Privacy

The short version

• The public site never shows a name, a face, an exact address, an age, a licence plate or a business name.
• Reading the site collects nothing about you beyond ordinary server logs, and we set no advertising or tracking cookies.
• Private logs record reports immediately. Public counts, costs and measures from businesses or partners appear only once three distinct contributors exist on a block or zone.
• You can ask us to delete anything you gave us, a reporter can delete everything from the report page, and every email we send has a one-click unsubscribe.

Reading the site

Our hosting provider (Cloudflare) records ordinary request logs, such as IP address, browser type and the pages requested, for security and performance. These logs are not used to build profiles and are kept for a short period. The site uses no analytics service and no third-party cookies. The report page keeps a sign-in token in your own browser for six months, renewed on each visit, so you do not have to request a new link each time; it stays on your device and you can clear it with "Sign out on this device". The link in a sign-in or summary email works for 14 days.

People who appear in public records

Source documents sometimes name people who were arrested or charged, and sometimes include ages or descriptions. We do not publish any of that. Every record passes two privacy checks. The first is a deterministic scan for names, ages and youth descriptors, civic addresses, licence plates, phone numbers and email addresses. The second is a separate model call whose only job is to look for anything that could identify a person or a business, including descriptions the scan cannot catch. If either check fires, the record is published without its free-text location detail; the structural record (type, block, date, stage) still publishes. Locations are reduced to the hundred-block. Records involving a young person are published at week precision without a block. No person reviews records before publication; the rules are on the methodology page, and "held back" on this site means a record the rules discarded. If you believe a record identifies you, email hello@communityledger.ca; the operator removes it while it is checked and the removal is logged.

We keep private copies of the source documents as they were when we read them. They are stored on Cloudflare's network with access limited to the operator, are never published, and exist so that any record can be traced back to its source and so that a takedown can be verified.

Businesses and residents that report incidents

To report an incident a business or resident gives us an email address, a business name (or their own name), a street address, a category, and for each report a date, an incident type, an optional cost, optional hours lost, an optional description, an optional police file number, and optional photos. This is personal information under Canada's Personal Information Protection and Electronic Documents Act, and we collect it with your consent for one purpose: to build block-level, anonymous statistics about public safety and disorder and its cost, and to send you back what the ledger shows for your block.

• Published only once three distinct contributors exist on a block or zone: block-level counts, costs and measures from businesses or partners.
• Never published, never shared, never sold: your name, business name, address, email, description, police file number and photos.
• Photos have their hidden camera data (location, device, timestamps) removed before storage, are stored privately in Cloudflare R2 on Cloudflare's network, are seen only by the operator, and are deleted after seven years at the latest.
• Your report is recorded in your private log as soon as you submit it. No person reads it first; automated guards (a confirmed email, a plausible date, at most ten reports in thirty days) stand in for a reviewer. Public counts, costs and measures remain hidden until the three-contributor threshold is met. The operator can remove a report, and every such action is logged.
• Your email is used only for the sign-in link, the summary we send after you submit a report, the receipt for a report you email us, the nightly block alert if you switch it on (one click in any alert stops it), and replies to your questions. No newsletters unless you ask. Every email says how to stop.
• A report you email us is kept as the message you sent, privately, so the record can be traced to it; it is deleted with everything else when you delete your data.
• Deletion: use "Delete all my data" on the report page or email us. Your name, address and email are erased, your reports stop counting immediately, your photos are deleted, and the audit log keeps a record of the deletion with your email replaced by a hash.

Licensees who receive data under a written agreement receive block-level figures only, never a business's identity, and must apply our corrections and deletions.

The weekly email

If you sign up for the weekly email we keep your address, the street or block you chose, the consent wording you saw, and the time and network address of the sign-up and confirmation, as Canada's anti-spam law requires. Nothing is sent until you click the confirmation link. Every email has a one-click unsubscribe link that takes effect immediately and needs no sign-in; you can also ask us to erase your address entirely. We never share the list.

Where data lives and who can see it

The site runs on Cloudflare's network. The operator is the only person with administrative access; every administrative action is written to an audit log. We use an AI model provider (OpenAI) to read source documents and extract facts; source text is sent for that purpose only and the provider does not train on it under our agreement. The description you type into the report form is not sent to any model. A quick report is: the few words you email to our report address from your registered address, or type into the quick box on the report page, are sent to the model once so it can fill in the form's fields; the model is instructed to keep no name, address or other identifier in the one-line note it returns, a second check removes any it missed, and the note stays private like the rest of your report.

We measure how the site is used with Google Analytics 4, configured for a public-record site: no advertising features, no ad personalization, and Google does not store visitor IP addresses. What we see is which pages and blocks are looked at, which selectors are used and whether a report or sign-up was completed, never who did it: no email, address, business name, file number or sign-in link is ever sent to analytics.

Your rights

You can ask what we hold about you or your business, ask us to correct it, withdraw consent, or ask us to delete it. Write to hello@communityledger.ca. We answer within ten business days. If you are not satisfied you can complain to the Office of the Privacy Commissioner of Canada.

Changes

We will post changes here with a new effective date. Substantive changes to how business reports are used will be emailed to businesses that have reported.