kander.
keeping everyone honest
This policy is written to meet PIPEDA, Canada's federal private-sector privacy law, which governs Kander as a Manitoba company.
This policy applies to Kander App Inc. ("Kander," "we," "us"), a Manitoba company, and to:
Once you create an account:
What we deliberately don't collect:
If we ever want to use your information for a materially new purpose, we will ask for your consent first — not just update this document.
We use the following third-party services to run Kander. Each receives only what it needs to do its specific job:
| Service | What it receives | Purpose |
|---|---|---|
| Supabase | Account data, job/review data | Database, authentication, file storage |
| Vercel | — | Hosting (doesn't process personal data directly) |
| Resend | Email addresses, and the contents of the notification being sent | Delivering notification and sign-in emails |
| ImprovMX | Email you send to hello@ or james@getkander.com | Forwarding mail addressed to Kander to a real inbox |
| Apple / Google push services | An anonymous push endpoint for your device, plus the notification text | Delivering push notifications — required by the browser, and they never receive your identity or email |
| Sentry | Technical details when something goes wrong — which page it happened on, your browser, an IP address, and the account identifier for the session (retained by Sentry for 90 days) | Catching bugs in production before you have to report them |
| OpenAI (Whisper API) | The audio of a voice note, if you record one | Turning a spoken review into text. Kander never writes the audio to its database or file storage, so we hold no copy of it. OpenAI retains what is sent to their API for up to 30 days for abuse monitoring and then deletes it, and their API terms state they do not use it to train their models |
| Payment processor (once Contractor Pro launches) | Payment details, directly — never through Kander | Subscription billing |
We do not sell your personal information.
Your information is stored in Canada. Kander's database, sign-in system, and file storage — your account, jobs, reviews, messages, and everything in your Home File — run on Supabase's Canadian region, physically hosted in Montréal, Québec. The servers that run the Kander app itself also run in Montréal, alongside the database. This was verified against the live infrastructure on Aug 18, 2026, not assumed.
When information crosses the border. While your information is stored in Canada, some of it is handled in the United States by the providers in Section 4 as a necessary part of operating Kander — most notably, every email Kander sends you (including sign-in links) is delivered by a US email provider, error reports go to a US monitoring service, and push notifications travel through Apple's and Google's delivery systems. Information in another country is subject to that country's laws, and in some circumstances its authorities may be able to access it. We use providers with contractual and security commitments comparable to how we protect your information here, and we send each one only what it needs. We do not sell your personal information to anyone.
When your account is deleted, reviews and job history are retained in de-identified form. Ninety days after deletion, your name, email, phone, profile photo, bio, and neighbourhood are erased and your remaining reviews and job records display under a generic placeholder instead of you. This retention serves one documented purpose — preserving the integrity of the review system so nobody can escape their track record by deleting and re-registering — and it is part of what you consent to at signup. Reviews you've written about others, and reviews others have written about you, both remain in that de-identified form regardless of which account was deleted.
Everything personal is erased at the end of that same 90-day window — automatically, by a scheduled process, not a manual review: email, phone, name, neighbourhood, profile photo and its underlying file, bio, portfolio links, your house's nickname, and every device push subscription. Until that erasure runs, deletion is reversible: sign back in with the same email within the 90-day window and your account is restored exactly as it was; once the window ends, erasure is permanent and cannot be undone. Messages you sent remain visible to the people you sent them to — like email, a conversation belongs to both sides — but under the placeholder name once the purge completes.
Your Home File is erased along with everything else when you delete your account — every record, note and uploaded document, permanently, at the end of the same 90-day window. We know this may be the thing you'd most want to keep, so we say it plainly on the delete screen before you confirm, and we'd rather you save anything you need elsewhere first. Once it's gone we cannot recover it for you.
Kander retains no voice-note audio, because it never stores any. A recording passes through only for the moment it takes to transcribe, and is never written to our database or file storage. The only thing we keep is the text — which you see, and can change, before you submit your review. OpenAI, who does the transcribing, holds the audio for up to 30 days for abuse monitoring before deleting it; that copy is theirs and outside our control, which is why we say plainly what happens to it.
Subject to the de-identified trust-record retention in Section 7, you can:
To exercise any of these, contact our Privacy Officer at the address in Section 14.
If a breach of our safeguards ever creates a real risk of significant harm to you, we will notify you and report it to the Privacy Commissioner of Canada, as the law requires.
If a Kander user logs a job with someone who isn't on Kander yet, we send that person a single invitation email on the user's behalf (or the user shares a QR code or link directly). The invitation names the person who logged the job, says it was sent because of them, identifies Kander, and needs no reply — there are no follow-up messages. We use the contact details only for that one invitation and for showing the job it belongs to; if the invitation is never accepted, the job record and the contact details are deleted after 90 days.
Kander uses essential sign-in cookies only — no advertising cookies, no third-party analytics, no trackers. Your browser also keeps a small amount of interface state on your device (things like whether you've collapsed a panel); that information never leaves your device.
Kander is not directed at, and we do not knowingly collect information from, anyone under 18.
If this policy changes in a material way, we'll update the date below and, where required, notify users directly. If a change would use your information for a materially new purpose, we'll ask for your consent first.
Access requests, corrections, complaints, and any question about this policy go to the Privacy Officer, Kander App Inc., Winnipeg, Manitoba: getkander@gmail.com.
If you're not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada — priv.gc.ca, 1‑800‑282‑1376.
Effective date: August 18, 2026.