Privacy

Every field, and why it exists. If something is not on this list, it is not kept.

Minimising afterwards is harder than not collecting, so these are decisions rather than intentions.

• Your full postal code. The last three characters identify roughly a city block. They are used once, to place your area on a map, and are never written down.
• Your address, phone number or date of birth. None of them are asked for, because none of them price a basket.
• Your IP address, as an identifier. The anonymous id in analytics is a random value in a cookie. It is not derived from your IP, your browser or anything else about you.
• Anything identifying inside an analytics event. Values are checked before they are written, and an email address, a full postal code or an account id is dropped — checked on the value itself, not on what the field happens to be called.
• Query strings from page addresses. A password-reset link carries a token in its address; recording the page you were on would record the token with it, so the address is cut off at the question mark.
• Receipt images. The text is read out and the picture is discarded.

You can build a basket without signing up. That basket is kept in your own browser and is never sent to us — it reaches our database only if you later create an account, and only then because you asked us to save it.

To show prices we need to know which stores you can reach, so we ask for a postal code. Only the first three characters are used, the part that identifies a neighbourhood rather than an address, and we use them to look up where that area is and which stores are near it. The postal code you type stays in your browser. What we keep on our side is a map of Canadian postal areas to coordinates, which is public geography and is not connected to you or to your basket.

To know which parts of Basketr are actually used, we record a small set of events: pages viewed, and a short list of actions such as adding a basket item or generating a plan. The full list of event names is fixed in the code — nothing else can be recorded, even by accident.

To count returning visitors, a first-party cookie named bskt_vid stores a random identifier that expires after 90 days. It contains no information about you: it is a random number generated on your first visit, and it is stored in our database only in hashed form. No IP address, browser fingerprint, or device identifier is used.

Analytics events are stored with a pseudonym rather than your account id, and location is reduced to the first three characters of a postal code — an area covering thousands of households, never a street.

There is no third-party analytics. No Google Analytics, no advertising pixels, no session recording, no data brokers. The events are stored in our own database and read by nobody outside Basketr.

If your browser sends a Do Not Track or Global Privacy Control signal, we record nothing and set no cookie. Both are settings in your browser or an extension, and both are honoured automatically — you do not need to tell us.

Clearing your cookies removes the identifier. A new one is generated on your next visit, and it cannot be linked to the old one.

We do not sell your data, and we do not share it with advertisers.

We do not store full postal codes on anything analytical, do not keep your home coordinates outside your own household record, and do not use your basket to target you with anything.

Basketr runs on Cloudflare Workers, with data in a Supabase Postgres database. Flyer prices come from publicly available flyer listings. Store locations are looked up through Google's Places API using the store address — never your address.

You can delete your account from settings, which removes your household, basket, plans and receipts. Analytics events, being pseudonymous, cannot be traced back to you afterwards — tell us before you delete if you would like them removed too.

Questions, a copy of your data, or a request under PIPEDA: contact@basketr.ca.