Privacy & Data Governance Policy

1. Scope and Legal Governance

Strengthen Family Bonds operates in strict compliance with Canadian privacy regulations, notably the Personal Information Protection and Electronic Documents Act (PIPEDA) and the modernized privacy standards mandated under Quebec’s Law 25 (Loi modernisant des dispositions législatives en matière de protection des renseignements personnels).

2. Person in Charge of Personal Information (Privacy Officer)

In accordance with Section 3.1 of Quebec’s Law 25, the highest-ranking officer exercises the functions of the Person in Charge of Personal Information (Responsable de la protection des renseignements personnels):

3. What We Collect and Why

We collect personal information solely for the clear, explicit purposes of providing family coordination and community exploration:

• Account & Authentication: Email address, validated via a one-time verification code, encrypted password hashes, and optional Multi-Factor Authentication (MFA) credentials.
• Community Profile: Household city/state, postal code, first and last name, or an optional Community Handle to protect personal identity when posting reviews and public community ideas.
• Private Family Vault: Child profiles, allergy and medical notes, emergency pickup instructions, and pinned school procedures. This data is strictly scoped to your tenant household ID and encrypted.

4. Meaning of "Encrypted and Never Shared"

We do not use misleading claims such as "end-to-end encryption" or "only you can technically access". We make a transparent, verifiable commitment:

• Storage Encryption: Sensitive Vault records are encrypted using AES-256-GCM before being stored in the database.
• Strict Tenant Scoping: Every query enforces household tenancy isolation; no member of another family can query, view, or modify your records (yielding an automatic 403 Forbidden).
• Zero Advertising or Third-Party Monetization: We do not track users across the web, use behavioral advertising cookies, or sell family data to data brokers.

5. Your Rights Under PIPEDA and Law 25

As a parent and user of Strengthen Family Bonds, you hold the following statutory rights:

• Right to Access: You may request a complete export of all personal and household information associated with your account.
• Right to Rectification: You can edit and update any vault entry, household profile, or contact information directly through your dashboard.
• Right to De-indexing and Deletion (Right to be Forgotten): Upon deleting an entry or closing your account, all associated private vault records are permanently purged from active databases.
• Explicit Consent: Email validation is mandatory prior to registration, ensuring that every user actively validates their identity and confirms consent.

6. Security Safeguards & Breach Protocols

We implement multi-layered administrative and technical safeguards:

• All data in transit is protected using TLS 1.3 / HTTPS.
• Strict Content Security Policy (CSP), HTTP-only cookies with SameSite=Strict flags, and automatic session regeneration upon authentication state changes.
• In the event of a confidentiality incident presenting a risk of serious injury, we maintain mandatory notification procedures toward the Commission d'accès à l'information du Québec (CAI) and affected users as prescribed by Law 25.