Privacy Policy

WhereIsMyBuddy ("we," "us," or "our") operates the social accountability platform available at whereismybuddy.app (the "Platform"). We are a Canadian startup with founders based in Vancouver, British Columbia and Toronto, Ontario.

For privacy inquiries, contact us at [email protected].

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use the Platform. It applies to all users of the Platform, regardless of location, and is intended to comply with:

• The Personal Information Protection and Electronic Documents Act (PIPEDA), Canadian federal privacy law
• Quebec’s Act Respecting the Protection of Personal Information in the Private Sector (Law 25), for users in Quebec
• The General Data Protection Regulation (GDPR), for users in the European Union and United Kingdom
• Canada’s Anti-Spam Legislation (CASL), for commercial electronic messages sent from Canada
• Other applicable provincial and international privacy laws

We collect information in three ways: information you give us, information generated by your use of the Platform, and technical information collected automatically.

3.1 Information you give us

(a) Account information. When you create an account, we collect:

• Your name and username
• Your email address
• Your password, if you sign up with email (we store only a secure hash of it, never the password itself)
• Your profile photo, if you upload one (otherwise a coloured initial avatar is generated)
• Your optional bio
• Your confirmation that you are 18 or older, and when you accepted our Terms

(b) Settings and preferences. Through Settings you may provide:

• Your birthday or age range
• Your time zone and country
• Your interests (selected from tags we provide)
• Your notification preferences, quiet hours, and reminder time
• Your preferred distance unit, and whether your activities show on your profile
• Your push notification preferences, per device

(c) Content you create. When you use the Platform, you may create:

• Check-in notes, photos, and details such as minutes, pages, or distance, visible to all members of the activity in which they are posted
• Discussion messages and cheers, visible to all members of the activity
• Support notes, private between you and the member you send one to
• Activity descriptions, cover images, and pinned prompts, including any images attached to a prompt
• Reflect journal entries, private text visible only to you, never shared with other users or read by us except to display them back to you
• Weekly Reflect summaries, built from your check-in data and visible only to you
• Feedback and reports, if you send us feedback or report a message

(d) Photos and images. Profile photos, activity cover images, check-in photos, and images attached to pinned prompts are stored with our file storage provider (Supabase Storage). Your profile photo is visible to other users; a check-in photo is visible to the members of its activity.

3.2 Information generated by your use of the Platform

When you use the Platform, we record:

• Your check-in history (dates and times, streaks, and activity participation)
• Your warning state in Committed activities
• Your likes and reactions on other members’ check-ins and messages
• The activities you have joined or created
• Your weekly buddy pairings and shared sessions
• People you have blocked and messages you have reported
• How you use the Platform, for internal product analytics only (see Section 5)

3.3 Technical information collected automatically

When you use the Platform, our servers and service providers automatically collect:

• Your IP address. We shorten it before storing it with your sign-in sessions, promotional link visits, and contact messages; full addresses may appear briefly in server logs.
• Your browser, device type, and operating system
• Pages visited and time spent on the Platform
• Referring addresses and campaign tags, when you arrive from a link we shared
• Push notification tokens, if you turn on push notifications

4.1 To operate and provide the Platform

• Creating and managing your account
• Showing your profile and content to other users in accordance with your settings
• Enabling check-ins, discussions, and activity participation
• Sending you the notifications and reminders you have chosen
• Processing your account deletion request

4.2 To write short summaries with AI

We use OpenAI’s API to write short summaries: your weekly Reflect observation (WMB+), a group’s weekly story and monthly episode, the welcome note for someone who has just joined an activity, and your 30-day and year reflections (WMB+). These are written only from check-in statistics (counts, days, and totals such as pages or minutes) and activity names and categories. Before anything is sent, every person’s name is replaced with a stand-in, which we swap back when the summary returns, so OpenAI is never told who anyone is. Your Reflect journal entries, check-in notes, discussion messages, support notes, and activity descriptions are never sent to OpenAI or any other AI service. See Section 6.6.

4.3 To communicate with you

• Sending emails the service needs, such as verification codes, sign-in links, security alerts, receipts, and account notices
• Sending your weekly Reflect email and other optional emails, which you can switch off at any time (see Section 14)
• Responding to your support requests or feedback

4.4 To improve the Platform

• Analysing usage through our internal analytics system (no third-party analytics tools are used)
• Identifying and fixing bugs and errors
• Developing new features and improving existing ones

4.5 To keep the Platform safe and lawful

• Enforcing our Terms and Conditions
• Detecting and preventing fraud, abuse, or misuse of the Platform
• Complying with legal obligations

4.6 Legal basis for processing (GDPR users)

If you are located in the European Union or United Kingdom, our legal basis for processing your personal data is:

• Contract: processing necessary to provide the service you have signed up for
• Legitimate interests: processing necessary to operate, improve, and protect the Platform, where those interests are not overridden by your rights
• Consent: where we have asked for and received your consent (for example, push notifications)
• Legal obligation: where we are required to process data to comply with applicable law

We do not use any third-party analytics services (such as Google Analytics). Usage events, such as screens viewed, feature use, and visits that arrive through our promotional links, are stored in our own database and are accessed only through our internal admin tools. This data is used solely to understand how the Platform is used and to improve it. It is never shared with third parties for advertising or marketing purposes.

We work with the following service providers, who may process your personal data on our behalf. Each is subject to its own privacy policy and data processing terms.

6.1 Hosting: Hetzner Cloud

Purpose: our application, API, database (PostgreSQL), and cache (Redis) run on a server provided by Hetzner Cloud in Ashburn, Virginia, United States.

Data involved: your account data, the content you post, and your activity history. Uploaded files are stored separately (see 6.3).

Privacy policy: hetzner.com/legal/privacy-policy

6.2 Email delivery: Resend

Purpose: delivering our emails, including verification codes, sign-in links, weekly Reflect emails, and notification emails.

Data involved: your email address and the content of the emails we send you.

Privacy policy: resend.com/legal/privacy-policy

6.3 File storage: Supabase Storage

Purpose: storing profile photos, activity cover images, check-in photos, images attached to pinned prompts, and data export files.

Data involved: the files listed above. Data export files are deleted when their 7-day download link expires.

Privacy policy: supabase.com/privacy

6.4 Payments: Stripe

Purpose: processing payments for WMB+ subscriptions.

Data involved: your payment card details are entered directly into Stripe’s secure payment page and never touch WhereIsMyBuddy’s servers. We receive your payment status and a transaction reference from Stripe.

Privacy policy: stripe.com/privacy

6.5 Sign-in and fonts: Google

Purpose: we offer optional sign-in with Google. If you use it, Google verifies your identity and gives us your name and email address to create your account.

Fonts: our app and emails load fonts from Google Fonts. When they load, your IP address is sent to Google as part of the standard web request.

Privacy policy: policies.google.com/privacy

6.6 AI: OpenAI

Purpose: writing the short summaries described in Section 4.2, using OpenAI’s API (the GPT-4o mini model).

Data involved: only check-in statistics (for example, how many check-ins happened this week, or total pages read) and activity names and categories. Names of people are replaced with stand-ins before anything is sent. Your Reflect journal entries, check-in notes, discussion messages, support notes, activity descriptions, and any other personal content are never sent to OpenAI.

Privacy policy: openai.com/policies/privacy-policy

6.7 Push notifications: browser push services

Purpose: we use the standard Web Push protocol to send notifications to people who turn them on. They are delivered through your browser maker’s push service (Google, Apple, or Mozilla, depending on your browser).

Data involved: a push token unique to your device and browser, shared with that push service so it can deliver notifications.

Note: push notifications are opt-in and can be turned off at any time, per device, in Settings.

6.8 Error reporting: Sentry

Purpose: when something breaks on our servers, Sentry receives an error report so we can fix it.

Data involved: technical details of the failed request and the code involved. We set Sentry not to collect personal information such as your name, email address, or IP address, though a report can include an internal identifier for the record involved.

Privacy policy: sentry.io/privacy

6.9 Voice typing in Reflect: your browser

Purpose: Reflect lets you speak instead of type, using your browser’s built-in speech recognition.

Data involved: depending on your browser, its maker (for example, Google in Chrome or Apple in Safari) may process your audio on its own servers to turn it into text, under its own privacy policy. WhereIsMyBuddy never receives or stores the audio; only the resulting text, which you can edit, becomes part of your private journal.

6.10 Network and security: Cloudflare

Purpose: every request to whereismybuddy.app passes through Cloudflare, which protects the site from attacks and abuse and delivers it quickly.

Data involved: the requests and responses between your browser and our servers as they pass through, including your IP address, browser details, and the address of the page requested.

Privacy policy: cloudflare.com/privacypolicy

To be clear:

• We do not sell your personal data to any third party, ever.
• We do not share your personal data with third parties for advertising or marketing purposes.
• We do not read your Reflect journal entries for any purpose other than displaying them back to you.
• We do not send your Reflect journal entries, check-in notes, messages, or anyone’s name to any AI service.
• We do not use third-party advertising networks or tracking pixels.
• We do not engage in behavioural advertising or build advertising profiles.

We use two cookies, and both are needed to keep you signed in:

• wmb_access keeps you signed in while you use the Platform. It lasts a short time and is renewed automatically.
• wmb_refresh renews your sign-in so you do not have to sign in every visit. It is only ever sent to our sign-in renewal address.

Both are set by our own servers and cannot be read by scripts on the page. We also keep a few small items in your browser’s local storage: your light or dark theme, a promotional code or campaign tag from a link you followed (cleared after 30 days), and markers that remember what you have already seen or dismissed.

We do not use advertising cookies, tracking cookies that follow you across other websites, or third-party analytics cookies. If you use Google Sign-In, Google may set its own cookies under its own policy.

You can control cookies through your browser settings, but blocking our two cookies means you cannot stay signed in.

WhereIsMyBuddy is based in Canada. Your account data is stored on servers in the United States (Hetzner Cloud, Ashburn, Virginia). By creating an account and using the Platform, you consent to the transfer of your personal data to the United States.

Our other service providers, listed in Section 6, may process your data in countries outside Canada. Where data is transferred outside Canada, we rely on the data processing agreements and privacy commitments of those providers.

For EU and UK users (GDPR): the United States does not have a general EU adequacy decision. Transfers to our US-based infrastructure are made on the basis of our legitimate interests in operating the Platform.

We keep your personal data for as long as your account is active, or as needed to provide you with the Platform.

Account deletion. When you ask to delete your account, you are signed out everywhere and we email you a link to cancel. If you do not cancel within 14 days, your account and personal data are permanently deleted: your profile, check-ins, messages, journal, and uploaded files are removed, any WMB+ subscription is cancelled, and activities you own pass to their longest-standing member (or are deleted if nobody else is in them). We keep a record that an account was deleted, without your identity. We may keep specific information longer where required by law, to resolve disputes, or to enforce our agreements.

Deleted messages. When a message in an activity’s discussion is deleted, by you or by the activity’s owner, other members stop seeing it straight away. We keep its text for up to 30 days in case it was reported, then erase it. If a report about it is still open, we keep it until the report is resolved.

Backup data. We rely on our infrastructure and storage providers’ backup systems to protect your data. We are at an early stage of operations and are putting a formal backup and recovery plan in place. Copies of deleted data may remain in our providers’ backup systems for up to 90 days after deletion, depending on their backup rotation. We recommend keeping your own copy of any data you consider critical. We will update this policy as our infrastructure matures.

Data exports. A data export you request can be downloaded for 7 days. After that, the file is deleted.

Financial records. When WMB+ payments are processed, Stripe keeps payment records in accordance with its own retention policies and applicable law. We keep transaction confirmation records for at least 6 years, as required under Canadian tax law.

Anonymised data. Anonymised or aggregated data that cannot reasonably identify you may be kept indefinitely for product analytics and improvement.

Depending on where you live, you have certain rights over your personal data. We honour these rights for all users, regardless of jurisdiction.

11.1 Right to access

You have the right to request a copy of the personal data we hold about you.

11.2 Right to correction

You have the right to ask us to correct inaccurate or incomplete personal data. You can update most of your information directly in Settings.

11.3 Right to deletion

You have the right to ask us to delete your personal data. You can delete your account at any time from Settings; it is permanently deleted 14 days later, as described in Section 10.

11.4 Right to data portability

You have the right to a copy of your personal data in a portable format. You can download it at any time from Settings, under Account and privacy.

11.5 Right to withdraw consent

Where we rely on your consent (for example, push notifications or optional emails), you can withdraw it at any time in Settings or by contacting us.

11.6 Right to object (GDPR users)

If you are in the EU or UK, you have the right to object to processing that relies on our legitimate interests.

11.7 Right to lodge a complaint

If you believe we have not handled your personal data in accordance with applicable law, you can complain to your data protection authority:

• Canada: Office of the Privacy Commissioner of Canada, priv.gc.ca
• Quebec: Commission d’accès à l’information, cai.gouv.qc.ca
• EU and UK: your national or regional data protection authority

11.8 How to exercise your rights

To exercise any of these rights, email [email protected] or use the options in Settings. We respond to all requests within 30 days, and we may ask you to verify your identity first.

WhereIsMyBuddy is for adults 18 and over and is not directed at children. We do not knowingly collect personal information from anyone under 18. If we learn that someone under 18 has an account, we will close it and delete its data.

If you believe someone under 18 has given us personal information, contact us at [email protected].

We take the security of your personal data seriously and use reasonable technical and organisational measures to protect it, including:

• Encrypted connections (HTTPS/TLS) for all data sent between your device and our servers
• Passwords stored only as secure hashes
• Sign-in cookies that scripts on the page cannot read
• Access controls that limit who on our team can access user data; our admin tools never show journal entries

About backups: we are at an early stage and rely on our infrastructure and storage providers’ built-in protections while we put a formal backup and disaster recovery plan in place. No system is completely secure, and we cannot guarantee the absolute security of your data. If a breach poses a risk to your rights and freedoms, we will notify you and the relevant authorities as required by law.

WhereIsMyBuddy complies with Canada’s Anti-Spam Legislation (CASL). We send two kinds of email:

Emails the service needs. Verification codes, sign-in links, security alerts, receipts, account notices, invitations from other members, and messages about activities you are in. These are sent without separate consent because they are needed to provide the service you asked for.

Optional emails. Your weekly Reflect email and year-end email, getting-started and welcome-back emails, the note when an activity you are in has gone quiet, and the morning note when people in your activities noticed you and you have not seen it yet. By creating an account, you give implied consent to receive these. Each one can be switched off in your notification Settings, and every one carries an unsubscribe link that works without signing in.

We act on unsubscribe requests straight away, and always within the 10 business days CASL requires.

We acknowledge our obligations under Quebec’s Act Respecting the Protection of Personal Information in the Private Sector (Law 25) for users in Quebec. These include:

• Transparency about the collection and use of personal information (throughout this policy)
• The right to access, correct, and delete personal information (Section 11)
• Notification of privacy incidents that present a risk of serious injury (Section 13)
• Privacy by default in our product design

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by email or by a prominent notice on the Platform, and we will update the "Last updated" date at the top of this policy.

Your continued use of the Platform after an updated policy takes effect means you accept the changes. If you do not agree, you must stop using the Platform and may delete your account.

Questions, concerns, or requests about this policy or our privacy practices? Email [email protected]. We respond to all privacy inquiries within 30 days.