Privacy Policy

Last updated: June 17, 2026 · Applicable to Quebec residents (Law 25)

1. Who we are

iCivic is a service of Solutions iCivic inc.("iCivic", "we"), a company based in Gatineau, Quebec, Canada. Our mobile app and website let you check real-time wait times at Quebec public services.

Privacy Officer (Law 25): reachable at legal@icivic.app. We acknowledge receipt of any request within 30 days.

2. Data we collect

2.1 Data you provide to us

• Email address and display name — when you create an account or join the waitlist.
• Wait-time reports — submitted voluntarily from the app. Reports are anonymous from the moment of submission: no account identifier is attached to them.
• Contact forms and B2G requests — name, organization, message.

2.2 Geolocation — never stored

If you consent (explicit system permission), your location is read only once at the moment of a report, solely to verify that you are near the location (500 m radius). This verification is performed directly on your device: your GPS coordinates are never transmitted to our servers. Only a yes/no presence flag accompanies the report. No continuous tracking, no movement history.

2.3 Data collected automatically

• Pseudonymized usage data — screens viewed, actions in the app (via PostHog, hosted in the United States, in cookieless mode; pseudonymous identifier with no email or name).
• Technical logs — hashed IP address (never in clear text), timestamp, device type — for security and fraud detection. Retained for 90 days.
• Push notification token — if you enable alerts, a device identifier is shared with Apple (APNs) or Google (FCM) to deliver notifications.
• Crash reports — in the event of a crash, a technical report is sent to Sentry, with no personal information (email and identifiers removed before sending).

3. How we use data

We use your data to:

• Provide and improve the iCivic service
• Send you the wait alerts and notifications you have set up
• Send you launch notifications in your region (with your consent)
• Detect and prevent abuse and false data
• Generate aggregated, anonymized statistics on wait times
• Comply with our legal obligations

We never use your data for advertising profiling or sale to third parties. No decision producing legal effects concerning you is made solely on the basis of automated processing.

4. Legal basis for processing

• Consent — for marketing communications (waitlist, newsletter), one-time geolocation and push notifications. Revocable at any time.
• Legitimate interest — for security, fraud prevention and aggregated statistics.
• Performance of a contract — for providing the service to registered users.

Use of the service is reserved for people 14 years and older. In accordance with Law 25, consent for a minor under 14 must be given by the holder of parental authority; we do not knowingly collect information from children under 14.

5. Artificial intelligence services

Some iCivic features (assistant, summaries, contextual search) rely on third-party AI services:

• Anthropic (Claude API) — generating responses and summaries. Momentary processing in the United States, zero retention: your messages are neither stored nor used to train models.
• Voyage AI — text vectorization for contextual search. No retention beyond processing.

These features have no access to your account data. Recommendation: do not share personal information (name, address, health status) in conversation areas with the assistant.

6. Data sharing and subprocessors

We share your data only with the providers necessary to operate the service:

Your primary personal information (account, sessions, reports) is hosted in Canada. When information is disclosed outside Quebec, we ensure it benefits from adequate protection, in accordance with Law 25. All our subprocessors are contractually required to protect your data and to use it only for the agreed purposes.

7. Data retention

• Waitlist — kept until launch in your region, then deleted within 30 days of your unsubscription.
• Active user account — kept as long as the account is active; deleted within 30 days of a deletion request.
• Inactive account — an account with no sign-in for 12 consecutive months is automatically anonymized: email and display name are removed from our systems on the 1st of the month following the deadline.
• Wait-time reports (anonymous) — raw data kept for 180 days then automatically deleted. The aggregated statistics derived from them contain no personal information (hourly granularity kept for 2 years, annual archives thereafter).
• Technical logs — 90 days, automatic purge.
• Pseudonymous analytics profile (PostHog) — 12 months, then deletion of the profile.

8. Your rights (Law 25)

You have the right to:

• Access your personal data
• Rectify inaccurate information
• Eraseyour data ("right to be forgotten") — directly from the app: Profile → Delete my account
• Portability — receive your data in a structured, commonly used format
• Cessation of dissemination / de-indexing — in the cases provided for by Law 25
• Withdraw your consent at any time (notifications, geolocation, marketing)
• File a complaint with the Commission d'accès à l'information du Québec (CAI)

To exercise these rights: legal@icivic.app. Response within 30 days.

9. Privacy incident

In the event of a privacy incident presenting a risk of serious harm, we will promptly notify the Commission d'accès à l'information du Québec as well as the individuals concerned, in accordance with Law 25, and we will keep an incident register.

10. Security

We apply the following security measures:

• TLS encryption for all communications
• Row Level Security (RLS) on all database tables
• Hashing of IP addresses before storage
• Encrypted local queue (AES-256-GCM) for offline reports
• Centralized secrets management (zero secrets in clear text in the code)
• Regular security audits and an audit log of administrative access

11. Cookies

Our website uses no advertising cookies or third-party tracking. The only cookies used are functional (language preference, sign-in session). Analytics is performed in cookieless mode via PostHog.

12. Changes

Any significant change will be communicated by email to registered users at least 30 days before it takes effect. The last-updated date appears at the top of this page.

13. Contact

For any question about this policy or your personal information:
iCivic — Privacy Officer
Gatineau, Quebec, Canada
legal@icivic.app