimate reasons we may need to retain some (e.g. active disciplinary records, legal obligations)
• Withdraw consent to our processing of your information, where consent is the basis for it

To exercise any of these rights, contact us at privacy@canadas-finest.ca or via a Discord ticket. We'll respond within a reasonable time and in any case within the timeframe required by law.

11. Additional Rights for Quebec Residents (Law 25)

Privacy Officer

The person responsible for privacy compliance at Canada's Finest is our Privacy Officer, reachable at privacy@canadas-finest.ca.

Confidentiality incidents (breaches)

If a confidentiality incident involving your personal information creates a real risk of serious harm, we will notify the Commission d'accès à l'information du Québec (CAI) and notify you, as required by Law 25, and we keep an internal register of such incidents.

Automated decision-making

We don't make decisions about your membership, application, or account based solely on automated processing without human review.

Complaints

If you're unhappy with how we've handled a privacy request, you can contact us directly, or file a complaint with the CAI at cai.gouv.qc.ca.

12. Other Regions

If you're located in the EU, UK, or another jurisdiction with its own data protection law, you may have additional rights (for example, data portability or the right to object to certain processing). Contact us and we'll do our best to accommodate rights that apply to you under your local law.

13. Minimum Age

The Services are not directed at children. You must be at least 13 years old to create an account at all, matching Discord's own minimum age requirement for any Discord-linked feature. Actual membership in the community — being accepted onto a department roster — additionally requires you to be at least 17 years old; an account between 13 and 16 can exist (for example, while an application is pending) but won't be onboarded to a roster until that age is met. If we learn we've collected personal information from someone below the applicable minimum age without appropriate consent, we will delete it.

14. Community Records Are Not Real-World Records

Ranks, titles, department assignments, training records, and similar information maintained in the CMS relate to your participation in a roleplay community and are not intended to represent your real-world identity, employment, qualifications, or professional status.

15. Do Not Track

Our Services do not currently respond to browser "Do Not Track" signals, as there isn't yet a common industry standard for how to honour them.

16. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by an updated "Last updated" date at the top of this page, and we may also post a notice or notify you directly for significant changes.

17. Contact Us

Questions, requests, or complaints about this policy or your personal information can be sent to privacy@canadas-finest.ca or through a ticket in our Discord server. For anything not privacy-related, see our general contact address in the Terms of Service.