Skip to main content
CommunATICommunATI
For programsFor familiesFor sponsorsFor volunteersAboutHelpSign inApply for your organization
For programsFor familiesFor sponsorsFor volunteersAboutHelpSign inApply for your organization

Data deletion

Last updated: May 31, 2026· ~5 min read· Jurisdiction: Canada (PIPEDA + Quebec Law 25)

You can delete your CommunATI account and the personal data tied to it at any time. There is no fee, no waiting period, and you do not need to give a reason. This page tells you exactly how to ask, what gets erased, what we have to keep, and how long the whole process takes.

Sections
How to request deletionData we collectThird parties we share withWhat we retain after deletionTimeline + confirmationData controllerYour rights under PIPEDA + Law 25Children + Play Families

How to request deletion

Three paths — pick whichever is easiest.

  1. In the app: open CommunATI on your phone or tablet, go to Profile → Settings → Delete account, confirm. The button queues the deletion job immediately.
  2. By email: send a message to hello@communati.ca from the address on your account with the subject line “Data deletion request”. Include the email or phone number you used to sign up. We confirm receipt within 5 business days.
  3. By mail: Bay Tech Ltd., Winnipeg, MB, Canada. Mailed requests take longer; the in-app and email paths are faster.
For a parent or guardian: you can request deletion of a child's account on their behalf. Confirm in the email that you are the parent or guardian of record.

Data we collect (and that gets deleted)

The list below mirrors the Google Play Data Safety form. Everything in this list is tied to your account and is erased when you delete it.

  • Name and email address
  • Account identifier (the row CommunATI uses to find you)
  • Phone number (only if you chose to share one for event-day SMS)
  • Purchase history (processed by Stripe; receipts and refund records)
  • Approximate location (city / postal code, used to find programs near you)
  • Photos and videos you uploaded to event galleries or showcase posts
  • User-interaction data inside the app (what programs you tapped, which competitions you registered for, what scores you submitted as a judge)
  • In-app search history (the queries you typed into the program finder)
  • Crash logs and performance diagnostics (sent to our error reporter)
  • Device identifiers (Android advertising ID, iOS IDFV; used to deduplicate sign-ins on shared family devices)
What we don't collect: precise GPS, contacts, calendar, microphone audio, browsing history outside CommunATI, or health and fitness data. We don't sell or share your data with advertisers.

Third parties we share with

We only share data with processors that help us run the service. None of them receive your data for their own marketing or ad use.

  • Stripe — payment processing. Receives the minimum data needed to process a registration fee, sponsor invoice, or refund.
  • Sentry — crash and error reporting. Receives stack traces and breadcrumbs with secrets and personal identifiers redacted client-side before sending.
  • PostHog — product analytics (EU data residency). You can opt out in Settings → Privacy; opt-out flips the SDK to a no-op locally.
  • Resend — transactional email (sign-in links, event reminders, family digests).
  • Google Cloud Text-to-Speech — synthesises voice for match announcements played over event sound systems. The synthesised audio file is cached server-side keyed by text hash; no personal data is sent.
  • Firebase Cloud Messaging — push notification delivery. Receives the encrypted push payload and a per-device token.
  • Supabase — our primary database and storage, hosted in Canada (ca-central-1).

Each processor is bound by a data processing agreement (DPA). We never sell data and we don't share it with ad networks, data brokers, or third-party analytics outside the list above.

What we retain after deletion

A small set of records is kept after your account is deleted, because law requires it or because the data is no longer about you specifically.

  • Stripe payment records — 7 years, as required by the Canada Revenue Agency for tax recordkeeping. Stripe holds these on its own infrastructure under its own retention policy.
  • Aggregated, anonymised analytics — counts and averages with no link back to any individual (e.g. “200 families attended this event”). These cannot be re-identified.
  • Breach-notification logs — if your data was ever part of an incident report we sent to the Office of the Privacy Commissioner of Canada (OPC) under PIPEDA section 10.1, that report stays in our compliance archive. The report identifies the incident, not you.
  • Public competition results — if you competed under a stage name or competitor number that we published on a public leaderboard, that historical record may stay up for the season. We never publish real first or last names on public pages.

Timeline + confirmation

  • Within 30 days of your request, we confirm receipt and either delete the data or explain why we cannot (e.g. you're disputing a charge and Stripe needs the record to resolve it).
  • Within 90 days of confirmation, all primary deletion is complete. Backups roll over within an additional 35 days under our standard backup-retention policy.
  • We email a final confirmation when the deletion job finishes. After that point your email address is also removed from the confirmation log itself.

Data controller

CommunATI is operated by Bay Tech Ltd., Winnipeg, Manitoba, Canada. Bay Tech Ltd. is the data controller for the purposes of PIPEDA and Quebec Law 25. A non-profit incorporation of the CommunATI Society is pending; when that completes, the controller will transition and this page will be updated.

Privacy questions, deletion requests, and access requests: hello@communati.ca.

Your rights under PIPEDA + Quebec Law 25

Canadian residents have the right to:

  • Know what personal data we hold about you (right of access).
  • Receive a portable copy of your data (right of portability).
  • Correct inaccurate data (right of rectification).
  • Delete your data (this page) — Principle 4.5 of PIPEDA and Article 28 of Quebec Law 25.
  • Withdraw consent for any optional data use without losing core service access.
  • Lodge a complaint with the Office of the Privacy Commissioner of Canada or, for Quebec residents, with the Commission d'accès à l'information du Québec.

You can exercise the access and portability rights from inside the app at /account/data-export.

Children and Google Play Families

CommunATI is enrolled in the Google Play Families programme. Children's data is treated separately from adult data:

  • Children under 13 cannot create their own account. A parent or guardian creates a family account and adds the child as a competitor.
  • We never publish a child's real name. Public pages use display names or competitor numbers only.
  • Photo uploads are off by default for children. A photo can only be uploaded after an explicit per-event opt-in from the parent or guardian.
  • There is no advertising of any kind to children. CommunATI shows no ads to any user.
  • We do not knowingly share children's data with any third party beyond the processors listed above, and we limit even those to the data strictly required to run the service.
  • A parent or guardian can delete a child's entire record by following the steps at the top of this page — the same path you use for your own account.
If you believe a child's data has been added without consent: email hello@communati.ca with the subject “Unauthorised child data”. We will isolate and delete the record within 7 days.
CommunATI

Powered by Bay Tech Ltd.

Bay Tech Ltd. · Winnipeg, MB, Canada

For programs
  • For programs
  • Apply for your organization
For families
  • For families
  • For volunteers
  • For sponsors
Help
  • Help
  • Privacy
  • Data deletion
  • Terms
  • About
© 2026 CommunATI · Bay Tech Ltd.POWERED BY BAY TECH LTD. · COMMUNATI