Last updated: 2026-08-31

Privacy Policy

PermitIndex (“we,” “us,” or “our”) operates permitindex.ca. This policy explains what personal information we collect, why we collect it, and your rights under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

This policy will be reviewed by a Canadian privacy/IP lawyer before the public launch of PermitIndex (Phase 3). Until that review is complete, treat this as a working draft.

1. What we collect

A. Your account information

• Email address: used to create your account and deliver alert digests. Required.
• Consent record: timestamp, IP address, and exact wording of the opt-in consent you gave when creating an alert. Required for CASL compliance.
• Saved searches: the trade × area × value filters you configure. Stored to run your daily alerts.

B. Permit data (not personal information about you)

We display Toronto Building Permit records from the City of Toronto Open Data portal. This data consists of property addresses, estimated construction values, work types, and dates. We do not store or display any contractor or owner names: v1 intentionally excludes those fields because they are ~95% blank in the source data and raise different privacy considerations.

C. Technical logs

Standard server access logs (IP, user-agent, timestamp) for security and debugging. Retained for 30 days. We never log magic-link tokens or session JWTs.

D. Cookies and analytics

Every page on permitindex.ca loads Google Analytics 4 (measurement ID G-NJGV3S7HR4), a service run by Google. It reports how the site is used: which pages were viewed, the link you arrived from, an approximate location worked out from your IP address, and your browser, device type and language. Google receives your IP address as part of this. We use it only to see which pages are worth keeping and improving. We run no advertising tags, no retargeting pixels, and no other tracking script.

These are the cookies this site sets:

• _ga and _ga_*: set by Google Analytics to tell one browser apart from another across visits. Analytics only.
• sb-*-auth-token: set only once you sign in. It holds your session so you stay signed in between pages. Strictly necessary for an account; it is never set for signed-out visitors.

You can refuse the analytics cookie through your browser settings, through any content blocker, or with Google's own opt-out add-on at tools.google.com/dlpage/gaoptout. Blocking it changes nothing about how the site works for you. The analytics data itself lives in Google's systems, not ours, and is kept for as long as Google's own retention settings and policies provide. We do not control that period and so do not state one here. Google describes its handling of the data at policies.google.com/privacy.

E. Map tiles

Pages that draw a permit map pull their background map tiles from OpenFreeMap (tiles.openfreemap.org). Loading a map sends your IP address and the tiles you are viewing to that service. No account information goes with it, and pages without a map make no request to it at all.

2. Why we collect it

• To operate the service: auth (magic-link sign-in), storing your saved searches, running the daily alert engine, and gating features to your plan.
• To send you the daily digest: only if you have expressly opted in and created a saved search. This is the core product feature.
• To comply with CASL: we log consent so we can demonstrate it on demand.
• To see how the site is used: the Google Analytics measurement described in section 1D, so we know which pages are worth keeping and improving.

The only email we ever send you is a sign-in link you asked for and, if you ticked the opt-in box, the alert digest for a search you created. We send no marketing or promotional email, and we never give your address to anyone else to email you. Every digest carries a one-click unsubscribe link, and you can also switch alerts off from your account alerts page.

3. Who we share it with

• Supabase: database and authentication provider, holding your email address, saved searches and consent record (servers in the USA; Supabase is SOC 2 Type II certified).
• Resend: email provider for sign-in links and the alert digest. Resend also reports delivery events back to us (delivered, bounced, marked as spam) and we store those so that we stop emailing an address that bounces or complains.
• Vercel: hosting provider for the site (Next.js app), which handles every request you make and keeps the server access logs described in section 1C.
• Google, as Google Analytics: receives the usage and device information set out in section 1D, including your IP address, on every page you view. This happens whether or not you have an account.
• Google, as the Geocoding API: converts City of Toronto permit addresses into map coordinates inside our data pipeline. Only permit addresses are sent to it. No account information and no visitor information goes with them.
• OpenFreeMap: serves the background map tiles and receives your IP address when a map loads, as set out in section 1E.

Your information is stored and processed outside Canada. All of the providers above operate on servers outside Canada, including in the United States. Information held in another country can be reached by the courts, law enforcement and national-security authorities of that country under its own laws, and those protections differ from Canadian ones. If you would rather your usage data did not leave Canada, you can block the analytics cookie as described in section 1D. Every permit page, hub page and blog article on this site can be read without an account.

We do not sell, rent, or trade your personal information. We do not share it with advertisers.

4. Retention

We retain your account data (email, consent record, saved searches) for as long as your account is active. If you delete your account, we delete your profile, saved searches, alert history, and consent record within 30 days. Some data may be retained longer in encrypted backups for up to 90 days, after which it is purged.

Two things sit outside that cycle. Server access logs are kept for 30 days (section 1C). If your address hard-bounced or you marked a digest as spam, we keep that single fact on a suppression list after deletion, because it is the only way to be sure we never mail the address again. Analytics data is held by Google rather than by us and is kept for as long as Google's own retention settings provide (section 1D).

5. Your rights

Under PIPEDA, you have the right to:

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct inaccurate information.
• Deletion: delete your account from your account settings page, which removes your personal information. You may also email us to request deletion.
• Withdraw consent: unsubscribe from alert emails at any time using the link in any digest email or from your account alerts page. Withdrawal stops future sends within one business day.

6. Security

We use HTTPS for all traffic, database-level Row-Level Security (Supabase RLS) so that each user can only read their own data, and server-side enforcement of all data access gates. Payment data never touches our servers. We use standard security headers (HSTS, Content-Security-Policy, X-Content-Type-Options).

If we become aware of a security breach that poses a real risk of significant harm to you, we will notify the Office of the Privacy Commissioner of Canada and affected individuals as required by PIPEDA.

7. Permit data and PIPEDA

Toronto Building Permit records are public data published by the City of Toronto under the Open Government Licence – Toronto. By design, v1 stores and displays only property addresses, permit values, work types, and dates: no individual names. We operate a takedown process (see our data sources page) for anyone who believes a specific address should be suppressed. Our privacy posture on this data is designed around PIPEDA's publicly-available-information exception and the Globe24h.com(2017 FC 114) precedent, and will be confirmed by Canadian counsel before PermitIndex's public launch (Phase 3). Consult yevh.kuznietsov@gmail.com with any concern about a specific record.

8. Contact

Privacy questions, access requests, correction requests, or complaints:

9. Changes

We will update this policy before the public launch following the lawyer review (Phase 3). Material changes will be emailed to account holders before they take effect.

Contains information licensed under the Open Government Licence – Toronto.