Nothing, apart from the one contact form you fill in and send yourself — that one is the next section. There is no account, no sign-in and no database here; what you look at and where you stop is never sent to us and never written down anywhere.
This page sets no cookie and carries no analytics or tracking code — the only scripts are this site's own few and the inline code in the page.
The typefaces are fetched from Google Fonts (fonts.googleapis.com and fonts.gstatic.com): that one request lets Google see your network address and what your browser says about itself, and carries nothing else. Apart from it, this page makes no third-party request at all.
The four fields (name, email, your campaign, and which interface language you were reading) stay in your own browser until you press send. Pressing send posts them once, to our own service on the product site (app.hermodfield.ca). No form-collection service stands in between.
The submission is stored in our own database — the same one the product uses, Supabase in ca-central-1 — and we are notified of it. That notification is delivered by the mail provider Resend (resend.com), so the name, address and message you typed reach that service; apart from it, nothing is passed to a third party. We use the submission to reply to you and for nothing else: it is never added to a mailing list, never used for anything but the reply. This system never sends any email, text message or form submission on your behalf.
To prevent abuse, sending also keeps a one-way hash of your network address (computed with our own secret, so it cannot be turned back into the address) only to count how many times one source submits within an hour; it is kept for at most about two hours and cleared on the next submission (there is no scheduled job), and it is not stored with the submission.
What you put in the form decides what we receive; if you would rather not put it in a form, write to the address at the bottom of this page instead.
The page keeps exactly two preferences in your own browser: interface language and light or dark appearance. Neither leaves your machine or rides along with any request, and clearing your browser data removes them.
The video, captions and images on this page are public material: the names shown in them are fictional samples and the door numbers are blurred out; the street names are real streets in this city and stand for no resident. No real voter data appears in them.
That material is delivered over a content delivery network, which carries public assets only and no personal information at all.
This product page is a static site hosted on Netlify; the product's backend functions run in Netlify's Montréal region (yul) and its database is Supabase in ca-central-1.
Voter data and the roster are stored in Canada. Real voter personal information lives only in that production database — never on this page, never in the source repository, never on the delivery network.
Connection records the host keeps in order to deliver the page are outside our control. The host keeps function logs for up to 7 days depending on plan; how long it retains connection records for page visits is not published, and we cannot verify it. [pending verification]
This page and the product are two different things. Personal information handled inside the product is governed by the product's own consent notice — eight sections, each one on screen: purpose / what is held / audit trail / retention and deletion / your rights / privacy contact / version and effect / terms of use.
Consent always comes before a session: without the tick there is no session and no data surface is reachable, and a new version of the text asks existing users to agree again at their next sign-in.
A person's level of support records only what they said themselves.
To order visits, the product infers a likely origin from the names on the roll. The inference only affects order: each door stores the count of names matching the target origins and the priority group derived from it, never any individual's origin, and none of it goes into door records; volunteers never see it, and organizers see only the priority group, not the count. The inference can be wrong: a wrong guess only changes the order of visits and never leaves a door out — every door sits on the T1–T6 ladder by ownership, origin and housing, and a door without coordinates is counted first and routed as soon as it has them; it is used for no other decision. It lives in the plan document and is deleted together with the roll when an administrator destroys the roll; after that it survives at most 7 days in the database's daily backups and is removed, together with the operations copies, under the destruction procedure.
The map base layer inside the product is fetched from two outside services: Esri (server.arcgisonline.com, the dark and light base maps) and OpenStreetMap (tile.openstreetmap.org, the street base map); the volunteer switches between them on the map itself, and the default is Esri dark. Each time a map is opened, the volunteer's browser requests the tiles in view directly from that service, which therefore sees the volunteer's network address, what the browser reports about itself, and the tile coordinates — that is, the area being looked at, at neighbourhood scale, never a door. Addresses, the roll and visit records never travel with these requests, and nothing passes through our servers. How long either service keeps its connection logs is set by its own policy; we cannot verify it. [pending verification]
The product's typefaces are also fetched from Google Fonts (fonts.googleapis.com and fonts.gstatic.com; Inter and Noto Sans TC): each time the product is opened the browser fetches them once, so that service sees the volunteer's network address and what the browser reports about itself, and nothing else.
Navigation is handed to Google Maps: when the volunteer taps “Directions to start”, “Navigate the whole route” or “Maps” on a door card, a www.google.com/maps link opens in a new tab carrying door-level coordinates — the route's start, the stops of that leg (at most ten per leg) or that one door. The link opens only when the volunteer taps it; nothing is sent automatically. The volunteer's own position is never in any link: the browser's location is read once, only when the volunteer asks for distance ordering, and is used only to sort on the device. Address text, names from the roll and visit records are never in the link — coordinates only. What Google does afterwards is governed by its own policy; we cannot verify it. [pending verification]
A link to the full consent notice in the product: [pending].
Access, correction and withdrawal of consent — inside the product all three are raised with that organization's own privacy contact, and people at that organization answer them.
For this page itself, or for an email you sent us, write to the contact below.
