2Toits

Privacy policy

Last updated: July 15, 2026 · Version 1.4 · Reference language: French

This is an English summary for convenience. The authoritative version is the French one, as required by Quebec's Charter of the French Language (Bill 96). Read the French version.

Preamble

This policy describes how 2Toits ("we", "the application") collects, uses, stores, shares and protects your personal information. It is drafted in accordance with Quebec's Act respecting the protection of personal information in the private sector (as amended by Bill 25), Canada's federal PIPEDA, articles 35–41 of the Civil Code of Québec, and the Charter of the French Language (Bill 96).

1. Data controller

Under Quebec Bill 25, the Privacy Officer function is formally assigned and reachable at the address above. The full identity of the designated person can be provided upon legitimate written request.

2. Data we collect

Required (parent account)

  • Email address
  • Password (bcrypt-hashed, never stored in clear text)
  • Display name
  • Language and time zone preference

Optional

  • Profile picture (Premium)

Updated June 2026 — minimisation (Quebec Bill 25, art. 13): the parent account uses a display name. We do not collect a last name, gender, date of birth, postal address, or phone number for parents.

About the child

Children are not app users. No child account exists. We collect first name (required), date of birth (required), photo (optional, Premium).

What we never collect

  • Social Insurance Number
  • Bank or credit card information (handled by Apple / Google)
  • Real-time geolocation
  • Phone contacts
  • Biometric data (processed locally on device)

3. Purposes & legal bases

  • Account authentication — performance of contract
  • Co-parenting coordination — performance of contract
  • Push notifications — explicit consent (revocable in-app)
  • Certified PDF reports (Premium) — explicit consent
  • Abuse detection — legitimate interest
  • Audit logs — legal obligation

We never sell your data. No targeted advertising. No data brokers.

3 bis. Absence of automated decisions (s. 12.1 Loi 25)

2Toits makes no decision based exclusively on automated processing of personal information within the meaning of section 12.1 of Quebec's Bill 25. All decisions affecting your account (e.g. suspension for violation of the Terms of Use, refusal of service) are made by a human — the Privacy Officer (RPRP) or an authorised member of the 2Toits team. You have the right at any time to obtain an explanation of any decision concerning you and to request a human review.

4. Consents collected at sign-up

  • Terms of use
  • Privacy policy
  • Confirmation you are 18+
  • (Optional) Push notifications

Each consent is timestamped server-side to demonstrate compliance with Bill 25 art. 12.

5. Your rights (Bill 25 art. 27–28.1)

  • Access — receive a copy of your data — 30 days
  • Rectification — correct inaccurate data — 30 days
  • Deletion / de-indexation — immediate anonymisation, full purge after 90 days
  • Portability — receive your data in JSON — 30 days
  • Withdraw consent — immediate in-app

To exercise: Profile → Loi 25 Rights in the app, or email privacy@2toits.ca. Response within 30 calendar days.

You may also file a complaint with the Commission d'accès à l'information du Québec (CAI): cai.gouv.qc.ca.

6. Account deletion

From the app: Profile → Delete my account. Two-stage process:

  1. Immediate anonymisation (within 24 h) — email replaced by anonymous ID; display name and profile photo removed; postal address and phone removed if present in legacy records; push tokens revoked.
  2. Full purge (90 days) — all residual personal traces deleted by automated process.

Data concerning the child (past events, expenses, handover notes) remains visible to the coparent, in accordance with the child's best interests (Civil Code of Québec, art. 33).

Audit logs are kept for 7 years in anonymised form (legal obligation).

See the full deletion procedure →

7. Security

  • TLS 1.3 in transit
  • At-rest encryption (Supabase Pro)
  • PostgreSQL Row-Level Security (RLS)
  • bcrypt password hashing
  • 15-minute JWT access tokens with rotation
  • iOS Keychain / Android Keystore on mobile
  • SHA-256 audit-log integrity chain
  • Helmet.js HTTP security headers
  • Rate limiting against brute-force
  • Strong authentication and secure session management

8. Hosting & sub-processors (Bill 25 art. 17)

Data is hosted in Canada on Supabase Pro (ca-central-1, Montreal, AWS). Some sub-processors handle limited data outside Quebec, strictly to operate the service:

  • Supabase Inc. (Canada — hosting / US — administration) — database, authentication, storage
  • Railway Corp. (US) — API server execution (transit and in-memory processing only, no persistent storage)
  • Resend Inc. (US) — transactional email (email + name only)
  • Anthropic PBC (US) — optional AI rewrite assistant (see § 8 bis)
  • Sentry (Functional Software Inc.) (US) — technical error and crash logging (technical stack trace, no user content)
  • RevenueCat Inc. (US) — subscription management (user identifier, Premium status; no banking data)
  • Expo Inc. (US) — push notifications and builds (anonymous push token)
  • Apple Inc. / Google LLC (US) — App Store / Google Play (no banking data ever passes through 2Toits)
  • Vercel Inc. (US) — marketing website and public forms (waitlist / beta)

Each sub-processor is bound by a Data Processing Agreement (DPA) guaranteeing an equivalent level of protection, and a Privacy Impact Assessment (EFVP) has been conducted (Bill 25 art. 3.3).

8 bis. Artificial intelligence processing

Provider: Anthropic PBC (Claude, Claude Haiku 4.5 model).

Function: the app offers an optional AI assistant that rewrites your drafts (handover notes, expenses, support messages) in a neutral tone. The assistant is never triggered automatically — you must explicitly tap the Rewrite button to send the text to Anthropic.

Limited use (aligned with Google Play's policy on third-party AI integrations):

  • The text you submit is sent to Anthropic solely to produce a rewrite; it is not used to train any model, not linked to your identity, and not retained beyond processing.
  • No identifying data (child first name, address, phone number, financial amount outside your literal input) is added by 2Toits before sending — only your literal input is transmitted.
  • You may ignore the suggestion at any time and keep your original text.
  • No decision based exclusively on this AI processing is made about you (Bill 25 art. 12.1).

If you prefer never to use the AI assistant, simply do not tap the Rewrite button — all other app features remain fully available.

9. Privacy incidents (Bill 25 art. 3.5)

In the event of an incident posing a risk of serious harm, we notify the CAI and affected individuals within 72 hours.

10. Minors

The service is intended for parents and legal guardians aged 18+. Children are not direct users and do not have accounts.

11. Changes to this policy

Material changes will be notified by email and in-app at least 30 days before they take effect.

12. Contact

Privacy Officer
RPRP function — 2Toits (Quebec, Canada)
Personal data / Bill 25: privacy@2toits.ca
General support: support@2toits.ca
Legal questions: legal@2toits.ca

Useful links