Privacy Policy

Last updated: October 16, 2026

1. Scope

This policy applies to FLAGG, including the website, mobile applications (iOS and Android), newsletter, customer support, and related services.

2. Privacy Officer

For any question, request, or complaint about personal information, contact our privacy officer at allo@flagg.ca or through our contact form.

3. Information We Collect

  • Account and profile: name, email, mobile phone number (optional), profile photo, communication preferences, practiced activities, followed users, favorite places.
  • Usage and security: login date and time, number of flaggs, IP address, user agent, technical and security logs.
  • Content and contributions: reviews, comments, reports, plans, added places, and uploaded photos.
  • Location: location provided by you (address, city, postal code) or device geolocation if you authorize it.
  • Push notifications: if you consent, a device identifier (FCM token) is stored to send push notifications. This identifier is linked to your account and updated at each sign-in.
  • Sign-in with a third-party account (Google, Facebook, Apple): if you choose to create your account or sign in through a third-party identity provider, we receive from that provider, depending on the provider, your name, email address, profile picture (where available), and a unique technical identifier specific to FLAGG. We never receive your password from the provider, and we do not access your contacts, posts, or any other data from your account with them. The identity provider may, on its side, know that you use FLAGG when you sign in this way; its own processing is governed by its privacy policy.
  • Sign-in with Facebook: FLAGG only requests the "public_profile" and "email" permissions. We therefore receive your first name, last name, email address, profile picture, and a technical identifier specific to FLAGG. If you do not share your email address with FLAGG, signing up with Facebook is not possible.
  • Sign-in with Apple: we receive a technical identifier, your email address and, on your first sign-in only, the name you choose to share. Apple does not send us a profile picture. If you choose to hide your email address, Apple sends us a private relay address (ending in @privaterelay.appleid.com) and forwards the emails we send to it to your real address. We also keep a token provided by Apple that allows us to revoke FLAGG's access to your Apple account; this token is revoked when you delete your FLAGG account.

4. Location and Precision

FLAGG requires a location for some features. You may provide this manually (address, city, postal code) without enabling precise device geolocation.

Your last known position is stored truncated to 2 decimal places (about 1.1 km), which is not precise enough to identify an exact address. Coordinates attached to content you publish yourself (e.g., a geotagged photo) may retain finer precision.

5. Purposes of Use

  • provide and improve FLAGG features;
  • personalize your experience and local recommendations (see Section 6 — profiling);
  • manage your account and settings;
  • support moderation, safety, and abuse prevention;
  • develop relevant partner and commercial offerings;
  • send service communications and, based on your preferences, marketing/newsletter messages.

6. Personalization and Profiling

FLAGG uses information about your activity, practiced sports, and preferences to generate personalized recommendations for places and plans. This processing constitutes profiling within the meaning of Quebec's Act to Modernize Privacy Protection Provisions (Law 25).

You may at any time request that no decision based solely on this profiling be applied to you by contacting allo@flagg.ca.

7. Public Content and Photos

Photos uploaded in places, reviews, and reports are public.

The profile photo is served through a signed URL with expiration (10 days).

Photos can be deleted by their author and removed by a moderator for policy violations.

The profile photo is deleted when the profile is deleted.

Your public profile (favorite places, practiced activities, followed users and followers, and collections marked public) is visible to any visitor, whether signed in or not.

8. Minimum Age

FLAGG is intended for users aged 14 and older. By creating an account, you confirm you are at least 14 years old. If we learn that an account belongs to someone under 14, we will take steps to delete their information and close the account.

9. Consent and Choices

Some information is required to operate the service (for example: name, email, location). Other information is optional (for example: mobile phone, precise geolocation, push notifications, marketing preferences).

Consent for optional cookies is collected through the consent banner displayed on your first visit. You can update your preferences at any time.

You can manage communication preferences in your profile and unsubscribe from newsletter emails at any time.

You can review the sign-in methods linked to your account in your settings. Unlinking an identity provider, or requesting data deletion through Facebook, removes the link between your FLAGG account and that provider without deleting your FLAGG account; full account deletion remains available at any time (see Section 12).

10. Service Providers, Partners, and Hosting

We use service providers to operate FLAGG. Information may be processed by Amazon Web Services (AWS) in the US East (N. Virginia) region and by Google (Firebase Cloud Messaging, Google Tag Manager) for the purposes described in this policy.

If you choose to sign in with a third-party account, the necessary information is exchanged, for authentication purposes, with the identity provider you chose: Google LLC (Google), Meta Platforms, Inc. (Facebook), or Apple Inc. (Apple). If your account uses an Apple private relay address, the emails we send you pass through Apple's relay service.

We do not sell your personal information to third parties. Any sharing with providers is governed by strict contractual terms, for specific and legitimate purposes, with access limited to what is necessary.

Where possible, we prioritize aggregated or de-identified data for analytics, commercial, and partner use cases.

11. Transfers Outside Quebec

Some information may be communicated or hosted outside Quebec, notably in the United States (AWS, Google and, for authentication, Meta Platforms, Inc. and Apple Inc.). In these situations, FLAGG conducts a Privacy Impact Assessment (PIA) and applies appropriate contractual commitments before any transfer.

12. Retention, Deletion, and De-identification

  • Account data: kept while the account is active. For prolonged inactivity, deletion or de-identification measures may apply.
  • Account deletion: deletion immediately hides your profile. Final purging of profile personal information is completed within 90 days of the request, subject to legal retention obligations.
  • Community contributions: reviews, reports, plans, and related media may be retained in de-identified form to preserve platform integrity, safety, and relevance.
  • Aggregated or de-identified data: may be retained for analytics, continuous improvement, and offering development.
  • Technical logs: retained for up to 12 months, unless a different legal requirement applies.

13. Your Rights

Under applicable law, you may exercise the following rights by contacting allo@flagg.ca:

  • Access: obtain a copy of the personal information we hold about you.
  • Correction: have inaccurate or incomplete information corrected.
  • Deletion: request deletion of your information, subject to legal obligations.
  • Portability: receive your information in a structured, commonly used technological format (applicable within timelines provided by law).
  • Withdrawal of consent: withdraw consent where processing is based on it.
  • Objection to profiling: request that no decision based solely on automated profiling be applied to you.

You also have the right to file a complaint with the Commission d'accès à l'information (CAI) of Quebec if you believe your rights have not been respected.

14. Privacy Incident

FLAGG implements reasonable security safeguards. If an incident presents a risk of serious harm, we will follow legal notification requirements, including notification to the CAI and affected individuals.

15. Partner-related Communications

Communications sent through our platform are identified as coming from FLAGG or as sent on behalf of FLAGG, including those related to partner programs.

16. Policy Updates

We may update this policy. For significant changes, we will notify you by email and through a banner on the platform. The current version is the one published on this page with its update date.

We use cookies for core site functionality and, based on your choices, for measurement and marketing.