Privacy Policy
Version 2026-08-18-draft · Effective 29 July 2026 · InfoTrail, a sole proprietorship in Ontario, Canada
Draft — pending legal review
InfoTrail is in private beta and this document has not yet been reviewed by a lawyer. It describes how we genuinely intend to operate, and we follow it today, but the wording will change before public launch. Some details — our registered entity and address — are still to be confirmed. Questions in the meantime: privacy@myinfotrail.com.
The short version
InfoTrail records whereyour personal information is stored — not the information itself. We collect the minimum needed to run the service: your email, your subscription status, and the labels you create. We never see your card numbers. We don't run ads, we don't sell your data, and we don't use it to train AI models. You can export or delete everything at any time.
1. What we collect
| Data | Why |
|---|---|
| Email address | Signing in, receipts, service notices |
| Password (hashed) or sign-in link tokens | Authentication |
| Labels you enter — organization names, people's display names, item nicknames, notes, statuses, dates | The service itself |
| Your plan, and how you came by it | Plan limits |
| Support correspondence | Helping you |
2. What we deliberately do not collect
Actual addresses, phone numbers, card or account numbers, government identification numbers, dates of birth — the values of the information you track. The database has no field for them, and we block entries that look like real card or identification numbers. There is no paid plan yet, so there are no payment details to collect: when billing is added, card details will go directly to the payment processor named in section 7 and we will never receive them.
3. What we never do
We do not sell your personal information. We do not run advertising or ad-tech trackers. We do not profile you for third parties. We do not use your content to train AI models. We currently run no analytics of any kind — no page-view tracking, no product analytics. If that changes we will name the provider here before turning it on.
4. Consent
Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), we collect, use, and disclose personal information with your consent, for the purposes described here. You may withdraw consent by deleting your account.
5. Other people on your plan
If you track information belonging to someone else, you provide only a display label — we recommend a first name. You are responsible for having their permission. Where you have given someone their own login, they control their own profile.
6. Who at InfoTrail can see your information
Support and administrative staff can see the state of your account — your email address, when you joined, when you last signed in, your plan and how you came by it, and whether your account is locked — together with counts of what you have recorded, such as how many places or items are on your trail.
They cannot see what you recorded: not the names of your places, not the labels on your items, not your notes or events, and not the display names of other people on your plan. This is enforced by how the software is built rather than by policy alone. The screens staff use read through a fixed set of database functions that return account state and totals and nothing else, so no view in the product can show your content, and no future change can quietly begin including it without rewriting those functions. Every time a member of staff opens an account is recorded, alongside every change they make.
Running a database means someone can technically reach the data inside it. Direct database access is held by the operator of the service, used for maintenance, backups and diagnosing faults, and is not used to browse what customers have recorded.
7. Where your data lives, and who processes it
Your data is stored in Canada (Montreal). These are every service provider that processes any of it on our behalf, each bound by their own terms. This list is the whole of it — if a provider is not named here, it does not receive your data.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and authentication hosting | Canada (Montreal) |
| Vercel | Web hosting | Global edge network; company in the United States |
| Resend | Transactional email — sign-in links, invitations, service notices | United States |
Some processing happens outside Canada; we choose providers with appropriate contractual and technical safeguards. We will update this list before adding a provider, not after.
8. Keeping and deleting your data
- Active accounts: kept while the account exists.
- Deleting your account removes your data from production immediately and from backups within 30 days.
- There is no paid plan yet, so there are no billing records. Once there are, they will be retained as tax law requires (approximately 7 years, held by the payment processor).
- Export is available at any time, on every plan, as CSV.
9. Security
Encryption in transit and at rest, row-level access isolation so one account cannot read another's data, least-privilege keys, and no card data on our systems. No system is perfectly secure. If a breach creates a real risk of significant harm we will notify affected users and the Office of the Privacy Commissioner of Canada, as PIPEDA requires.
10. Your rights
You may access, correct, export, or delete your information at any time — from within the app, or by writing to privacy@myinfotrail.com. If you are dissatisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada.
11. Children
InfoTrail is not directed at children under 16. An adult may track a child's information locations under their own account using a label.
12. Changes
We will email account holders at least 30 days before a material change takes effect.
13. Contact
privacy@myinfotrail.com
InfoTrail, a sole proprietorship in Ontario, Canada
Ontario, Canada — a postal address is available on request