Privacy Policy

Last updated: April 28, 2026

Fluvaro ("we", "our") is a progressive web application (PWA) that aggregates hydrometric, tide, and fishing data for Quebec. This policy describes what personal information we collect, for what purposes, on what legal basis, how long we keep it, to whom we disclose it, and what rights you can exercise over it.

Fluvaro is subject to Quebec Law 25 (Act respecting the protection of personal information in the private sector). In accordance with this law, Fluvaro designates a Person in charge of the protection of personal information, reachable at [email protected], for any question, complaint, or request to exercise your rights.

1. Personal Information Collected

We collect only the personal information necessary for the purposes described in §2. This information falls into two categories:

Information you provide to us:

• Account information — email address and password (stored in hashed form).
• Preferences — language and display theme.
• Subscription data — when you subscribe to a Pro plan, billing information is managed directly by our payment provider (see §5).

Information generated through use of the service:

• Technical logs — IP address, browser type, and session information, collected to ensure security and proper operation of the service.
• Referral data — when you sign up from another user's QR code or shared link, we record the referrer's identifier, your identifier, and the signup date in order to attribute the referral. No cookie or local storage is used for this: the token only travels in the URL at signup time. The record is automatically deleted if either of the two accounts is deleted.
• Behavioural analytics data — We use Cloudflare Analytics to measure application usage: pages viewed and web performance indicators (via Cloudflare Web Analytics), as well as feature interactions (e.g., navigation between sections, language changes, subscription progress) via Cloudflare Analytics Engine. This data is entirely anonymous: no cookies are used, IP addresses are anonymized by Cloudflare at the edge before any processing, and no information that could identify you is associated with the measurements collected. This data is used exclusively to improve the product and is not shared for advertising purposes. Retention is 90 days within Cloudflare's infrastructure.

We do not collect any location data, any advertising identifier, and we do not perform any third-party advertising tracking.

2. Purposes of Collection

We collect your personal information for the following purposes only:

• Authentication and account management — creating your account, logging you in, securing access.
• Service delivery — displaying your preferences (language, theme), synchronizing your data across your devices.
• Pro subscription management — processing subscriptions, charging payments, issuing receipts (via our payment provider).
• User support — responding to your requests and resolving incidents you report.
• Security and abuse prevention — detecting intrusion attempts, blocking abusive behaviour.
• Legal obligations — retaining the records required to meet tax, accounting, or judicial requirements.
• Referral program — attributing each new signup to the referrer who triggered it and keeping an internal counter of referrals per user. This information may in the future be used to offer benefits (discounts, access) to users who actively share Fluvaro. Any reward mechanic will be described in separate terms at the time it is introduced.

We do not use your personal information for any other purpose. We do not sell it, rent it, or disclose it to any third party for marketing purposes. We do not perform any profiling or automated decision-making having legal effects on you.

3. Legal Basis for Processing

Each processing of your personal information relies on one of the following legal bases:

• Performance of the contract (account creation, subscription management, service delivery) — processing is necessary for Fluvaro to provide what you have subscribed to.
• Consent (optional Google OAuth authentication, non-billing notification emails) — you can withdraw your consent at any time; see §7 Your Rights.
• Legitimate interest (service security, fraud prevention) — we balance this interest against your rights and freedoms; you may object by writing to us.
• Legal obligation (accounting retention, response to a request from a competent authority) — we cannot exempt you from these processing activities.

4. Local Storage on Your Device

Fluvaro uses your browser's storage technologies to provide an offline experience. This data remains on your device and is not transmitted to our servers. No third-party cookies are used.

• IndexedDB — local cache of hydrometric, tide, and river data for instant and offline access.
• localStorage — preferences (light/dark theme, language).
• Service Worker + Cache API — caching of pages and resources for offline functionality.

You can clear this data at any time through your browser settings or the "Clear data" function in the application.

5. Third-Party Services and Transfers Outside Quebec

To provide its service, Fluvaro uses third-party technical providers (hosting, database, payment processing, authentication). Some of these providers store or process your information outside Quebec, notably in the United States.

Privacy impact assessment — In accordance with article 17 of Law 25, Fluvaro has assessed that these transfers offer equivalent protection to Quebec requirements, supported by the contractual commitments of these providers and their compliance with recognized international frameworks (ISO 27001, SOC 2, European GDPR).

You may object to these transfers by closing your account (see §7 Your Rights). However, a refusal would make it impossible to provide the service.

No advertising identifier and no third-party tracking cookie for advertising purposes is used. We use Cloudflare Analytics (cookieless, anonymized IP) to measure application usage for product improvement purposes only — see §1.

6. Retention Period

We retain your personal information only for the time necessary for the purposes described in §2, after which we securely destroy or irreversibly anonymize it.

Retention periods vary by category of information:

• Account (email, hashed password, preferences) — kept as long as your account is active. Deleted within a reasonable timeframe after a deletion request or account closure.
• Pro subscription data (plan, status, billing history) — kept in accordance with tax and accounting obligations applicable in Quebec.
• Authentication sessions — expire automatically according to the active session policy, or immediately upon logout.
• Security logs (IP addresses, access attempts) — retained for the time necessary to detect and analyze incidents, then purged.
• Support correspondence — retained for the time necessary to follow up on your request, then deleted.
• Referral data — retained as long as both accounts (referrer and referred) are active. Deleting either account automatically removes the referral record via database cascade.

Data cached locally on your device (IndexedDB, Service Worker) can be cleared at any time by you, through your browser settings or the "Clear data" function in the application.

You may contact us at [email protected] for details on the retention period applicable to a specific processing concerning you.

7. Your Rights

Under Law 25, you have the following rights over your personal information:

• Right of access — obtain a copy of the information we hold about you.
• Right of rectification — have inaccurate, incomplete, or equivocal information corrected.
• Right to portability — obtain your information in a structured, commonly used technological format (e.g., JSON, CSV), or request that it be transmitted to another controller.
• Right to erasure ("right to be forgotten") — request the deletion of your information when its retention is no longer justified (subject to our legal obligations, see §6).
• Right to withdraw consent — withdraw, at any time, a consent previously given (notably for Google OAuth authentication or optional emails). Withdrawal does not affect the legality of processing performed before the withdrawal.
• Right to object — object to processing based on our legitimate interest (§3), or to transfers outside Quebec (§5).
• Right to de-indexing — request that hyperlinks to information concerning you be de-indexed from search engines, when the legal conditions are met.

How to exercise your rights — Send your request to the Person in charge of the protection of personal information at [email protected]. We may ask you to confirm your identity before acting on your request. We will respond within the timeframes provided by Law 25. The response is free of charge, except for exceptions provided by law (manifestly abusive or repetitive requests).

8. Security of Information

Fluvaro implements reasonable technical and organizational measures to protect your personal information against loss, unauthorized access, disclosure, alteration, and destruction. These measures include in particular:

• Encryption in transit — all communications between your device and our servers are protected by TLS (HTTPS).
• Password hashing — your passwords are never stored in clear text; they are transformed by a cryptographic hashing algorithm with salt.
• Access controls — access to production systems is limited to authorized personnel and protected by authentication.
• Anti-abuse protection — our infrastructure includes mechanisms to detect and block intrusion attempts and denial-of-service attacks.
• Security updates — our software dependencies are kept up to date and known vulnerabilities are addressed as promptly as possible.

Despite these measures, no system is entirely invulnerable. In the event of a confidentiality incident presenting a risk of serious harm, Fluvaro will inform the Commission d'accès à l'information du Québec and the affected individuals, in accordance with the obligations of Law 25.

9. Children's Privacy

Fluvaro is not intended for individuals under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

10. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be indicated by updating the "Last updated" date at the top of this page. We encourage you to review this page regularly.

11. Complaint to the Commission d'accès à l'information du Québec

If you believe that Fluvaro has not respected your rights or its obligations regarding the protection of personal information, you may file a complaint with the Commission d'accès à l'information du Québec (CAI), the competent supervisory authority:

• Website: cai.gouv.qc.ca
• Email: [email protected]
• Phone: 418 528-7741 (Quebec) / 1 888 528-7741 (toll-free)

We nevertheless invite you to contact us first at [email protected] — a large portion of requests find a quick resolution through this channel.

12. Contact and Person in Charge of the Protection of Personal Information

For any question about this policy or to exercise your rights, contact the Person in charge of the protection of personal information at [email protected].