This Privacy Policy describes how Muskoka Research Inc. ("we," "us," or "our") collects, uses, and shares information about you when you use Nibi Metrics (the "Service"). We aim to be straightforward: we collect what we need to provide the Service, and not much more.

This Policy applies to all users of the Service across Canada. We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), the federal Canadian privacy law that governs how private-sector organizations collect, use, and disclose personal information in the course of commercial activities. Where provincial privacy laws apply additional or stricter requirements (for example, Quebec's Act respecting the protection of personal information in the private sector, Alberta's PIPA, or British Columbia's PIPA), we work to comply with those as well.

By using the Service, you agree to the practices described here. If you do not agree, do not use the Service.

1. Information We Collect

Information you provide

• Account information: Email address and password (passwords are hashed, never stored in plain text)
• Profile preferences: Your favourite lakes, alert configurations, units (metric/imperial), and other settings you choose
• Payment information: For Premium subscriptions, payment details are collected and stored by our payment processor, Stripe. We do not store your full credit card information on our servers — only a customer reference ID and subscription status returned by Stripe
• Communications: If you email us for support, we retain that correspondence to assist you

Information collected automatically

• Usage data: Pages or features viewed, approximate timing, and basic interaction patterns (used for service improvement, not for advertising)
• Device and connection data: Browser type, operating system, IP address, and approximate region (used for security and to ensure compatibility)
• Authentication tokens: Stored in your browser to keep you signed in (similar to a session cookie)
• Anonymous preview session: When you first visit, we assign a temporary anonymous identifier so we can track your free preview time. This identifier is automatically deleted within 30 days of inactivity

2. How We Use Information

We use the information we collect to:

• Provide and maintain the Service
• Authenticate your account and personalize your experience
• Process payments and manage subscriptions
• Deliver alerts you have configured
• Send transactional emails (account confirmations, password resets, billing notifications, alert deliveries)
• Diagnose technical issues, prevent abuse, and improve the Service
• Comply with legal obligations

We do not sell your personal information. We do not use your information for behavioural advertising or share it with advertisers.

3. Who We Share Information With

We share limited information with the following service providers, only as needed to operate the Service:

Provider	Purpose	What's shared
Google Firebase (Authentication, Firestore, Hosting, Cloud Functions)	Account authentication, application database, hosting	Email, hashed password, profile data, usage logs
Stripe	Payment processing for Premium subscriptions	Email, payment method (entered directly with Stripe), subscription status
Environment and Climate Change Canada	Source of public water level and weather data	No personal information is sent to ECCC
Email delivery service	Future: sending alerts and transactional email (not yet active)	Email address and alert content (when this feature launches)

We may also disclose information when we believe in good faith that disclosure is required by law, court order, or other legal process, or to protect the rights, property, or safety of Muskoka Research Inc., our users, or others.

4. Where Your Data Is Stored

Your data is stored on Google Cloud Platform infrastructure, primarily in data centers located in the United States (region: us-central1). By using the Service you consent to your information being transferred to and processed in the United States.

The United States has different data protection laws than Canada or the European Union. Google Cloud is contractually committed to maintaining appropriate security and is certified under various international frameworks.

5. Cookies and Tracking

We use a minimal set of browser storage mechanisms:

• Authentication tokens stored in localStorage to keep you signed in
• Preference data stored locally so we can remember your settings between visits
• Anonymous session identifier for the free preview period

We do not use third-party advertising cookies, retargeting pixels, or behavioural analytics tools that build profiles of individual users. We may use Google's Firebase Analytics or similar aggregated, non-identifying analytics in the future; if we do, we'll update this policy.

6. Your Rights

You have the following rights with respect to your personal information:

• Access: View the personal information we hold about you (available in your account settings)
• Correction: Update inaccurate information through your account settings or by contacting us
• Deletion: Delete your account and associated personal information at any time through the "Delete account" option in your account settings. Deletion is immediate and irreversible
• Portability: Request a copy of your data in a structured format by emailing us
• Withdrawal of consent: Stop using the Service and delete your account if you no longer consent to our practices
• Complaint: If you are a Canadian resident, you may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca

To exercise any of these rights, contact us at info@muskokaresearch.com.

7. Data Retention

We keep your personal information only as long as needed to provide the Service or as required by law:

• Account data (email, profile, favourites, alerts): retained while your account is active. Deleted immediately on account deletion.
• Anonymous preview sessions: automatically deleted within 30 days of inactivity.
• Billing records: retained as required by Canadian tax and corporate record-keeping laws (typically 6-7 years).
• Support correspondence: retained for up to 2 years after the conversation ends, then deleted.
• System logs: typically retained 30-90 days for security and debugging.

8. Security

We use industry-standard security practices to protect your information:

• HTTPS encryption for all traffic to and from the Service
• Passwords are hashed using Firebase Authentication (bcrypt-based hashing)
• Payment data is handled by Stripe, which is PCI-DSS Level 1 certified — we never see your full card number
• Administrative access requires both account credentials and additional authorization
• Data at rest in Google Cloud is encrypted

No system is perfectly secure. If you suspect your account has been compromised, contact us immediately at info@muskokaresearch.com.

9. Children

The Service is not directed at children under 18. We do not knowingly collect personal information from individuals under 18. If you believe a child has provided us with personal information, please contact us so we can delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top and, where reasonably possible, notify you by email or within the Service.

Your continued use of the Service after a change becomes effective constitutes acceptance of the updated policy.

11. Contact

For questions, concerns, or requests regarding this Privacy Policy or your personal information, contact:

Muskoka Research Inc.
Email: info@muskokaresearch.com