Scope
This policy describes how CanadaPath handles information in its mobile app, website, and the services that support them. CanadaPath provides independent immigration information and is not affiliated with the Government of Canada.
Information we process
- Website: our hosting and security providers process connection information such as IP address, browser information, request time, and requested resource to deliver and protect the site. The dashboard uses Google Firebase App Check and reCAPTCHA Enterprise to distinguish legitimate requests from abuse.
- Website preferences and security storage: your Light, Dark, or System choice and your analytics choice are saved in local browser storage. Firebase App Check may save a security token in browser storage, and reCAPTCHA Enterprise may use cookies or similar storage to protect data requests. Draw searches and filters are used in the current page session. Local visit markers remember which published draws and updates this browser has seen, separately for Express Entry and Alberta. Clearing browser storage resets these markers.
- Optional browser alerts: when available and enabled by you, Express Entry alerts use Firebase Cloud Messaging. We store an anonymous installation identifier, a hashed installation credential, the website origin, notification delivery address, and opt-in state on the server. This browser stores its installation credential and alert preference to manage registration and unsubscribe. No account is required. Turn alerts off in the website menu before clearing browser storage, or revoke notification permission in browser settings.
- Mobile installation: the app registers an installation identifier and credential. The backend may hold a notification delivery identifier, device model, app and OS versions, locale, time zone, nickname, language preferences, and last activity time.
- Personalization and alerts: if you use these features, we process your saved CRS score, selected province, notification preferences, and alert conditions such as programs, categories, score ranges, and minimum invitations. Delivery records support notification reliability and prevent duplicate alerts.
- Mobile crash diagnostics: The iOS app uses Firebase Crashlytics to diagnose crashes and improve reliability. Reports can include crash stack traces, app version and build, device and operating-system information, and a crash-reporting installation identifier. Google processes these reports through Firebase. When mobile Analytics is enabled, reports may also include app event breadcrumbs. App code does not attach notification tokens, developer diagnostic identifiers, or custom user IDs to crash reports. This crash reporting applies to the iOS app, not the website.
- Mobile usage analytics: The mobile app uses Google Analytics for Firebase to understand app usage and improve the service. This includes automatic app/session events and fixed screen and action labels for viewed sections, draw details, charts, comparisons, filters, and source links. Google processes associated app/device information through its SDK. Our custom engagement events do not include search text, selected filter values, CRS scores, article URLs, notification tokens, installation credentials, or signed purchase payloads. The website’s Analytics choice controls website Analytics; it does not change mobile collection.
- Purchase analytics: After Apple verifies an eligible production purchase, the app passes the verified transaction to Firebase’s purchase analytics API to measure subscriptions. This is separate from verification of subscription access. Apple handles payment details; CanadaPath does not receive full payment card numbers.
- Feature requests: If you submit a feature request, we process the text you provide and associated installation information to receive and review feedback. The submitted title and description, together with app version and build information, are sent to GitHub as an issue for the developer to review. Avoid including sensitive personal information in free-text submissions.
- Advertising: free mobile users may see a labeled Google AdMob banner after the Home content. Plus subscribers do not see app ads. Production website advertising is currently paused. When ads are enabled, Google and its advertising partners may place or read cookies and use IP addresses, device and browser information, and identifiers to serve and measure ads, subject to your choices and applicable law.
- Subscriptions: we process store transaction identifiers, product, subscription status, and renewal, expiry or revocation information to verify access. Apple handles App Store payment details; CanadaPath does not receive your full payment card number.
How information is used
We use this information to deliver public immigration data, remember settings, match requested alerts, send permitted notifications, verify subscription access, diagnose errors, and prevent fraud or misuse. The website does not offer account registration or purchases. Optional browser alerts require your opt-in and a supported browser.
Optional device permissions are controlled by your operating system. You can use public website information without a mobile subscription. Some mobile features require a verified subscription.
On the password-protected staging website, Google Publisher Tag may load sample advertisements from Google’s test inventory. These requests share network and page-request information with Google. We request limited ads; staging does not use our production AdSense publisher inventory.
Service providers and links
CanadaPath uses Google Firebase and Google Cloud for hosting, app verification, and mobile notification delivery, and Google AdMob and AdSense when advertisements are enabled, and hosted PostgreSQL infrastructure through Supabase for backend records. Apple provides App Store purchases and the Apple push notification service. GitHub receives feature-request submissions as issues for the developer to review.
These providers may process information outside your province or country, subject to the laws where processing occurs. We may disclose information when legally required or to protect the service and its users. Opening an official source or other external link takes you to that provider’s service and privacy practices.
See Google’s Privacy Policy, Google’s Terms of Service, Supabase’s Privacy Policy, and Apple’s privacy information.
Read how Google uses information from sites or apps that use its services for more about Google’s data use.
Storage and retention
Browser appearance preferences remain until you clear site data or change them. Mobile settings and cached public content can remain on your device until removed through the app or device controls. Installation, alert, delivery, and subscription records are stored on our backend to operate those features and support security, transaction verification, and necessary record keeping.
Retention depends on the record’s purpose and applicable requirements. Deleting the app does not by itself delete backend records or cancel a store subscription.
Your choices and rights
- Change appearance on this website or clear its stored preferences through your browser.
- Manage notification preferences in the app and revoke notification permission in device settings. Removing permission does not cancel a subscription.
- On a free account, iOS may ask whether CanadaPath can track activity across other companies’ apps and websites to show more relevant ads. You can decline and keep using the app; if Google advertising consent allows it, you may still see contextual ads. You can change tracking permission later in iOS Settings. Plus subscribers are not asked for advertising tracking.
- Where available, review advertising choices through the app’s Preferences screen or Google’s website advertising message.
- Manage or cancel an App Store subscription in your Apple account’s subscription settings.
Available rights to access, correct, or delete personal information, and any exceptions, depend on applicable law.
We use access controls and verification mechanisms to protect information, but no online service can guarantee absolute security.
Children and policy updates
CanadaPath is intended for people seeking immigration information, not as a service directed at children.
We will update this page when our practices change and revise the date shown above. Where a change requires additional notice or consent, we will provide it through the relevant service.