Privacy Policy

• Your account: email, first name, display name, username, bio, avatar, and the first three characters of your postal code. The email is how you sign in. Your first name and display name are never shown to other people; the rest is what other people see of you.
• Addresses: the recipient name, phone, street address and postal code for each place you ship from or to. The phone is there so a courier can call about a parcel.
• Payment information: handled by Stripe. We keep Stripe's identifiers for your customer record, saved cards and payout account, never the card number itself.
• Tax details: your legal name, date of birth, home address and SIN, but only if you sell enough to near the CRA reporting line (30 sales or $2,800 in a year), or choose to add them early. They are encrypted before they are stored, and used for CRA reporting and nothing else.
• What you list and buy: listings, photos, orders, offers, reviews, and the events on each order.
• Messages: chat with other users, and any photos attached. Contact details in chat are automatically hidden, which requires us to scan message text as it is sent.
• Case evidence: the photos and descriptions you upload when opening or answering a case.
• How you use Pigeon: your searches, the day you were last active, and basic technical logs. Searches are kept for 90 days and used to work out what people can't find.
• Your phone number, verified before you sell. We keep a hash of numbers that have left Pigeon so an account's standing follows the number, not the email.
• Decisions we automate: new listings are screened by an AI model, contact details in chat are hidden by a filter, and we post reviews on completed and cancelled sales (a five-star when a sale completes cleanly, a one-star when the seller cancels or misses handover). A person reviews any listing the screen pauses, and you can ask us to look at any automated decision by writing to privacy@getpigeon.ca.

We ask for each of these at the moment it's needed, not up front: an address at checkout, a card when you buy. That way you can see why we're asking.

Not public, ever: your real name (it goes on the courier label and in our emails to you), your email, your phone number, your full address, your postal code, your tax details, your balance, and what you have bought. A seller shipping to you never sees your address. It goes onto the courier label server-side. A buyer never sees where a parcel came from beyond the city.

• Stripe (United States): payments, saved cards, identity checks and payouts. They receive your name, email and, for sellers, the identity details their checks require, which go to Stripe and not to us. Stripe also collects device and browser signals on checkout for fraud prevention, under its own privacy policy.
• Stallion Express (Canada): the courier. They receive the sender and recipient name, address and phone for a parcel, because that is what a shipping label is.
• Supabase: our database, file storage and sign-in, hosted in Canada (ca-central-1).
• Cloudflare (United States): application hosting and its edge network, which sees your IP address in the ordinary course of serving the site and keeps short-lived request logs.
• Resend (United States): sending email. They receive your email address and the contents of the message.
• Anthropic (United States): automated screening of new listings. They receive the listing's text and its cover photo. Your personal details are not sent, and the content is not used to train their models.
• Twilio (United States): sending the code that verifies your phone number, and only that number.
• Google Maps (United States): address suggestions as you type, and a check that the address exists when you save it. They receive the street, city and postal code you typed, sent through our servers so they never see your IP address, and never your unit or buzzer, your name or your phone.
• Protomaps and OpenStreetMap: the drop-off map. The map itself is drawn from OpenStreetMap data and served from our own servers, so nobody else sees which part of the map you looked at. The one exception is the map's lettering and icons, which your browser fetches from Protomaps' asset host on GitHub Pages, so GitHub sees your IP address and nothing else. We send them nothing about you, your address or your listing.

We also share data when the law requires it: a court order, a CRA reporting obligation, a police investigation. If Pigeon were ever sold or merged your data would go with it, and we'd tell you first.

• Your account and its content: 30 days after you close it (you can reactivate until then), and then we delete your addresses, saved cards, chats, photos, tax details and profile, and release your email address. The exception is tax details we have reported to the CRA, which the law requires us to keep for at least six years after the year they cover. What's left is a "Former member" record that your past orders point at.
• Orders, receipts and ledger entries: seven years after the order, because tax law requires it. This survives closing your account, and it includes the shipping address on each order, which stays on the order record even after your saved addresses are deleted.
• Reviews and case records you were part of: kept, under "Former member", because the other person's history depends on them.
• Case evidence: as long as the case record.
• Chat: until you delete it, or 30 days after you close your account.
• Search history: 90 days.
• Photos on an abandoned draft listing: 24 hours.

No system is perfect. If a breach ever puts you at real risk of significant harm, we will tell you and the Privacy Commissioner of Canada, as the law requires.

Some things we can't delete on request: order and tax records we're required to keep, and content another user needs to resolve an open case. We'll tell you if that applies.

If you're unhappy with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

The person responsible for privacy at VEEBZ INC. can be reached via privacy@getpigeon.ca, or by post at 80 Alton Towers Circle, Unit 1009, Scarborough, ON M1V 5E8.