Privacy Policy

1. Who we are

KWise (“we”, “us”) is a community tips platform for Kitchener-Waterloo students and newcomers. We are based in Waterloo, Ontario, Canada, and we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA).

2. What we collect

• Email address — collected when you sign in via magic link. Used only for authentication. Never sold or shared with third parties.
• Usage data — anonymous page-view analytics via Vercel Analytics (no cookies, no personal data, IP addresses are not stored).
• Submissions — tip content you submit. Optionally includes a contact email for review follow-up only.
• Votes and saves — associated with your account to prevent duplicate votes. Not shared publicly.
• IP address (hashed) — we store a one-way SHA-256 hash of your IP address, salted and rotated, for rate limiting only. The original IP is never stored.

3. What we do NOT collect

• Your real name or physical address
• Phone number
• Payment information
• Social media profiles
• Browser fingerprint or tracking cookies

4. How we use your data

• To authenticate you via email magic link
• To save your bookmarked tips and voting history
• To prevent spam via rate limiting
• To improve the platform via aggregate analytics

We do not use your data for advertising, profiling, or any automated decision-making.

5. Third-party services

• Supabase — database and authentication (data stored in Canada where available)
• Vercel — hosting and cookie-free analytics
• Cloudflare Turnstile — bot protection (privacy-preserving, no tracking cookies)
• Resend — transactional email for magic links
• Upstash Redis — rate limiting (no personal data stored)

6. Data retention

Your account and associated data are kept as long as your account is active. You may delete your account at any time from Account Settings, which permanently removes your profile, saves, and votes within 30 days.

7. Your rights (PIPEDA)

• Right to access the personal information we hold about you
• Right to correct inaccurate information
• Right to withdraw consent and request deletion

To exercise these rights, email us at privacy@kwise.ca.

8. Security

All data is encrypted in transit (TLS 1.2+). Row-level security ensures users can only access their own data. We follow OWASP security guidelines and conduct regular reviews.

9. Changes to this policy

We will notify registered users by email of material changes to this policy at least 14 days before they take effect.

10. Contact

Questions? Email privacy@kwise.ca. We respond within 5 business days.