privacy policy

this policy covers personal information ConnectYXE processes in connection with the service. it does not cover information processed by third-party venues, ticketing providers, or other sites we link to; those operate under their own policies.

we collect only what we need to operate the service.

account information

email address, display name, username, and an authentication record. passwords are hashed by our auth provider and are not visible to us in plain text.

profile information

anything you add to your profile (neighbourhood, bio, visibility settings) and your social connections on the service (friend requests, accepted friendships, venues you follow).

platform activity

events you save, RSVP to, or submit; venues you follow; administrative actions if you operate a venue listing; notification preferences you set in your account.

submissions

events, images, claims, and venue submissions you send us, including any contact details you choose to include.

payment information

if you purchase a paid placement, our payment processor collects your payment details directly. we receive only the placement metadata (which order, amount, status) and a customer reference. we never store full card numbers or CVV codes.

newsletter subscriptions

if you subscribe to the Friday Roundup, we store your email address, the page you signed up from, and timestamps for subscription and unsubscription. for CASL audit-trail purposes we also record the IP address and user-agent of the device that submitted the form.

device and request data

standard web-server log fields (IP address, user-agent, requested URL, timestamp) generated automatically when you visit. used for security, abuse prevention, and aggregate traffic measurement.

support correspondence

if you email us, we retain the message for as long as needed to respond and to keep an audit trail.

we do not collect precise location data, payment-card numbers, government identifiers, or sensitive categories of personal information (health, biometrics, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, trade-union membership).

we process personal information for the following purposes:

• to operate the service and provide the features you use;
• to authenticate you, secure your account, and protect the service against fraud, abuse, and unauthorized access;
• to communicate with you about your account, submissions, and material changes to the service;
• to deliver the Friday Roundup if you have subscribed, until you unsubscribe;
• to send service notifications about events you have saved or RSVP'd to (reminders, cancellations) and venues you follow (new events), subject to the preferences you set in your account;
• to moderate user-submitted content;
• to process payments and issue refunds;
• to comply with applicable Canadian and Saskatchewan law.

we do not use personal information for behavioural advertising, cross-site tracking, profiling, or automated decisions that produce legal or similarly significant effects.

we share personal information with carefully selected service providers that help us operate the service — for example, database and authentication, application hosting, transactional and bulk email delivery, payment processing, product analytics, and error monitoring. each provider receives only the data necessary for its function and is contractually bound to safeguard it. we do not sell personal information, and we do not share it with advertisers, data brokers, or marketing partners.

we may disclose personal information when required by law, court order, or to enforce our terms of service, and in connection with a corporate transaction (merger, acquisition, asset sale), subject to PIPEDA's prospective- transaction provisions.

we use two categories of cookies and similar local storage:

essential

authentication tokens that keep you signed in, anti-forgery tokens that protect form submissions, and small UI preference values (theme, dismissed banners). these are required for the service to work.

analytics

a product-analytics tool that records page views and feature interactions. for signed-in users, events are associated with a stable internal user id so we can understand what works in aggregate; we do not sell or share this data, and we do not run session-replay or third-party advertising scripts.

error monitoring

when a page crashes or a server action fails, we capture the technical details (URL, error type, stack trace, browser type) so we can fix the bug. we configure the tool not to collect personal information by default.

most browsers let you block or clear cookies through their settings; blocking essential cookies will sign you out and may break parts of the service.

some of our service providers operate or store data outside Canada, including in the United States and the European Union. when personal information is processed in another jurisdiction, it may be accessible to authorities in that jurisdiction under local law, including lawful access requests. we use Canadian-region storage where available and require contractual data-protection commitments from each provider.

account data

retained while your account is active; deleted within 30 days of account deletion, except where a longer period is required by law.

submissions

approved listings are retained as part of the editorial archive. rejected submissions are deleted within 90 days.

newsletter records

retained until you unsubscribe; the unsubscribed record is retained for three years from withdrawal as proof of CASL compliance.

payment records

retained for six years to satisfy Canadian tax-record requirements.

server logs

rotated and discarded within 30 days, except where a longer period is necessary to investigate an active security incident.

under PIPEDA, you have the right to:

• access a copy of the personal information we hold about you, including the categories of third parties to whom it has been disclosed;
• correct inaccurate or incomplete personal information;
• withdraw consent to processing, subject to legal or contractual restrictions and reasonable notice. withdrawing consent for essential account processing means we can no longer maintain your account;
• delete your account and associated personal information;
• request a copy of the personal information you provided to us in a portable, machine-readable format.

to exercise any of these rights, email hello@connectyxe.ca from the address on your account. we will respond within 30 days. if we need to verify your identity, we will tell you what we need.

the service is not directed at children under 13. we do not knowingly collect personal information from anyone under 13. event listings tagged for younger audiences are intended for parents and guardians. if you believe a child has provided us personal information, email hello@connectyxe.ca and we will delete it.

we use technical and organizational measures appropriate to the sensitivity of the information we hold: encryption in transit and at rest, access controls limiting personal information to those who need it, and database-level rules that prevent one user from reading another's private data. you are responsible for keeping your account credentials confidential. no system is perfectly secure.

if a breach of security safeguards involving your personal information creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as required by section 10.1 of PIPEDA, and we will maintain a record of all breaches involving personal information under our control.

we may update this policy from time to time. if a change materially affects how we use existing personal information, we will notify you by email or via a prominent notice on the service at least 14 days before the change takes effect. minor wording updates will be reflected in the effective date at the top of this page.

you can reach our privacy contact at hello@connectyxe.ca. if you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.