Privacy Policy — ShareVibes

ShareVibes ("we", "us") is operated from Canada. This policy describes how we collect, use, disclose, and safeguard your personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, Quebec's Act respecting the protection of personal information in the private sector (Law 25).

1. Accountability & Privacy Officer

ShareVibes has designated a Privacy Officer responsible for our compliance with PIPEDA. You can reach the Privacy Officer at privacy@sharevibes.online for any question, access request, correction, complaint, or to withdraw consent.

2. Personal information we collect

Account data: email address, hashed password, display name, bio, avatar.
Profile data you provide: city, approximate latitude/longitude (if you enable location), skills you offer or seek, availability, session preferences.
Activity data: bookings, in-app messages between members, reviews you give and receive, and your credit ledger.
Technical data: IP address, browser user-agent, and basic request logs — used for security, abuse prevention, and to prove that you consented to this policy when you signed up.
Support & feedback data: content of feedback, help requests, or bug reports you submit through the in-app widget.

3. Purposes & legal basis

We collect and use your personal information only for these identified purposes:

To create and operate your account (sign-in, sessions).
To match you with other members and facilitate skill trades.
To send transactional emails (booking updates, notifications).
To protect the community — detect fraud, enforce the Terms and Code of Conduct, and respond to reports.
To respond to your questions and support requests.
To comply with legal obligations.
To improve the service in aggregate, non-identifying form.

Our lawful basis is your express consent given at signup (via the Terms and Privacy Policy checkbox) and, for security logs and transaction records, our legitimate interest in operating a safe service. We do not use your data for behavioural advertising or automated decision-making that produces legal effects about you.

4. Consent

By checking the consent box at signup you provide meaningful, informed consent to the collection, use, and disclosure described in this policy. We record the date, time, IP address, browser, and version of the policy you accepted as proof of consent, as recommended by PIPEDA. You may withdraw consent at any time (see section 9), subject to legal and contractual restrictions and reasonable notice; withdrawing consent may mean we can no longer provide the service to you.

5. Disclosure & service providers (cross-border transfers)

We rely on a limited number of trusted service providers to run ShareVibes. Some of them process your personal information outside of Canada (primarily in the United States). While your data is outside Canada it is subject to the laws of that country, including lawful access by foreign authorities:

Lovable / Supabase — hosting, database, authentication, storage. Encrypted at rest and in transit.
Resend — transactional email delivery.
Google Maps Platform — map display and location autocomplete.

We use written agreements with these providers designed to require a comparable level of protection to what PIPEDA requires while the data is under their control. We do not sell your personal information. We only share information between members that we tell you about in-app (for example: your display name, city, and skills appear in public listings; your email and precise coordinates do not).

6. Retention

Active account data is kept while your account is open.
After account deletion, we remove your personal information within 30 days.
Consent records (see section 4) are retained for the greater of the account lifetime plus 7 years, to satisfy PIPEDA record-keeping expectations.
Anonymized transaction records (credit ledger entries stripped of personal identifiers) are kept to preserve the integrity of the community's credit history.
Basic security logs are kept for up to 12 months for abuse prevention and incident response.

7. Security safeguards

Encryption in transit (TLS 1.2+) and at rest (AES-256).
Row-level security policies on every table so members cannot read each other's private data.
Passwords are salted and hashed; we never see them in the clear.
Least-privilege access for internal operations, audit logs for administrative actions.
Screening of passwords against known breach lists (HIBP) to discourage compromised credentials.

No system is perfectly secure. We take reasonable precautions appropriate to the sensitivity of the information and continue to improve them.

8. Cookies

We use only the cookies and browser storage strictly required to keep you signed in. We do not use advertising or cross-site tracking cookies.

9. Your rights

Under PIPEDA (and Law 25 for Quebec residents) you may:

Access the personal information we hold about you.
Ask us to correct information that is inaccurate or incomplete.
Receive a portable copy of the personal information you provided.
Ask us to delete your account and the personal information associated with it (subject to the retention rules in section 6).
Withdraw your consent, at any time, going forward.

To exercise any of these rights, email privacy@sharevibes.online from the address on your account. We will respond within 30 days. There is no fee for reasonable requests.

10. Complaints

If you are not satisfied with how we have handled your personal information or a privacy request, please contact our Privacy Officer first so we can try to resolve it. You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada and, if you are a Quebec resident, with the Commission d'accès à l'information du Québec.

11. Location data

Location is optional. If you provide it, we store an approximate coordinate used to show nearby offers. Other members only see your city and a rough distance — never your precise coordinates.

12. Children

ShareVibes is for adults 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, contact the Privacy Officer and we will remove it.

13. Breach notification

If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as required by PIPEDA, and keep the required records of any such breach.

14. Changes to this policy

We may update this policy. Material changes will be announced in-app and we will ask you to re-consent where required. The current version and effective date are shown at the top of this page.

15. Contact

Privacy Officer, ShareVibes — privacy@sharevibes.online.