Testing Privacy policy

This policy covers the Vidda app for Apple devices.

Vidda is offered in Canada only. This policy is written to the federal Personal Information Protection and Electronic Documents Act, to the Personal Information Protection Acts of British Columbia and Alberta, and to Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25.

The rest of this policy explains those three sentences and tells you what else is true.

You can install Vidda, answer the opening questions, and see your first result without an account. During that time nothing you enter leaves your device and no record of you exists on our server or anywhere else. Your plan is calculated on the device and stored on the device.

The one thing that happens before you subscribe is described in the next section, and it happens only if you choose to look at the price.

Vidda's subscriptions are managed by RevenueCat, a company in the United States. When you open the screen that shows the price, our app asks RevenueCat what the current prices are. To answer, RevenueCat receives basic information about your device, your IP address, and a random identifier that is not connected to you or to anything you have entered.

This does not happen when you simply open the app. It happens when you choose to look at buying.

Buying a subscription creates your account. You can sign in with Apple, or with an email address and a password.

If you sign in with Apple, you can choose to hide your email address, in which case Apple gives us a forwarding address instead of your real one and we never see the real one.

Apple, not Vidda, takes the payment and holds your billing information. We never see your card details. Your subscription is managed through your Apple account, and you can cancel it at any time from the Manage subscription row in the app's Settings, or from your Apple subscription settings.

Your plan syncs to our server so that it survives a lost device and follows you to a new one. Every record is encrypted on your device before it is sent, using a key that only you hold. We store the sealed result. We cannot open it, our hosting provider cannot open it, and nobody who obtained a copy of our database could open it. This is a property of the encryption, not a promise about how we behave.

What we can read is this, and nothing more.

Your account: the email address or forwarding address you sign in with, and whether your subscription is active and which one it is.

Two facts kept on purpose, so that we can understand who we are serving and where: the province you told us, and the five-year span your birth year falls in, recorded as a number such as 1960 rather than your date of birth.

Bookkeeping attached to each sealed record: an opaque record identifier, your account identifier, the times the record was created and last changed, and a marker saying whether it has been deleted. These say when something changed. They never say what it is.

An automated test runs every time we build the app and fails the build if this readable list ever grows. If we ever decide to add a field, this policy changes before the field exists.

The key that unlocks your plan is generated on your device and stored in your iCloud Keychain, which Apple encrypts end to end. It follows you to your own Apple devices. Neither we nor Apple can read it.

You are also given a recovery code when your account is created. The recovery code is the key itself, written down. Keep it somewhere safe, such as a password manager or a piece of paper. We will never ask you for it, in support, by email, or in any other way. Anyone who asks you for it is not us.

Recovery of your encrypted data depends on your iCloud Keychain or your recovery code. If both are lost, your plan cannot be recovered by anyone, including us. There is no override, no support process, and no back door. This is the cost of the guarantee in section 7, and we would rather say it plainly than hide it.

Your plan also lives on your device, in ordinary device storage protected the way Apple protects your data, so losing the key does not remove the plan from the device you are using. It removes our ability to restore it anywhere else.

If you contact us with a problem, the app can produce a diagnostics report that you choose to send. That report is not encrypted. The screen tells you so before anything is shared, and it lets you send counts only, without your actual figures, unless the full numbers are needed.

We delete a diagnostics report from our support mailbox when your question is answered, or within thirty days, whichever comes first. That includes any working copy we made.

We send you three kinds of messages and nothing else:

Messages needed to run your account, such as confirming your email address or resetting your password.

Notices the law requires us to send you about your subscription, such as telling you before a trial ends and what you will be charged, and telling you before an annual subscription renews and how to cancel. These are required by consumer protection law in British Columbia and Quebec. They are not marketing, and each one says so.

Replies to messages you send us.

We do not send marketing email, we do not have a newsletter, and we do not use open tracking, click tracking, or any other measurement in the email we send you.

We use four service providers. We do not sell, rent, or trade your information with anyone, and none of these companies may use your information for their own purposes.

Supabase provides our database and sign-in. Your data is stored in the AWS Canada Central region, which is in Montreal, Quebec. Everything in your plan is stored there as ciphertext we cannot read.

Amazon Web Services provides the service that sends the email described in section 12, in the same Montreal region. Tracking is switched off.

RevenueCat, in the United States, manages subscriptions. After you subscribe it holds your account identifier, information about your device, your transaction history, and two notes about which version of the price screen you saw. It never receives your email address, your name, or your telephone number, and an automated test fails our build if any part of our code tries to give it one.

Apple provides the App Store, takes your payment, offers Sign in with Apple, and syncs your encryption key through iCloud Keychain. Apple's handling of your information is governed by Apple's own privacy policy.

Because RevenueCat and Apple are in the United States, some information about you is stored or processed outside Canada, and outside Quebec, where it may be accessible to foreign courts and law enforcement under the laws of that country. Nothing readable about your plan is ever sent to either of them.

Your plan stays on your device for as long as you keep the app.

The copy on our server, and your account with it, is deleted in two circumstances. If you started a trial and never subscribed, we delete your account twelve months after that trial ended. If you have no active subscription and have not signed in for thirty-six months, we delete your account then. We warn you inside the app before this happens.

When your account is deleted, everything goes together: the account itself, every sealed record, the province and the five-year span your birth year falls into (section 7), and your subscription record.

Once our copy is deleted, your recovery code no longer recovers anything, because there is nothing left on our side to unlock. Your plan on your device is untouched and keeps working.

Diagnostics reports are deleted as described in section 9.

Two different things live in the app's Settings, and they do close to opposite jobs.

“Reset all data” erases your plan everywhere, on your device and on our server, and keeps your account.

“Delete account” permanently deletes your account and everything our server holds about you, and leaves the plan on your device, working, without an account. Deleting your account does not cancel your App Store subscription, which you cancel through Apple.

You can ask us what personal information we hold about you, ask us to correct it, ask for a copy of it in a commonly used electronic format, ask us to delete it, or withdraw a consent you gave us. Write to privacy@vidda.ca and we will reply within thirty days.

There is one thing we cannot give you, and it is worth explaining. We cannot give you a copy of your plan, because we cannot read it. What we can give you is everything readable listed in section 7. Your plan itself is already yours, on your device, and the app can export it.

If you are not satisfied with how we have handled your personal information, write to our Privacy Officer at privacy@vidda.ca and say so plainly. We will investigate and reply in writing.

If our answer does not satisfy you, you can contact the Office of the Privacy Commissioner of Canada, to the Information and Privacy Commissioner for British Columbia or for Alberta, or, if you live in Quebec, to the Commission d'accès à l'information du Québec.