What happens to your data

Where it lives

Montreal. The database and files are on Supabase (Amazon), the website on Vercel, the keys, the gatekeeper, the AI and the backups on Google Cloud. All American companies, so this is residency, not sovereignty. Stored and processed in Montreal; on the way in, though, the encrypted connection is opened (decrypted in transit, not stored) at the nearest edge: Vercel’s for the website (Portland, in the US, from western Canada) and Cloudflare’s for sign-in and fitness-file imports (Vancouver, from BC). §4

How it is locked

Each document has its own key, locked by your account’s key in Google Cloud KMS. Your names, birth date, notes and conversations are encrypted in the database with a key of their own. Numbers, dates and the names of things are not, so charts and search can work. §3

Every opening is written down

Documents and encrypted words open only through one gatekeeper, which records who asked. You can read the whole trail yourself under Privacy & activity. §10

Where AI runs

Gemini in Montreal, for every account. Claude in the US only if you choose it in Profile, which takes your consent, a fresh sign-in and your two-step code. A document you import is read whole; what the coach sends has your names, birth date and contact details taken out first. Nobody trains on it. §5

What a share link sees

Only the sections you pick, until the time you set. Documents only as a masked copy: identifiers blacked out, uncertain pages withheld, flattened to images. Careful, not perfect. §6

Connectors

Oura, Garmin, ResMed myAir and the Android app’s Health Connect, each off until you connect it. Only tokens are kept, encrypted. No password is ever stored, and disconnecting deletes the token. §7

Email

Resend, in the US, sends sign-in emails and links. No health information is emailed: the visit email is a link to a page that needs your sign-in and two-step code. §9

Backups

A nightly copy is made on the operator’s computer in BC and mirrored to a private bucket in Montreal, kept up to six months. Documents and words stay locked in it; numbers and your email address do not. §11

Deleting your account

Your key is destroyed after seven days, and nothing locked under it opens again from any copy. Everything else goes at once, and from the backups the next night. The audit trail keeps its entries, with your words removed. §12

Never

Sold, rented, used for advertising, or tracked across other sites. §4

Not yet reviewed by a lawyer, like the policy it summarises. Questions go to privacy@selfsense.ca.