Privacy policy

PubLocal, a sole proprietorship of Francis Bourget-Guérin ("we"), operates the publocal.ca website and the PubLocal apps for Android and iPhone, a local classifieds platform. This policy explains what personal information we collect, why, how we protect it and what your rights are, in accordance with Québec's Act respecting the protection of personal information in the private sector, as amended by Law 25.

In short

• We collect only what is needed to run the site: your account, your listings and your messages.
• We never sell your information, and we do not send advertising by email.
• Advertising and audience measurement are turned off until you consent to them.
• You can access, correct or delete your information at any time, free of charge.

1. Person in charge of the protection of personal information

The person in charge is Francis Bourget-Guérin, owner. You can reach them at confidentialite@publocal.ca for any question, request for access or correction, or complaint.

2. Information collected

• Account: email address, display name, password (encrypted, never readable by us), city (optional), introduction (optional) and chosen language (French or English). If you turn on two-factor authentication, the secret key of your authenticator app is kept by our authentication service (Supabase). If you use Google, or Facebook once that sign-in is offered (it is not yet), we receive your name, your email and your profile photo (never your password, your friends or your posts).
• Listings: the content you post (text, photos, price, city). This content is public. Only the city is recorded, never your address. Photos are reduced in your browser before they are sent, which removes their metadata, including the GPS location.
• Support requests: the subject and the messages you exchange with our team through "Contact us", and your plan at the time of the request (requests from paid plans are handled first).
• Requests to test the app: during the test of the Android app, the first name, Gmail address, city and, if you wish, phone model you give in the form of the Download the app page. They are used only to run the test: only the administration team sees them, and if your request is accepted, we write the steps to install the app to that address.
• "Verified by PubLocal" badge: if you ask for it, the way to reach you that you give (for example the link to your Facebook profile or when you are available to meet). A person from our team uses it only to check that you are the person on your profile. We do not ask for or keep any ID or screenshot. If the badge is granted, the mention "Verified by PubLocal" is public on your listings and your profile.
• Business profile (Business plan): the business name, logo, description, phone, website, business address and opening hours that you choose to enter. Everything is optional except the name. This information becomes public once approved by our team.
• Individual or business, vehicles and bikes: the "Individual" or "Business" label and, for a vehicle, its identification number (VIN) or, for a bike, its serial number if provided, shown publicly on the listing. To enforce the business rule, we count the vehicles you post over 12 months, and an automatic daily check flags to our team the accounts whose listings look like a commercial activity (no measure is taken without review by a person). The handover code and the confirmation of the sale are kept with the sale. A listing in the "Local businesses" category also shows its start and end dates.
• Seller trust card: on your listings and your public profile, in addition to your display name, your sign-up date and your reviews, we show: the "New member" label during your first 30 days, the number of your sales confirmed by handover code, your usual response time (calculated on conversations about your listings over the last 90 days, in broad ranges, from 3 conversations; the content of messages is not used), the "Two-factor authentication on" label if you turned it on, and "Business verified" for an approved business profile. Only these facts are shown: no overall score, and never a report or a measure taken by our team.
• "Wanted" posts: what you are looking for, your details, the category and the city, shown publicly with your display name for 30 days. The budget you enter is never shown or passed on to other members: it is only used to alert you to listings within your budget.
• Messages: the messages exchanged with other members through the site's messaging, about a listing or a "Wanted" post. Only the two members of the conversation can read them. Our team reads a conversation only if one of them reports it or if our anti-scam shield detects a high risk in it (see below). If you suggest a meetup in a conversation, we keep the public place chosen (or the place you wrote), the date and time, your answer, and whether the sale took place; they are used for the reminders sent to both members (the day before, 2 hours before, then 1 hour after) by notification and by email. If you suggest a place to PubLocal for the list of safe spots, we keep that place (name, address, city, type and your answers about cameras and lighting) with your account only until the team's decision: a refused place is erased entirely, an accepted place is shown without your name, and the date of each suggestion is kept for 30 days to limit abuse.
• Sales and reviews: when a seller marks a listing as sold, they can name the buyer among the members who wrote to them; we record the listing's title, the date and both members. The buyer can then leave a review of the seller (from 1 to 5 stars, with an optional comment). The review is public: it is shown with its author's display name and the listing's title on the seller's profile. A seller's profile also shows their average rating, their number of sales and their sold listings.
• Favourites and alerts: the listings you keep in your favourites, and your alerts (category, keywords, city and radius, how you want to be notified). Your favourites are visible only to you; the advertiser only sees how many members saved their listing, never who.
• Android and iPhone apps: if you accept notifications, a token that identifies your device to the notification service (it contains neither your name nor your phone number), as well as the alerts you create. Photos are reduced in the app before they are sent, which removes their metadata, including the GPS location. The app keeps your sign-in session, your theme (light or dark) and your language on your phone; they are erased when you sign out (the session) or uninstall the app.
• Reports and blocks: the reason and the details of a report, and the list of members you have blocked. The reported or blocked member does not know who reported or blocked them. In each member's file, our team keeps the history of the reports about them (made by members or by our automatic shields), with the date, the reason, the title of the listing or conversation concerned and the team's decision, as well as the history of the reports they made (to detect false reports). This history is never shown to members.
• Deleted items: when you delete a listing, a "Wanted" post or a review, a copy is kept for 30 days, visible only to our team, then erased (see section 6).
• Payments: payment for plans is processed by Stripe, which receives your name, your email and your card information. We neither receive nor keep your card number. We keep your Stripe customer ID, your plan and its dates (start, renewal, end), as well as the date on which you confirmed being 18 or older.
• Technical data: IP address, browser type and security logs, to prevent fraud and abuse. Our authentication service (Supabase) keeps a sign-in log that may contain your IP address; the rest is in our hosts' technical logs. The sign-in log is erased automatically after 90 days.
• Listing statistics: we count the number of views of each listing, without cookies and without information about you, to show statistics to the advertiser. So that the same visit is not counted twice, a short marker (publocal:vue:…) is kept in your browser until the tab is closed; it is never sent to our servers.
• QR codes (posters and stickers): when you arrive by scanning the QR code of a poster printed by a member or of a PubLocal sticker, we count the visit, without cookies and without information about you. Your browser keeps for 7 days a short marker (publocal:qr-source) that only says which poster or sticker was scanned. If you create an account during those 7 days, we record with your account which poster or sticker brought you, to know which posters work. The member who printed the poster only sees numbers (scans and sign-ups), never who you are. This information is deleted with your account.

What you can refuse. The city and the introduction on your profile are optional: you can leave them empty without losing any feature. You can refuse advertising and audience measurement cookies without any consequence on your use of the site. Signing in with Google, with Apple (iPhone app) or with Facebook (once it is offered) is optional: you can create an account with your email only. The app's notifications are optional: you can refuse them or turn them off in the phone's settings without losing any other feature. Without an email address, we cannot create an account, since it is used to identify you and to reach you about your listings.

3. Why we use it

• To create and secure your account, and to let you post listings.
• To let members contact advertisers through the site's messaging.
• To protect members against fraud (anti-scam shield): some messages are analyzed automatically by artificial intelligence, when they are sent, to detect known scams (request for a code received by text message, payment in advance, fake payment link, etc.). The messages analyzed are the first messages of each conversation, messages from accounts less than 30 days old and those that mention payment, links or contact details. The result is used only to show a warning to the person who receives the message and, in case of high risk, to alert our team. No message is blocked or deleted automatically, and no decision about your account is made without a person on our team reviewing the conversation.
• To detect reused photos: for each listing photo, we calculate a fingerprint (a short code that summarizes how the image looks, without AI or an outside service) and compare it with those of other members' photos, to detect fraudsters who take the photos of another listing. Only our team sees the result, and no listing is removed automatically for this reason. Fingerprints are erased 12 months after the photo is deleted (the photo itself is erased right away, except for the copies kept for 30 days after a listing is deleted, section 6).
• To protect members against fraudulent or prohibited listings (listing shield): each listing, and each change to its text, price or photos, is analyzed automatically by artificial intelligence. The result is shared only with our team. A listing already online that is judged very risky is taken off the site and sent back for review until a person on our team examines it; only that person can refuse it or put it back online. You are notified by email. You can ask to know the reasons for this review and submit your observations by writing to our team.
• To write to you about your account and your listings: address confirmation, forgotten password, listing approved, refused or sent back for review, listing expiring soon, end of a reduced price, end of a paid plan, account suspension and reactivation, account deletion scheduled or cancelled, business profile approved, refused or removed, request to switch to the Business plan, answer to a support request, new message from the PubLocal team (never the text of the message), two-factor authentication turned on, turned off or reset, reminders of an accepted meetup, listings that match your "Wanted" posts (at most once a day), invitation to leave a review after a purchase, new review received, welcome email when the account is opened, unread messages waiting for you (at most once a day, never the text of the messages; you can stop it in your account or with the link in the email). For paid services: confirmation and contract of each purchase, plan change, renewal stopped or resumed, reminders before the end of a period or before a price increase, payment declined, refund and end of the subscription. We do not send advertising by email.
• With your permission, in the Android or iPhone app: to send you notifications. New message (with the sender's name and the listing's title, never the text of the message), listing approved or refused, new listing that matches one of your alerts or one of your "Wanted" posts, "Wanted" post approved or refused, price drop on a favourite, meetup reminders, meeting spot you suggested accepted, invitation to leave a review after a purchase and new review received.
• Only at your request: to send you a daily email with the new listings that match your alerts. You can stop at any time in "My alerts".
• To show buyers' reviews on sellers' profiles, to help members buy with confidence.
• To moderate content, handle reports and prevent fraud. So that a fraudster cannot erase their tracks, our team keeps each member's report history and, for 30 days, a copy of what is deleted; so that a suspended member cannot simply come back under a new account, a short anti-fraud record is kept for 2 years after their account is deleted (section 6).
• To bill paid services and meet our tax obligations.
• Only with your consent: to show advertising and measure audience.

We never sell your personal information. If we wanted to use it for a purpose other than those listed here, we would first ask for your consent, except in the cases provided for by law.

Automated processing

We do not do advertising profiling, and no final decision about you (refusal or deletion of a listing, suspension or closing of the account) is made without review by a person on our team. Some temporary measures or fixed rules do apply automatically, however:

• a listing reported by three different members is hidden until the team checks it;
• listings posted with the Free plan wait for the team's approval before they are visible;
• a listing online that the shield (artificial intelligence) judges very risky is taken off the site and sent back for review; you are notified by email;
• a new account may start at most 5 conversations during its first 48 hours (except paid plans);
• a daily check flags to the team the accounts whose listings look like a commercial activity; only the team then decides whether to write to you;
• an account created with the same email, or a business profile registered with the same phone, as an account that was suspended and then deleted is flagged to the team; only a person on the team decides whether it is the same person and whether to act;
• at the end of a subscription, your most recent listings stay online up to the limit of your new plan and the others are paused, without being deleted;
• if a payment is declined, the plan's benefits are suspended until payment.

For any measure taken automatically about you, you can write to us to learn the information used, the reasons and the main factors that led to it, have that information corrected, and submit your observations to a person on our team, who can review the measure. The display order of results depends on the advertiser's plan, then on chance; it does not depend on your browsing habits.

4. Cookies and advertising

Essential cookies (sign-in, security, display preference) are always on. A session cookie also sets the display order of listings during your visit, so that pagination stays consistent; it is not used for any tracking and is erased when the browser is closed. Advertising (Google AdSense) and audience measurement cookies are turned off by default and are turned on only if you consent to them. You can change your choice at any time with the "Manage cookies" link at the bottom of each page.

If you accept advertising, Google may choose ads based on the content of the page and on your interests, inferred from your browsing on other sites. Without your consent, no advertising cookie is set and no Google ad is loaded. Google processes this information in the United States, under its own privacy rules.

Cookies used

• Sign-in (Supabase): session cookies that keep you signed in and secure your account; essential.
• publocal_consent: remembers your cookie choice; 12 months; essential.
• pl_seed: sets the display order of listings during your visit; session; essential.
• publocal-google-oauth: protects the sign-in with Google while it takes place; 10 minutes; essential.
• Display preference (light or dark): kept in your browser (publocal-theme); essential.
• Google (advertising): set by Google, under its rules, only with your consent.
• Audience measurement (Cloudflare Web Analytics): no cookie; the script is loaded only with your consent. It counts visits and page views without identifying you and without tracking from one site to another.

Google advertising

If you accept advertising cookies, third-party vendors, including Google, use cookies to show ads based on your previous visits to PubLocal or to other sites. You can turn off personalized advertising in Google's ad settings, or turn off the use of cookies by some third-party vendors at aboutads.info/choices and, in Canada, at youradchoices.ca. To learn more about how Google uses data, see policies.google.com/technologies/partner-sites. If you refuse, no Google ad is loaded.

5. Disclosure to third parties and hosting

We use suppliers that process information on our behalf:

• Supabase (database, authentication, photo storage) — data hosted in Québec (Montréal); the company Supabase, based in the United States, may access it for technical support;
• Netlify (site hosting) — servers in the United States and a global delivery network;
• Resend (sending emails) — servers in the United States (Virginia);
• Stripe (payments and invoices) — may process information in the United States;
• Google (sign-in with Google and, with your consent, advertising) — processing in the United States;
• Apple (iPhone app: sign-in with Apple, only if you choose it, and delivering notifications to iPhones; if you choose to hide your email, Apple gives us a relay address that forwards our emails to you) — processing in the United States;
• Meta Platforms (sign-in with Facebook, only if you choose it; it is not offered yet) — processing in the United States;
• Anthropic (artificial intelligence, which does not use this data to train its models): (1) "Fill in with AI", only when you use it: small versions of at most 3 photos, without your name or your email, to suggest the title, the description, the category and a price; (2) anti-scam shield: the text of the message analyzed and of the few messages before it, the listing's title and price and the age of the sender's account, without name or email; (3) listing shield: the listing's title, description, price, category, city, website and first photo, and the seller's plan and account age, without name or email — processing in the United States;
• OpenStreetMap (base map of the Meeting spots page): your browser downloads the map images directly from its servers, which receive your IP address and the address of the page, without your name or your account — OpenStreetMap Foundation, based in the United Kingdom, global delivery network;
• Cloudflare (protection against bots on the sign-in and sign-up forms and, with your consent, cookieless audience measurement) — global network, company based in the United States;
• Google Firebase Cloud Messaging (delivering the Android app's notifications to phones) — processing in the United States;
• Google Firebase Crashlytics (crash reports for the app: phone model and version, app version, location of the error in the code and a random installation ID; never your name, your email or the content of your listings or messages) — processing in the United States, kept for 90 days.
• Google Groups and Google Play (test of the Android app): if you become a tester, you join our Google testers group yourself with your Google account, and Google Play gives you access to the test app — processed in the United States, under Google's rules.

These suppliers therefore process some information outside Québec. Before such a transfer, we carry out a privacy impact assessment. We give them only the information needed for their service. When your information is processed outside Canada, it is subject to the laws of those countries and may be disclosed to the authorities of those countries in accordance with those laws.

6. Retention and destruction

• Account and profile: as long as your account exists.
• Listings and photos: until you delete them, or until your account is deleted. An expired listing stays in your account so that you can renew it, but is no longer visible to the public.
• Business profile: as long as your account exists. At the end of the Business plan, the page is no longer visible, but your information is kept so that it can come back if you take this plan again. To have it erased, write to us or delete your account.
• Messages: a conversation is deleted 14 days after the listing or the "Wanted" post ends (removed, expired, sold or found). If it was reported or the anti-scam shield detected a risk in it, a copy is kept for 30 more days, visible only to our team, then erased.
• Support requests: an answered request is closed after 30 days without a new message, then deleted 1 year after the last message.
• Requests to test the app: erased 30 days after a refusal, and at the latest 1 year after the request. To leave the Google testers group, do it on groups.google.com or write to us.
• "Verified by PubLocal" badge: the way to reach you is erased as soon as we answer; the request itself (date and answer) is erased 30 days later. The badge stays on your profile as long as your account exists, unless we remove it.
• Reports: the team's work list keeps a report until it is handled, then for 1 year. Each member's report history (section 2) is kept as long as their account exists, even if the listing or conversation concerned is deleted, and it is erased with their account.
• Deleted items: a listing (with its small photos, and its full-size photos if it had been reported), a "Wanted" post or a review that you delete is kept for 30 days, visible only to our team, to investigate in case of fraud, then erased automatically. You no longer see them in your account.
• Anti-fraud record: only if your account had been suspended by our team when it was deleted. We then keep, for 2 years: your email and, where applicable, the phone of your business profile, in hashed form (turned into a code that makes it possible to recognize the same address, but not to read it), the reason and date of the suspension, and the number of reports received per reason. This record, visible only to our team, is used only to detect a new account of the same person; it is then erased automatically. It remains personal information: you can exercise your rights over it (section 7).
• Notification tokens: erased when you sign out of the app, when the notification service indicates that the device is no longer valid, after 180 days without using the app, or when your account is deleted. The record of notifications sent is kept for 30 days.
• Alerts (followed categories) and favourites: until you delete them, or until your account is deleted. A favourite also disappears when the listing is deleted.
• Sales and reviews: as long as the seller's and the buyer's accounts exist. If the buyer deletes their account, the sale stays in the seller's account, without the buyer's name. You can delete your review at any time; our team removes a review that breaks the rules. A review is erased when its author's or the seller's account is deleted.
• Emails sent: the record of their sending is kept for 90 days.
• Shields and automatic rules: the result of a message's analysis is kept for 30 days (the warning shown stays with the message); the shield's opinion on a listing is kept with the listing. The record of vehicles posted is erased after 12 months, and the count of "Fill in with AI" suggestions after 2 months.
• IP addresses and technical logs: kept by our hosts for a few days at most, then erased automatically. Our authentication service's sign-in log is erased after 90 days.
• Invoices and payments: kept for 6 years after the year concerned, as required by tax laws, in our Stripe account and in our records; after your account is deleted, we keep only those records.

You can delete your account yourself, in My account on the site or in the app's Account tab; the steps are on the account deletion page. As soon as you ask, your listings and your profiles are hidden, and you can cancel for 30 days by signing in again. After that period, your account, your profile, your listings and their photos, your conversations, the history of the reports about you, your deleted items kept for 30 days, your alerts, your favourites, the reviews you gave or received and your notification tokens are permanently erased from our database and our storage: your listings do not stay online, even anonymously. The reports you made stay in the file of the member concerned, but without your name. A last email confirms the deletion; your address is kept only long enough to send it. Only the information the law requires us to keep (for example, invoices) is kept, for the required period, and, if your account was suspended, the anti-fraud record described above, for 2 years. Our host's automatic backups are replaced on its own cycle, and we never restore a deleted account.

7. Your rights

• Access your information and obtain a copy of it, including in a structured technological format;
• Have inaccurate, incomplete or equivocal information corrected;
• Withdraw your consent and ask for the deletion of your account;
• Ask us to stop disseminating information about you, or to de-index a link to it, when its dissemination breaks the law or causes you harm;
• File a complaint with the Commission d'accès à l'information du Québec.

Make your request in writing to confidentialite@publocal.ca. These requests are free. We may ask you to confirm your identity. We answer in writing within 30 days; without an answer within that time, the request is deemed refused. You can obtain your information in a structured, commonly used technological format (for example JSON or CSV), or ask us to send it directly to a person or an organization you designate. If we refuse your request, we give you the reasons. You can then ask the Commission d'accès à l'information to examine the disagreement, within 30 days of the refusal or of the end of the time allowed to answer.

8. Security and incidents

Exchanges are encrypted (HTTPS), access to data is limited by strict rules enforced by the database itself, and passwords are encrypted. In case of a confidentiality incident presenting a risk of serious injury, we will notify the people concerned and the Commission d'accès à l'information (and, when federal law applies, the Office of the Privacy Commissioner of Canada), and we keep a register of all incidents.

Who has access to your information. The owner, Francis Bourget-Guérin, who handles administration and moderation, has access to accounts, listings, reports and to a conversation only when it is reported by one of its members or the anti-scam shield detects a high risk in it (section 3), as well as to the report history, the deleted items kept for 30 days and the anti-fraud records (section 6). If other people join the moderation, they will have access only to listings and to content reported or detected in the same way, as well as to these files, and will be bound by a confidentiality agreement.

Our internal rules (governance). The person in charge of the protection of personal information approves our internal rules and ensures they are followed. These rules provide in particular for retention periods and the secure destruction of information (section 6). They also provide for a privacy impact assessment before any new information system and any disclosure outside Québec, as well as a register of all confidentiality incidents. To complain about how we handle your information, write to confidentialite@publocal.ca describing the situation. We acknowledge receipt, examine it and answer you in writing within 30 days. If the answer does not satisfy you, you can contact the Commission d'accès à l'information.

9. Minors

You must be 14 or older to create an account. We do not offer a parental consent mechanism: a person under 14 therefore cannot sign up. If we learn that an account belongs to a person under 14, we close it and delete their information. A parent or guardian can write to us at confidentialite@publocal.ca. People aged 14 to 17 can consent themselves to the use of their information, as provided by law. Paid services are reserved for people 18 and older.

10. Changes

We may change this policy. Any change is published on this page with its date. We also notify you with a message on the site and, if the change is significant (for example a new purpose or a new supplier outside Québec), by email before it takes effect.