Privacy policy

Whenever (whenever.austinhansen.io) dates the conditions on real-estate deals and keeps them in front of you until they're done. This policy explains what the website and the iOS app collect, what it's used for, who else sees it, and how to delete it.

The short version: we collect what it takes to run your account, use it only for that, and never sell it or use it for advertising.

What we collect

• Your account. Your email address and password. The password is stored only as a one-way hash (bcrypt), never as the password itself. We also note when you confirmed your address and how far you got through the welcome tour.
• Your province or territory, which decides which statutory holidays business-day deadlines skip.
• Your deals and conditions: everything you enter in them, such as titles, notes, dates, triggering events, and which conditions you've completed. If your deals mention clients or properties, that information is kept the same way and used only to show it back to you.
• Your sign-ins. Each time you sign in we keep a record of that session, with the IP address and the browser or app details (user agent) it was started from. It's deleted when you sign out.
• Your calendar feed link, a private, unguessable address your conditions can be subscribed to from a calendar app.
• In the iOS app, a push token. The app registers with Apple so we can wake it silently when your conditions change and it should update your calendar. We store the token Apple issues and the device name iOS reports, tied to the sign-in that registered them; signing out deletes them. These pushes never show a notification.
• Server logs. Like most websites, our server logs the requests it receives, including the IP address and the page asked for.

We don't ask for your name, phone number, location, contacts, or payment details.

The iOS app and your calendar

The app keeps your deadlines in a calendar called “Whenever” on your phone. To do that it asks iOS for access to your calendars. It looks through your list of calendars only to find its own, and reads and changes only the events in that one. Nothing from your phone's calendar is sent to us: syncing only downloads your conditions from Whenever.

The app keeps a private link to your conditions, tied to the session you signed in with, in the phone's Keychain so it can sync in the background. Signing out of the app, or deleting your account in it, removes the Whenever calendar and that link from the phone. So does ending that session from elsewhere, such as by resetting your password: the link stops working, and the app removes the calendar the next time it syncs.

How we use it

• To run your account: signing you in, dating your conditions, and showing them on your dashboard, in your calendar feed, and in the app.
• To email you a link to confirm your address, and a link to reset your password when you ask for one. Those are the only emails we send.
• To keep Whenever secure and working: limiting repeated sign-in attempts, and finding and fixing errors.

We don't sell your information, share it for advertising, or build profiles from it. Whenever has no ads, no analytics, and no tracking scripts.

Who else handles it

These service providers handle information on our behalf, to run Whenever:

• DigitalOcean hosts the server and the database your information is stored in.
• Cloudflare sits in front of the website, so everything sent between your browser and Whenever, including your IP address, passes through it.
• Resend delivers our emails, so it receives your email address and the message.
• Honeybadger receives error reports and a record of each request, including which part of Whenever handled it and how long it took. Error reports also include your IP address and browser details. Neither includes the page address, what you entered in a form, or your cookies.
• Apple Push Notification service delivers the silent wake-up to the iOS app. The push carries nothing about your deals.

If you subscribe to your calendar feed in Apple Calendar, Google Calendar, Microsoft 365, or another calendar app, that calendar service fetches the feed and receives your outstanding conditions' titles, their deals' titles, their due dates, and a link to each deal. Deal notes are never included. The settings page hands your feed link to Google or Microsoft only if you click its button for them. Anyone with the link can see those conditions, so keep it private; if it leaks, regenerating it in Settings stops the old one from working.

Some of these providers process information outside Canada, including in the United States, where it is subject to the laws there. We'll also disclose information if the law requires us to.

Cookies

Whenever uses two cookies of its own, both needed for it to work: one keeps you signed in, and the other holds short-lived things such as the message shown after you save and a token that protects forms from forgery. There are no advertising or analytics cookies. Cloudflare may set a cookie of its own to protect the site from abuse.

Security

Whenever is only served over an encrypted (HTTPS) connection. Passwords are stored as one-way hashes, and the cookie that keeps you signed in can't be read by scripts on the page.

How long we keep it, and deleting it

We keep your information for as long as your account exists. You can delete your account at any time, on the web or in the app, from Settings → Delete account. That permanently deletes your account and everything in it: your deals, conditions, settings, sign-ins, and push registrations. Your calendar feed link stops working at the same time. Server logs and error reports that already mention a request you made aren't part of your account, and aren't removed with it.

Your rights

You can see and change your deals, conditions, and province yourself in Whenever. You can also ask for a copy of the personal information we hold about you, ask us to correct it, or ask anything about this policy, by emailing [email protected].

Whenever is for real-estate professionals in Canada, and we handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). If you're not satisfied with our answer to a privacy question, you can complain to the Office of the Privacy Commissioner of Canada.

Changes to this policy

If we change this policy, we'll post the new version here and update the date at the top. If a change affects how we use information you've already given us, we'll say so in the app and on the site before it takes effect.

Contact

Questions or requests about your privacy: [email protected].