Privacy Policy

Version 7.0.0 · Last updated: December 7, 2026 · Applicable to Quebec residents (Law 25)

1. Who we are

iCivic is a service of Solutions iCivic inc. ("iCivic", "we"), a company based in Gatineau, Quebec, Canada. Our mobile app and website let you check published wait times for certain Quebec public services, where such data exists.

Privacy Officer (Law 25): reachable at legal@icivic.app. We acknowledge receipt of any request within 30 days.

2. Data we collect

2.1 Data you provide to us

• Email address and display name — when you create an account or join the waitlist.
• Wait-time reports — submitted voluntarily from the app, with an account. Each report is published at once, one by one: anyone who consults iCivic can see it, with no information that could identify you. That is what lets the next person see the current wait. No data we keep links a report to your account, your device or your IP address — not the published row, not any other table, not our backups. To fight abuse, we check at the moment of sending that your account, your device and your connection have not exceeded the limits (one report per service every 10 minutes, 24 per day). This check runs on in-memory counters, never written to disk or backed up, identified by a fingerprint that changes every day: those tied to a place erase themselves after 15 minutes at most, the daily ones after 24 hours. After that, nobody — us included — can tell who made which report.
• Visit declarations (“I’m going”) — when you indicate what time you plan to visit a location, so others can spread out their visits. These declarations are anonymous from the moment they are collected: the stored row contains only the location, the service and the intended hour — no account identifier, even when you are signed in, and no GPS coordinates. We know that someone plans to be somewhere; never who. Only your device keeps the token that lets you cancel your own declaration.
• Queue presence (“I’m in line”) — when you report, from a SAAQ or Service Canada office, that you are in line, so others can see how many iCivic users are waiting there. You must be signed in and within 500 m of the office (checked on your device, see 2.2). We record the location, the service you chose, the number of files if you give it, and your arrival time — no account identifier, and no GPS coordinates. Only your device keeps the token that lets you confirm you are still in line, then say that you were served or that you left. When you leave, we keep the visit outcome (served, left, or expired for lack of confirmation), with an arrival time rounded to the hour and a duration rounded to 5 minutes — still with no account and no token. While you are in line, your device asks you once an hour whether you are still there: these reminders are scheduled on your device, go through no notification service and do not name the location.
• Contact forms and B2G requests — name, organization, message.
• Favourites — the locations you follow are kept on your device. They are copied to our servers only if you turn notifications on, and for that single purpose: letting our servers alert you about those locations while the app is closed. Turning notifications off erases that copy. Without an account, or without notifications turned on, your favourites never leave your device.
• Wait alerts — when you create an alert ("tell me when it drops below 30 minutes") with an account, the location and threshold are stored on our servers: that is what lets us warn you while the app is closed, which your device alone cannot do. Deleting the alert deletes that record.
• Proof of your acceptance — when you accept these terms or this policy, we record which version you accepted, on what date, in which language, and from which platform, together with a hashed IP address (never in clear text). We are required to: the burden of demonstrating your consent is ours, not yours to disprove. This register is immutable — we can neither alter it nor delete a line from it.

2.2 Geolocation — never stored

If you consent (explicit system permission), your location is read only once at the moment of a report, solely to verify that you are near the location (500 m radius). This verification is performed directly on your device: your GPS coordinates are never transmitted to our servers. Three pieces of information, none of them coordinates, accompany the report: the yes/no verdict, the age of the location reading (to reject a reading older than 10 minutes) and, on Android, a simulated-location flag. None of the three is kept. A refused report (too far from the place, reading too old, simulated location) only adds one to a total per hour and per reason, which designates no one. The same verification applies when you declare that you are in line. No continuous tracking, no movement history.

2.3 Data collected automatically

• Pseudonymized usage data — screens viewed, actions in the app (using an analytics tool we host ourselves, on our servers in Quebec, in cookieless mode; pseudonymous identifier with no email or name). ⚠️ Until 7 September 2026 this data passed through the tool vendor's cloud infrastructure in the United States; data from before that date remains there for up to 12 months, then disappears.
• Technical logs — hashed IP address (never in clear text), timestamp, device type — for security and fraud detection. Retained for 90 days.
• Push notifications — if you enable alerts, a device identifier is shared with our notification delivery service (United States), then with Apple (APNs) or Google (FCM) to deliver the notification. The content of the notification also passes through these services: it names the place concerned and, for a wait alert, the threshold you chose. No account identifier accompanies it. We cannot bypass Apple and Google — they are the only services allowed to deliver a notification on their respective devices.
• Visit-declaration abuse counter — a randomly generated device token (never derived from your hardware; clearing the app’s data resets it) and a hashed IP address, to prevent a single source from declaring visits in bulk. This counter points to no declaration: it counts, it does not designate. Its timestamp is rounded to the hour, and the row is deleted after 48 hours.
• “Too far from the place” refusal counter — to spot abusive use, we count, per account, how many of your attempts this week were refused because you were too far from the place. This tally lives in memory only, under a pseudonym that changes every week, and erases itself after 7 days. It counts refusals; it designates no published report.
• Queue-presence abuse counter — your account identifier and the time of your declaration, rounded to the hour, to limit each account to one declaration per 30 minutes and six per 24 hours. This counter contains neither the location nor the service and points to no presence: it knows that you declared, never where. The row is deleted after 25 hours.
• Crash reports — in the event of a crash, a technical report is sent to our own server, hosted in Quebec, with no personal information (email and identifiers removed before sending). No third party receives these reports.

2.4 Session restoration when you change devices (Android)

On Android, when you are signed in, we entrust Block Store — a Google Play service — with a copy of the session token that keeps you signed in, so that you stay signed in when you replace your phone. That is the sole purpose of this copy.

What we entrust is limited to that token: not your email, not your name, not your reports, not your favourites.

This copy is uploaded to Google’s cloud backup only if your device offers end-to-end encryption (Android 9 or later, with a screen lock) — Google then carries a copy it cannot read. If your device does not offer it, the copy never leaves your device and can only serve a direct cable transfer to your new phone.

You stay in control: signing out erases this copy. Turning off Android backup in your phone’s settings prevents any upload.

Why we spell this out so precisely: a session token is a key to your account. Until this version, ours never left your device. It now can leave it, encrypted, for this single purpose — and that is a change you should be able to weigh before it takes effect.

iOS is not affected: Block Store is an Android service.

3. How we use data

We use your data to:

• Provide and improve the iCivic service
• Send you the wait alerts and notifications you have set up
• Send you launch notifications in your region (with your consent)
• Detect and prevent abuse and false data
• Publicly display reports, with no information that could identify you, so that anyone can see the current wait. For a wait reported by the community to override official data, it takes at least three distinct people within 15 minutes: we count them in memory, under a fingerprint, without knowing who they are.
• Display a location’s declared attendance — how many people plan to be there at a given hour — so the next person can choose a quieter moment. This figure is never an exact count: it is published in tiers (5+, 10+, 20+, 50+) and only from five declarations onward for the same slot. Below that, nothing is shown — neither a figure nor a zero.
• Display, for a SAAQ or Service Canada office, how many iCivic users report being in line, service by service. This number is exact, but it is frozen every 5 minutes, so that no one can deduce the moment a person arrived. Durations (“last arrival … ago”, “in line for …”) are published only from three people in line for the service.
• Produce, from visit outcomes, statistics on the actual length of visits, provided only to the organization the office belongs to — never to another. No statistic is provided for a time slot with so few visits that a person could be recognized in it.
• Generate aggregated, anonymized statistics on wait times
• Provide client public-sector organizations, for a fee, with anonymous wait-time data covering their own service locations
• Show you, if you have an account, your personal contribution statistics (number of reports and hours of wait avoided, accumulated for life)
• Comply with our legal obligations

We sell no personal information. The wait-time data we provide to client organizations is anonymous: no data we keep links a report to an account, a device or an address.

A correction, because previous versions of this text stated that reports were “anonymous from the moment of submission”. Until 7 October 2026, that was not accurate. A technical table kept to fight abuse recorded, for each report, your account, a fingerprint of your device and of your IP address, as well as the place, the service and the time. Only we could match that row against the published report: near-certainly for 48 hours, then still through the service until its deletion after 90 days. We never performed such a match, and this table was never shared with anyone. It was emptied and then deleted on 7 October 2026. Only our backup copies made before that date still contain it, until they expire on 5 January 2027 at the latest (see 7.1). The per-account reliability score derived from it was deleted the same day.

Your contribution statistics, with no link to your reports. Your total (number of reports, hours of waiting, badges, leaderboard) is kept on our servers, but it is not updated at the moment you report: the time of the update would be enough to find the report. After a report, our servers hand your device a signed receipt, which they do not keep. Your device redeems it later — between 6 and 48 hours after, at a randomly chosen moment, together with any other pending receipts — and that is when your total moves on our servers. Your app shows it right away. The receipt keeps only a wait rounded to the quarter hour. Your streak of consecutive days is computed on your device; our servers only check that it does not exceed the number of receipts redeemed. If your app is not up to date, your total still moves at the moment of the report: updating the app is enough.

We never use your data for advertising profiling. No decision producing legal effects concerning you is made solely on the basis of automated processing.

4. Legal basis for processing

• Consent — for marketing communications (waitlist, newsletter), one-time geolocation, push notifications and declaring your presence in line (a separate act, which you withdraw by leaving the line). Revocable at any time.
• Consent at the moment of reporting — before you send it, and without your having to expand anything, the app tells you that your report will be published without your identity.
• Performance of a contract — for providing the service to registered users.
• Exceptions provided by Law 25 — the Act allows us to use information without your consent in specific cases, notably where it is necessary to prevent and detect fraud or to improve our security measures, and to produce de-identified information for statistical purposes.

Use of the service is reserved for people 14 years and older. In accordance with Law 25, consent for a minor under 14 must be given by the holder of parental authority; we do not knowingly collect information from children under 14.

5. Artificial intelligence services

Some iCivic features (assistant, summaries, contextual search) rely on AI services:

• Our generative AI provider — generating responses and summaries. Processing in the United States. Your messages are not used to train models, and the provider deletes them within 30 days at most. One exception remains — if the provider's automated safety systems flag an exchange, that exchange may be retained for up to 2 years.
• Contextual search — on our own servers, in Québec. The text vectorization behind this feature was previously handled by a second subprocessor in the United States. Since 3 September 2026 it runs on our infrastructure in Beauharnois: your question no longer leaves Québec for that step, and no third party receives it.
• On-device speech recognition — if you choose to dictate your question, transcription runs entirely on your phone, using Apple's (iOS) or Google's (Android) built-in recognition engine. No audio recording is sent to our servers. Only the transcribed text is then forwarded to our generative AI provider to generate the response, under the same conditions as a typed message. iCivic records only the length of the dictated text for telemetry, never its content or the audio.

These features have no access to your account data. Recommendation: do not share personal information (name, address, health status) in conversation areas with the assistant.

6. Data sharing and subprocessors

We share your data only with the providers needed to run the service. We describe them by category, with where they process your information:

Your core personal information (account, sessions, reports) is hosted in Quebec, on our own servers. Where information is communicated outside Quebec, we say so above. The named list of our providers is available on request, at the address given in §14.

7. Data retention

• Waitlist — kept until launch in your region, then deleted within 30 days of your unsubscription.
• Active user account — kept as long as the account is active; deleted within 30 days of a deletion request.
• Inactive account — an account with no sign-in for 12 consecutive months is automatically anonymized: email and display name are removed from our systems on the 1st of the month following the deadline.
• Wait-time reports — kept indefinitely, with no data linking them to an account, a device or an address, for public display and aggregated statistics. The anti-abuse counters that accompany them live in memory: 15 minutes at most for those tied to a place, 24 hours for the daily ones, 7 days for the “too far from the place” refusal tally. Refusals leave only a total per hour and per reason in our database.
• Personal contribution statistics — for account holders: an aggregate counter (number of reports and minutes of waiting, with no date at all), your badges (dated to the month), and the record of your redemptions — how many receipts you redeemed, per redemption day, never per report day. Kept as long as your account exists, erased when it is deleted, included in your data export. So that a receipt can only be used once, we keep its fingerprint indefinitely, with no account and no date.
• Proof of acceptance — the link to your account is severed as soon as it is deleted, and the hashed IP address is erased after 90 days, as with other technical data. What remains — "an acceptance of version X happened on that date" — no longer identifies you and is kept in that anonymous form, like the reports.
• Visit declarations — deleted 7 days after the intended date. Before that deletion, a purely aggregated record is kept — how many declarations targeted a location on a given date and hour — so that we can one day verify whether such declarations actually predict attendance. This record contains no account, no token and no address: it holds only a number per slot, and therefore cannot designate anyone.
• Queue presence — the presence is deleted 10 minutes after you leave the line. Without confirmation from you, it closes on its own after 90 minutes, and at the latest 8 hours after your arrival or two hours after the office closes. The abuse counter is deleted after 25 hours. The visit outcome, which contains no account and no token, is kept with no time limit for statistics; we will review this period twelve months after the feature launches.
• Favourites and alerts — the server copy of your favourites exists only while your notifications are on: turning them off erases it. A wait alert is kept until you delete it. Both disappear with your account.
• Session restoration token (Android) — held by Block Store for as long as you stay signed in. It deliberately survives reinstalling the app: that is precisely what makes restoration on a new device possible. It is erased as soon as you sign out, and you can also remove it by deleting your Google account’s backup data.
• Technical logs — 90 days, automatic purge.
• Pseudonymous analytics profile — 12 months, then deletion of the profile.
• Aggregate count for the public site — the technical fingerprint that tells two visits apart within a single day is destroyed by the host after 24 hours. Only totals remain after that: they identify no one and are tied to no account.

7.1 A backup copy survives for up to 90 days

The periods above describe our live systems: when data is deleted there, it is deleted right away and for good. An encrypted backup copy may nonetheless still contain it, for up to 90 days, until that copy expires in turn and disappears automatically. We say so because it is true, and because "deleted within 30 days" would otherwise read as instantaneous disappearance from everywhere.

These backups exist for one reason: to be able to restore the service if our systems are lost or compromised. They are never consulted, queried, or used for any other purpose, and no decision concerning you follows from them. They are encrypted before leaving our systems — the decryption key is not held by the hosting provider — and kept in Québec, in Beauharnois.

8. Your rights (Law 25)

You have the right to:

• Access your personal information — directly from the app: Profile → Download my data
• Rectify inaccurate information
• Erase your data ("right to be forgotten") — directly from the app: Profile → Delete my account
• Portability — receive your data in a structured, commonly used format, directly from the app: Profile → Download my data
• Cessation of dissemination / de-indexing — in the cases provided for by Law 25
• Withdraw your consent at any time (notifications, geolocation, marketing)
• File a complaint with the Commission d'accès à l'information du Québec (CAI)

Download my data, in your profile, exercises access and portability in one step: we prepare the information attached to your account in JSON — a structured, commonly used format readable by you and by another service alike — and place it in a private space that only your account can reach. You open the file from the app, through a temporary link valid for one minute, created at the moment you ask for it. The file passes through no email service, and it is erased from our servers within 24 hours.

One clarification, because the transition is not instantaneous: app versions older than the one introducing this pickup still email the export as an attachment, to your account's email address — never to an address supplied with the request. Updating the app is enough to move to the pickup.

Three limits, stated plainly. Your wait-time reports are not in this export: no data we keep links them to your account — which is also why we cannot produce a list of them for you. Your device keeps their history; the record of your receipt redemptions, on the other hand, is included. And information held by our processors is not included automatically; ask us and we will obtain it for you.

A third limit, of the same nature: your visit declarations cannot be accessed, corrected or deleted on request. This is not a refusal — it is a direct consequence of their anonymity: no key links a declaration to you, including for us. The only way to withdraw yours is the cancel button in the app, which uses a token only your device holds. We chose this design deliberately: knowing where a person plans to be touches on a degree of intimacy we would rather never hold.

The same goes for your queue presences and the visit outcomes that follow from them: no key links them to you. To withdraw yours, tap “I left”; without confirmation, it closes on its own within 90 minutes at most. The queue-presence abuse counter, however, carries your account: it is included in “Download my data” and disappears with your account.

To exercise these rights another way, for any other request, or if the feature is temporarily unavailable: legal@icivic.app. Response within 30 days. That route stays open at all times and answers the same rights as the button.

9. Privacy incident

In the event of a privacy incident presenting a risk of serious harm, we will promptly notify the Commission d'accès à l'information du Québec as well as the individuals concerned, in accordance with Law 25, and we will keep an incident register.

10. Security

We apply the following security measures:

• TLS encryption for all communications
• Row Level Security (RLS) on all database tables
• Hashing of IP addresses before storage
• Encrypted local queue (AES-256-GCM) for offline reports
• Centralized secrets management (zero secrets in clear text in the code)
• Regular security audits and an audit log of administrative access

11. Cookies

Our website uses no advertising cookies or third-party tracking. The only cookies used are functional (language preference, sign-in session). Both audience measurements on the site are cookie-free, and they do not follow the same rule:

• Aggregate count (Vercel Web Analytics, our host's measurement tool) — on by default. It counts page views, along with country, region, city, device type and browser. It sets no cookie and builds no profile: two visits within the same day are told apart by a technical fingerprint derived from the request, which Vercel destroys after 24 hours and which allows no correlation from one site to another. The query string is stripped from addresses before sending.
• Detailed path measurement (a tool hosted on our servers in Quebec) — nothing is sent without your prior consent. Without an explicit yes, the provider is not even initialized.

How to decline: the Decline button on the audience-measurement banner stops both — immediately, with no reload. You can change your mind at any time through the “Usage measurement” link at the bottom of every page. Neither measurement is used for advertising, and neither is sold.

12. Changes

Any significant change will be communicated by email to registered users at least 15 days before it takes effect. The last-updated date appears at the top of this page.

13. French version and language primacy

This policy is drawn up in French. An English version is made available to you for convenience. In the event of any discrepancy between the French version and the English version, the French version is authoritative.

This policy is an information notice: it describes our practices, it is not accepted as a contract. The French version is therefore the one that states our commitments authentically — and it is the version number and fingerprint recorded when you consulted it that identify the text then in force.

14. Contact

For any question about this policy or your personal information:

iCivic — Privacy Officer
Gatineau, Quebec, Canada
legal@icivic.app