Privacy policy

Draft — structured for Québec's Law 25. Prepared with AI assistance, not legal advice. To be reviewed by a lawyer. Version 2026-09-28. Contact: theskillharbor@gmail.com.

1. Data we collect

We collect only what the site needs to operate:

• Accounts. When you sign in with a magic link, we store your email address (and your name if you provide one), your referral code, and who referred you. A session cookie (sh_session, valid 30 days) keeps you signed in.
• Anonymous visit counts. Each page fires an invisible beacon that records only the page path, the day, and the country — no IP address, no user agent, no cookie, no account link. Signed-in sessions are never counted. You can opt out entirely from your account page ("Statistics" checkbox) or with ?notrack=1 on any page.
• Forms. Listing reports — name, email, message content.
• Contest. Your avatar profile and entries (avatar name, public display name, bio, avatar image) and your votes (one per account per entry).
• Newsletter. Your email address if you subscribe via the footer form — every email includes an unsubscribe link.

We do not collect banking information; payments for our own services are processed by Stripe.

2. How we use it

Form submissions are used solely to review reports and to reply to you. Account data runs your account, the referral program, and the contest — public contest pages show only the display name you chose, never your email address. We do not sell personal information and do not use it for advertising.

3. Storage and retention

Data is stored on Cloudflare's infrastructure (D1 database). Reports are kept as long as needed for moderation, then deleted on request.

4. Your rights (Law 25)

You may request access to, correction of, or deletion of your personal information at any time by writing to theskillharbor@gmail.com with the subject "Law 25 request". We will acknowledge receipt within 7 days and respond within 30 days. Deletion requests are honored unless we must keep data for a legal obligation (e.g. transaction records).

5. Cookies

This site uses no advertising or tracking cookies. It does use:

• sh_session — strictly necessary session cookie (30 days) that keeps you signed in; set only after you request a magic link.
• Your language preference — stored in your browser only, never sent to our servers.

6. Security incidents

We keep an internal register of confidentiality incidents as required by Law 25. If an incident involving your personal information presents a risk of serious injury, we will notify you and the Commission d'accès à l'information as required by law.