Privacy policy

This policy explains how Verota Technology Ltd. handles personal information in CommonBeat: in the app, on commonbeat.ca, and in the messages we send. It describes the product as it works today. Where something is built but switched off, it says so.

The parts people ask about most are location, in section 7, and the automatic check on chat messages, in section 8.

1. Who is responsible for your information

Verota Technology Ltd. is the company that runs CommonBeat, and it is the organisation accountable for the personal information CommonBeat holds. CommonBeat is operated by one person.

Our privacy officer is responsible for making sure that we follow this policy and the law. You can write to the privacy officer, about this policy or anything we hold about you, at info@commonbeat.ca. A person at Verota Technology Ltd. reads it. Our mailing address is at the foot of the emails we send you, and we give it to anyone who asks.

This policy covers members of CommonBeat, people who visit commonbeat.ca, and anyone who writes to us. It does not cover the app stores, your mobile carrier or the maker of your phone. Each of them has its own privacy policy.

2. The law this follows

CommonBeat is operated from Vancouver, British Columbia. Two privacy laws apply to it: the federal Personal Information Protection and Electronic Documents Act (PIPEDA), and British Columbia's Personal Information Protection Act (PIPA). Where the two differ we follow whichever gives you more.

Both laws work the same way in the part that matters here. We may collect only what a reasonable person would consider appropriate, only for purposes we have told you about, and only with your knowledge and consent. If a purpose is not on this page, we are not allowed to do it, and adding one means changing this page first.

If you live in Alberta, its own Personal Information Protection Act protects you as well, and we follow it. Section 10 names the countries outside Canada where the companies that work for us keep information, as that law asks.

3. What we collect

3.1 When you set up an account

Your date of birth and your gender answer live in a separate table that the app itself cannot read. Apart from the two rules that need them, nothing in the product reads them, except that the moderator's view of an account shows an age worked out from the date. Your gender answer is shown to nobody.

3.2 When you put out a beat

A beat records what you are up for, your mood, the window you are free in, how far you are willing to go, and how big a group you want. It records the neighbourhood you chose to meet in, which you pick under "Meet in" from the neighbourhoods that are open, and which of that neighbourhood's named weekly windows it was sent for, if any. It records the two flexibility switches, if you have turned either on. It also records a coarse location cell and, when the cell came from your phone's position, the accuracy your phone reported for it, as a number of metres. Section 7 explains the cell and where it comes from.

We also record what happened to each beat: for example, that it waited, was offered a room, was parked or found a group. Every hour, beats are counted by neighbourhood, and those counts hold nothing about any person.

Every week. After you send the same beat twice, the app offers to send it every week. If you accept, you choose the neighbourhood it meets in, from those that are open, and the app suggests the one your beat just went to. We keep that repeating beat with your account: the day and time, how long, what you are up for, your mood, how far, how big a group and its neighbourhood. Each week's beat goes out with both flexibility switches off. It goes out only while that neighbourhood is open. A repeating beat saved before this version of the policy meets in the neighbourhood you had chosen when you saved it.

Shortly before each week's time, the app asks whether you are still on. Only a week's beat you say yes to can join a group. If you say no, that week's beat is cancelled, and if you do not answer, it ends when its time starts. Either way the next week's is asked again. Turning it off stops it, and it stays with your account, switched off, until you delete your account. Each week's beat starts from the centre of its neighbourhood, not from your phone's location.

Would you come? While the neighbourhood you live in is not open, the app shows its weekly times and asks whether you would come to one of them. If you say "I'd come", we keep that answer against an hour of the week your neighbourhood is trying to fill, with the neighbourhood, when you said it and, if you take it back, when you did. It holds no position, no note and nothing about your phone. It is counted with everyone else's, so that a neighbourhood opens on an hour enough people are actually free for, instead of on a guess. It is not a promise to come. You can take it back at any time, and it then stops counting. Changing the neighbourhood you live in takes back every "I'd come" you gave the old one, so an answer only ever counts where you live.

Nobody else is shown your answer. People who live in the same neighbourhood see in the app how many said they would come to an hour. A count under five is never shown and never sent to the app as a number, so no bar or number in the app reveals fewer than five. The moderator who decides when a neighbourhood opens sees the exact count for each hour. Each answer, taken back or not, is deleted 90 days after you gave it, and at once if you delete your account. Saying it again after taking it back starts a new 90 days.

Your usuals, the beats you save to send again with one tap, are kept on your phone and not by us. So is your setting for the two flexibility switches, which is copied onto each beat you send yourself, but not onto a repeating beat.

3.3 In a room

We keep the messages you write, and when you joined the room, opened it and left it. We also keep a dated record of who you have shared a room with, so that the same two people are not put together more than twice in four weeks.

When a room forms, it also keeps the midpoint of its members' coarse cells, worked out as part of putting the group together. Nobody is shown it, and it is cleared when the room closes.

3.4 When something goes wrong

If you report someone, we keep the reason you chose and any note you add. We also keep a snapshot taken at that moment: the message, the room's recent messages and the list of people in it. The same is kept when someone reports you.

We keep the blocks you make and the blocks made against you, and every decision a person here makes about an account, with its reason.

The automatic chat check records its result for each message it reads: whether it passed, a score, and which rule it matched, if any. When it removes a message or passes one to a person, it files a report saying what it found. A snapshot of the message and of the room's recent messages is kept with the report, so that a person can read them.

When the rules are unsure about a first name or a one line, the words are kept for a person here to read before anyone else is shown them.

3.5 About your phone and your connection

For each phone that receives our notifications, we keep a record of the kind of phone, its operating system version and the app's version. The record also holds an identifier the app creates when it is installed, the token that lets us send that phone notifications, and when it was last used.

When you sign in, our database provider keeps a session for your phone. The session holds the internet (IP) address it signed in from, and a short description of the app called a user agent. The provider also keeps a log of each sign-in: when it happened, the IP address, and the phone number or email address involved.

Each time a sign-in code is asked for, we keep a scrambled form of the phone number or email address, and of the IP address, with whether the code was sent. It is a keyed hash: it tells us whether the same number asks again, and it cannot be turned back into the number without a secret key that we keep.

Before a sign-in code is sent, Cloudflare checks signals from your phone or browser to tell a person from a program. Our database provider and Cloudflare also keep short records of the requests that reach them, with the IP address each came from.

We keep a record of each notification, and of each email other than a code, with whether it was delivered. For a code, by text or by email, we keep only the scrambled record of the request above, and the company that sent it keeps its own record of delivery.

3.6 The messages we send you

Texts. We text a one-time code each time you sign in, and when you delete your account on our website, at commonbeat.ca/delete-account. The whole text reads "123456 is your CommonBeat code. It expires in five minutes. We will never ask you for it.", with your code in place of 123456. A last line lets your phone fill the code in for you. Section 17 says how to stop the texts.

Emails. We send four kinds, all about your account: a code that confirms your address, a welcome once it is confirmed, and one email when your neighbourhood opens, if it was not open when you signed up. The fourth is a notice each time your account is signed in, after the first time. We do not send marketing email.

Every email after the code names Verota Technology Ltd. and gives its mailing address. The welcome and opening emails carry a link that stops them. The sign-in notice does not, because it is about the security of your account.

Notifications. The app's notifications are about your beats and rooms, your neighbourhood, your account and your safety. No notification names another person.

3.7 When you write to us

If you write to info@commonbeat.ca, we keep your message and our reply for as long as we need them to help you, and to keep a record of a request about your information or your safety. Porkbun, our domain provider in the United States, forwards that mail to the mailbox where we read it.

3.8 What other people tell us

Other members can report you, block you, and write about you in a room. A police service can send us a lawful demand about you. Sections 10 and 13 say what we do then.

3.9 What we do not collect

• No precise location. The permission for it is absent from the app, and a check in our build fails if it ever appears.
• Nothing from your contacts. Two checks in our build refuse every way of reading them.
• No photos, no camera and no microphone. Chat is text only.
• No advertising identifier. The app does not ask for one.
• No payment details. CommonBeat is free.
• No analytics or crash-reporting service, no tracking pixels, nothing from a social network, and nothing bought from a data broker.

4. Why we use it

We use your information for these purposes, and for nothing else:

1. To create your account, sign you in and keep it secure.
2. To put you in a group that fits your beat, and to run the room and its chat.
3. To send you the codes, emails and notifications that section 3.6 describes.
4. To keep members safe: the chat check, reports, blocks and decisions, and bans that survive a new account on the same number.
5. To meet our legal duties, including those about children, and to answer lawful demands.
6. To see whether CommonBeat works, and whether a neighbourhood is ready to open, from counts rather than from people. Examples are how many beats a neighbourhood has each hour, how many people live in it, and how many said they would come to one of its hours. Nothing we publish or show members from those counts describes fewer than five people, and a count under five is never sent to the app as a number.
7. To answer you when you write to us.

We do not use your information for advertising, we do not sell it, and we do not use it to train artificial intelligence. The two companies that run the chat check do not use what we send them to train their models either.

5. Your consent

We ask for your consent where we collect your information, and we tell you there what it is for.

• On the phone step, before you tap "Send the code", the app says that by tapping it you agree that CommonBeat texts your number a one-time code each time you sign in.
• On the rules step, the app shows the three rules and says that chat is checked automatically for anything illegal or unsafe. You agree to the terms by tapping "I agree".
• On the email step, the app says what the address is for. It names all four emails in section 3.6, and says that the sign-in notice has no link that stops it. Versions of the app from before 2026-11-10 show an older notice that names only three.
• Your phone asks you separately before the app may use approximate location. On Android 13 and later, and on an iPhone, it also asks before the app may send you notifications.

Most of what we collect is a condition of using CommonBeat, because it cannot work without it. That is your number, first name, date of birth, neighbourhood and email address, and the chat check. Your gender answer, your one line and any "I'd come" are optional. Location is never needed. With it, a beat you put out inside the neighbourhood you chose starts from where you are, and "Now" can be offered in a neighbourhood your phone's approximate position is inside. Versions of the app from before version 2026-11-12 of this policy have no "Meet in". With them, a beat needs location, can go out only while the neighbourhood you live in is open, meets in the neighbourhood your phone is in, and starts from your phone's position.

You can withdraw your consent at any time. Withdrawing does not undo what was done before, and some things then stop working:

6. What other members can see

People in a room with you can see your first name, and your one line if you wrote one. If the fixed rules hold either of them for a person here to read, other members see "New member" instead of your name, and no one line, until it is approved. They can also see the room's neighbourhood, which is the one its beats chose to meet in. They see your messages, and when you joined or left the room.

They never see your phone number, email address, date of birth, age, gender or location, the neighbourhood you live in, your other beats, any "I'd come", or anything you have reported or blocked. A block is invisible to the person blocked, and a report never tells anyone who made it.

7. Location: coarse, always

This is the section people ask about, so it says exactly what happens.

The app asks your phone only for approximate location. It does not ask for precise location. On Android the permission to do so is blocked in the app's manifest — not merely unused, but absent, and a check in our build fails if it ever appears. Google describes Android's approximate location as accurate to within about 3 square kilometres.

When you put out a beat, the app sends your phone's approximate position with it only if that position is inside the neighbourhood you chose. Versions of the app from before version 2026-11-12 of this policy send it with every beat. If that position is inside the neighbourhood you chose to meet in, the beat starts from it. If it is not, or the app has none, the beat starts from the centre of that neighbourhood instead. The position also decides whether "Now" can be offered. "Now" is offered only in the neighbourhood you live in, and in a neighbourhood your phone's approximate position is inside, when your phone also says that position is accurate to within 3 kilometres. Either way, before anything is stored, the starting point is snapped to a 500-metre grid. The grid is shifted by an offset that belongs to your account and nobody else's, so two people standing together get different cells. We never store the position the phone reported, not even briefly.

A repeating beat does not use your phone's location at all. Each week's beat starts from the centre of the neighbourhood chosen for it, put through the same grid and offset.

The consequence is that we cannot tell you where another member is, and neither can anybody who takes our database. There is no map of members in this product, and that is why.

When a room forms, it keeps the midpoint of its members' cells, as section 3.3 says. Nobody is shown it, no company receives it, and it is cleared when the room closes.

At this stage there are no exceptions. Nothing in CommonBeat stores a position more precise than that cell, and nothing asks your phone for more than approximate location. An earlier version of this policy described two exceptions, a duress message and an arrival check-in. Both belonged to arranged meetings, which CommonBeat does not do, and neither runs.

No company other than Supabase ever receives a location from us, approximate or otherwise. Like any service on the internet, the companies that carry our traffic see the IP address your phone connects from, which can show a general area. Section 10 names them.

If you turn location off, you can still use the app and put out a beat. It starts from the centre of the neighbourhood you chose, and "Now" is offered only in the neighbourhood you live in. Section 19 describes questions about where you are usually around that a later version may ask, and exactly what they would add.

8. Messages, and the automatic chat check

Messages in a room become read-only the moment the room closes, and are deleted 48 hours after that. That is long enough to read what was said, and to file a report about it. It is not long enough to become an archive of what strangers said to each other.

Message text is checked as it is sent against a fixed list of rules for phone numbers, links and social handles.

After a message is sent, it is also checked automatically for things that are illegal or unsafe. The check looks for weapons, drugs and other illegal goods, threats of violence, anything sexual involving someone under 18, hate, harassment, and signs that the writer may hurt themselves. It also looks for romantic or sexual approaches, for limiting who may answer by gender, age or looks, for contact details, and for selling or asking for money. OpenAI's moderation service scores every message. The messages it picks out, or that contain words from a fixed list, are then read by Anthropic's Claude, together with up to five earlier messages from the same room so that it can tell a joke from a threat. Neither company receives your name, your phone number or any account or room identifier: only the words, and whether each earlier message came from the same person.

What happens next depends on what the check finds. A message that clearly breaks a rule is removed. If it is about weapons, drugs, other illegal goods, a threat or a child's safety, the account is also paused until a person here has looked. A message the check is less sure about stays visible and is passed to a person to read. Nothing automated closes an account: only a person does that. If a message suggests that the writer may hurt themselves, they are not penalised in any way; they receive one notification pointing to 9-8-8, Canada's suicide crisis line, at most once a day.

When the check removes a message or passes one to a person, the report it files keeps a snapshot of that message and of the room's recent messages. A person can then read them after the room's messages are gone. The snapshot is kept for 12 months.

A person also sees any message a member reports.

What the two companies keep: OpenAI's moderation service keeps nothing about a request once it has answered it. Anthropic deletes what we send within 30 days. If its own safety systems flag a request, it may keep that request for up to two years, and its safety scores for up to seven. Neither company uses what we send to train its models.

Messages are encrypted on their way between your phone and the database, and while they are stored there. They are not end-to-end encrypted, because a moderator has to be able to read a conversation somebody has reported in order to keep people safe.

Anyone in a room can take a screenshot of it. Nothing in CommonBeat prevents that, and we will not claim otherwise.

9. Decisions made automatically

Software makes these decisions about you without a person:

• Refusing an account to anyone whose date of birth makes them under 19, and to a phone number that has been banned.
• Refusing a new account on a Quebec number, known from its area code, until the terms exist in French. The app says so before it sends a code. An account already open on one keeps signing in, and can still be deleted from the app or our website.
• Which group your beat joins. It is worked out from the beats themselves: what each is up for, when, the coarse cells, how far and how big a group. It never puts the same two people together more than twice in four weeks, and never puts you with somebody either of you has blocked. It does not use your gender, or anything said in a chat.
• Whether a beat for a drink can go out. It cannot if your date of birth makes you under 19.
• Where a beat can go, and when you can move. A beat can name only a neighbourhood that is open. "Now" is offered only in the neighbourhood you live in, and in a neighbourhood your phone's approximate position is inside. The neighbourhood you live in can be changed at most once every 7 days, after your first day.
• When you can change your first name. Not while you are in a room that has not closed, and at most once every 30 days after your first day.
• Removing a message and pausing an account, when the chat check finds a clear breach, as section 8 describes.
• Refusing a message that contains a phone number, an email address, a link or a social media handle, or that asks for money or to move to another app.
• Refusing a first name or a one line that clearly breaks the fixed rules, and holding one for a person to read when the rules are unsure.
• Pausing an account when a serious report is filed, until a person has looked.
• Limiting an account when two different members report, within 30 days, that they did not feel safe with that person. The limit lifts on its own after 7 days, but not while a report about the account is still open. A person here can lift it sooner.

You can ask us why any of these happened and what information it used, and you can ask for a person here to look at it again. Write to info@commonbeat.ca. A decision that ends an account is always made by a person.

10. Who else receives your information

10.1 The companies that run parts of CommonBeat for us

Each of them handles your information to provide its service to us, under its own terms and privacy policy, which can let it keep some records for its own security. Two uses go further, and you should know them. Cloudflare uses the signals from its bot check to improve how it detects bots, and Anthropic may keep a request its safety systems flag, as section 8 says.

We have chosen, but do not use yet, Sentry for crash reports, PostHog for counting how the app is used, and OVHcloud in Canada for storing encrypted backups. Project Arachnid Shield, from the Canadian Centre for Child Protection, would check images for known child sexual abuse material, and it is switched off because CommonBeat carries no images. Apple's push notification service will deliver notifications to iPhones once the iPhone app is offered. None of them receives anything, and each will be added to the table above before it does.

10.2 Where your information is kept

Our database is in Canada. Some of these companies are in the United States, and Healthchecks.io is in the European Union. PIPEDA permits that and requires us to tell you, which is what this section does. While information is held outside Canada it is subject to the laws of that country, including lawful access by its courts, police and security agencies.

10.3 What no company receives

• No precise location, because there is none to send.
• No date of birth and no gender answer. No company receives either.
• No message content, except the words the chat check sends OpenAI and Anthropic, described in section 8, with no name, number or account identifier attached.
• Nothing goes to an advertising, attribution or marketing company. There is no such company in this product and there cannot be one without this page changing first.

10.4 When the law requires it, or someone is in danger

We disclose information to Canadian law enforcement acting under lawful authority, such as a production order, a preservation demand or a warrant. We tell the person affected unless the law forbids it, or telling them would put someone at risk.

We may also disclose information without a demand where we believe in good faith that it is necessary to prevent serious harm to a person. That has a narrow meaning and we treat it narrowly.

Where we find material involving a child, Canadian law requires us to report it to the Canadian Centre for Child Protection and to the police, and to preserve the evidence. We do both.

10.5 If CommonBeat changes hands

If another company takes CommonBeat over, your information would pass to it only to keep CommonBeat running under this policy. We would tell you before that happened, and you could delete your account.

10.6 We do not sell it

We do not sell, rent or trade personal information, and we do not share it with anyone for their own marketing.

11. How long we keep it

A legal hold pauses the rules that apply to the records it covers. A hold is placed when material involving a child is found, when law enforcement serves a preservation demand, or when a serious report is being investigated and the evidence would otherwise expire. Every hold has a reason and an expiry date.

Sometimes we use your information to make a decision that directly affects you, such as suspending your account. We then keep the decision, its reason and the report it was based on for at least a year, so that you can ask to see them.

12. Deleting your account

You can delete your account from the app, or from commonbeat.ca/delete-account with the app uninstalled. Both do exactly the same thing. It is immediate, there is no grace period, and nothing tries to talk you out of it.

This is the same text the app shows you before you press the button, generated from the same source, so that the two cannot say different things.

CommonBeat does not collect a profile photo, and does not let anybody add a trusted contact, at this stage. The lines about your photo and your trusted contacts apply only if a record like that exists. The same is true of how far you will walk, the areas you are usually around, a "near me now", an invitation record and an answer to "did your group meet?". None of those is asked for at this stage, so those lines apply only once they are.

Deleting is immediate. There is no grace period and nothing here will try to talk you out of it. You will be signed out when it is done.

What goes

• Your first name becomes "Deleted", and your one line goes.
• The neighbourhood you live in, and the times you last changed it and your first name, go.
• Any photo on the account is removed from storage, not just unlinked.
• Your birthday, your gender, your timezone, how far you said you will walk, the areas you told us you are usually around, any "near me now" you gave for one beat and the day you last opened the app are dropped.
• Your device tokens go, so notifications stop.
• Any trusted contacts go.
• Your saved usuals go.
• Any "I'd come" you said for one of your neighbourhood's weekly hours goes.
• The record that you were invited, or that you invited somebody, goes.
• Your answers to "did your group meet?" go.
• The record of who you have shared a room with goes.
• The record of the days you sent a beat goes.
• Your beats and your seats go, and the rooms they belong to age out on the schedule in the privacy policy.
• Your waitlist row goes.

What stays, and for how long

• A one-way hash of your phone number, for two years, or for as long as a ban on it lasts.
• Any ban decision about your account, and the report it rests on, for good.
• Blocks other people made, carried on that hash, until the person who made one lifts it.
• Reports filed about you and the other decisions about your account, for two years.
• The snapshot taken when a report was filed, for a year from the report.
• A record of when a moderator opened your record, for two years from that day.
• Anything a legal hold or a police request needs, until it no longer does.

Somebody banned for harming another member would otherwise be back the next morning on the same number, with every block against them gone. The hash cannot be turned back into a phone number.

What stays, exactly. Two years after an account is deleted, the hash of its phone number, the empty record of the account, and the reports and decisions about it are deleted. Some records last longer, and we would rather say so here than leave you to find it out.

• If the account was banned, the hash is kept for as long as the ban lasts, and a ban is permanent. The ban decision and the report it rests on are kept for good. Otherwise a person banned for harming somebody could come back simply by waiting, and a ban could not be explained or fairly lifted.
• Anything a legal hold, a child-safety case or a police request needs is kept until it no longer does.
• A report that a decision about another member rests on is kept as long as that decision is.
• Once the record of when a moderator opened a report is switched on (section 19.3), a report a moderator opened is kept until that record goes, two years after the opening.
• A block another member made is theirs, and lasts until they lift it, even after the report it came from is deleted.
• Reports the deleted account filed about other members are about them, and are kept on their accounts' periods.
• Reports and decisions hold no phone number or email address. The evidence snapshot kept with a report holds the first names and messages of its room for 12 months.
• The hash cannot be turned back into a phone number without a secret key that we keep. For 90 days after a deletion, the sign-in log still links the account to its phone number; after that, nothing does.
• Your beats and your seats end at once, and are removed on the schedule in section 11. Usuals saved on your phone stay there until you uninstall the app.
• No record of when a moderator opened your record is made at this stage, as section 19 explains.

Deleting your account also deletes your sign-in record's phone number and email address, and ends every session. The times you last changed your neighbourhood and your first name are deleted with it. Copies of the database in our backups age out on their own schedule, so something you deleted can remain in a backup for about a month.

If some of your records are under a legal hold, the deletion runs as far as it can — your name and your private details go — and the held records stay until the hold lifts. The confirmation tells you so.

13. Your rights

13.1 Getting a copy of what we hold

Under PIPEDA and BC PIPA you can ask what personal information we hold about you, what we have used it for, and who we have disclosed it to. Write to info@commonbeat.ca with enough detail for us to find your account, and we will answer within 30 days. If we need longer we will tell you why, within those 30 days.

Before we answer, we check that the request is yours, using the phone number or the email address on the account.

What you get is a machine-readable file of your own rows, with the companies in section 10 that have received your information. It will not contain other people's identifiers or names. A group has other members in it, and their information is not yours to receive, so those parts are redacted. If a redaction means the answer is hard to read, ask and we will explain it.

There is no charge.

13.2 Correcting it

You can change your first name in the app, but not while you are in a room that has not closed, and at most once every 30 days after your first day. You can change your one line and your email address there too. You can also change the neighbourhood you live in there, at most once every 7 days. Changes in the first 24 hours after you set up your account do not count toward that. For anything else, write to us. If we agree that it is wrong, we correct it, and tell any organisation we disclosed it to in the year before. If we disagree that it is wrong, we record that you asked.

13.3 Withdrawing consent, and deleting

Section 5 says how to withdraw your consent and what happens then. Section 12 says how to delete your account.

13.4 A person to look again

Section 9 lists the decisions software makes, and how to ask a person to look at one again.

13.5 Complaining

If we have not dealt with you properly, tell us first — info@commonbeat.ca — because we would rather fix it than be told to.

If that does not resolve it, you can complain to either regulator:

• The Office of the Privacy Commissioner of Canada, at priv.gc.ca, for the federal law.
• The Office of the Information and Privacy Commissioner for British Columbia, at oipc.bc.ca, for the provincial one.

If you live in Alberta, you can also complain to the Office of the Information and Privacy Commissioner of Alberta, at oipc.ab.ca. None of them costs anything and none requires a lawyer.

14. How we protect it

Everything is behind row-level rules in the database, which means a request reaches nothing unless a rule says so by name. The site you are reading reaches the database in only four ways. The first is one public, read-only call for a neighbourhood's status. The second is one public, read-only call for the list of neighbourhoods. For each neighbourhood, the list gives what the first call gives. That is its name, whether it is open, the number of sign-ups we publish as its target, its weekly hours, and how many people are waiting, only when that is five or more. It adds the municipality. Neither call holds anything about any person. The third, on the delete-account page, is your own sign-in code and the deletion you ask for, made as you. The fourth, from the link in one of our emails, is the request to stop those emails.

Information travels encrypted, and the database encrypts it where it is stored. One person can read member records, through a moderation console that sits behind two locks: Cloudflare Access, which emails that person a one-time code, and the console's own sign-in, with a second factor.

Each time your account is signed in, we tell you, and you can sign every other phone out from You. Backups are made on the operator's own computer in Canada, whose disk is encrypted, and each is encrypted with a 256-bit key before it is kept.

We are a small operation and we will not claim more than that. If you find a hole, write to info@commonbeat.ca with "security" in the subject line and we will answer. The security page says more.

15. If something goes wrong

If a breach of our safeguards creates a real risk of significant harm to you, we will tell you directly, as soon as we can. We will also report it to the Office of the Privacy Commissioner of Canada and to the Commissioner for British Columbia, and to the Commissioner for Alberta where its law asks.

We will tell you what happened, what information was involved, what we have done about it, and what you can do. We keep a record of every breach for at least two years, whether or not it had to be reported.

16. Children

CommonBeat is for adults. A new account needs you to be 19 or older, the age of majority in British Columbia. Until 2026-11-10 the minimum age was 18. An account opened at 18 before then is not closed, but it cannot put out a beat until its holder turns 19. An account we find was opened by someone younger than the minimum age at the time is closed. Where we find material involving a child, we preserve it and report it, as the terms describe and as Canadian law requires.

17. Text messages

Our texts come from CommonBeat, which Verota Technology Ltd. runs. We text only the one-time codes in section 3.6: one each time you ask for a code to sign in, or to delete your account on our website. CommonBeat does not charge for them. Message and data rates from your carrier may apply.

Reply STOP to any of our texts to stop them, and HELP for help, or write to info@commonbeat.ca. After STOP, we keep your number on our do-not-text list so that we never text it again by mistake.

We do not share your mobile number, or your consent to our texts, with anyone for their marketing or promotional purposes. Text messaging opt-in data and consent are not shared with any third parties. Twilio, which sends our texts, handles your number to deliver them for us.

The text messages page shows exactly how you agree to these texts in the app.

18. Our website

commonbeat.ca runs no analytics in your browser and sets one cookie, only on the account-deletion page. It lasts ten minutes, and it carries your sign-in from one step of the deletion to the next. The site is served by Cloudflare, which keeps short records of the requests it serves, with the IP address each came from.

Two pages use Cloudflare's bot check: the page the app opens before a sign-in code is sent, and the account-deletion page. The check runs in a frame from Cloudflare's own address. It reads signals from your phone or browser, such as the IP address and the browser it reports, to tell a person from a program.

The account-deletion page asks for your phone number and the code we text you. The page that stops our emails reads the code in its link, and a neighbourhood's page reads that neighbourhood's name from the link. No other page on the site reads who you are.

The links to Google Play and the App Store take you to those stores, and their own privacy policies apply there.

19. Things we have built but do not collect yet

A few features are built and switched off. We describe them here first because of the rule in section 2: if a purpose is not on this page, we are not allowed to do it. Each begins only on a date the history at the end of this page will record.

19.1 Where you are usually around, and how far you will walk

Not asked yet. The app asks none of the questions in this section. Some of the places that would hold the answers already exist in our database, and they hold nothing about you. The one for how far you will walk holds the same starting value, 15 minutes, for everyone, and nothing reads it. The others are empty. They are written here first because of the rule in section 2. So the page says it before the app asks it, and not the other way round. The questions begin only in a later release of the app, on a date the history at the end of this page will record.

Why we would ask at all, in one sentence: places you tell us you're regularly around, used only to find groups you can get to.

These are the rules those answers are held under. They are part of the policy, not a description of our intentions.

• A name, never a position. A home area is the name of a part of a neighbourhood, picked by you from a list. It is not a reading from your phone, it is not a fix, and it is not a cell. Nothing works out from it where in that part you live, and nothing tries to.
• Nothing to put together. Walking time is read from a table of minutes between named places. That table is worked out once and is the same for everybody, and it is about places, not about people. Nothing you answer here is turned into a distance between you and another person or a place, nothing of that kind is stored, and no distance of any kind ever leaves our database.
• A second place expires. An "anywhere else" area is dropped after 90 days in which no group was found through it. Two or three stored places begin to describe a person, so the second one has to keep earning its place.
• Places change slowly. A home area can be changed at most once a week. So can the neighbourhood you live in, as section 13.2 says. A place that can be changed hour by hour is a position under another name.
• No hints about where to meet. CommonBeat does not arrange meetings. It suggests no place to any group, and these answers do not change that.
• No count is ever small. Nothing we publish or show from these answers describes fewer than five people.

They are used to find groups you can get to, and for nothing else. They are not shown to other members. They do not order anybody in any list. No company but Supabase, which is the database itself, would receive them. If any of that were to change, this page would change first, with a new version.

What they would add to section 7, and what they would not. This is the part to read twice rather than take on trust. A home area and an "anywhere else" area are names you pick from a list. No reading is taken from your phone to fill either of them in, and neither is stored as a position. "Near me now" is the same 500-metre cell, used for one beat and not kept as a place afterwards. So once those questions are asked, the complete list of what CommonBeat holds about where you are reads:

• The name of the neighbourhood you live in.
• The name of the neighbourhood each beat you have out chose to meet in.
• A coarse cell, offset to your account and to nobody else's, for a beat you have out.
• The name of the part of your neighbourhood you chose as home.
• One more such name, if you gave one, until it expires unused.
• The number of minutes you said you would usually walk.
• The midpoint of the cells of the people in a room you are in, kept until the room closes.

That is the whole list. Nothing on it is a position of you more precise than your cell, nothing on it is a distance between you and anything, and there is still no map of members.

How long each would be kept: a walking limit and a home area, for the life of the account. An "anywhere else" area, until 90 days pass without it being used. A "near me now" cell, until its beat closes, and never more than 24 hours. A record of who invited you, 90 days after the invitation. An answer to "did your group meet?", 30 days, with its room.

19.2 Whether people come back

Not recorded yet. Once this is switched on, sending a beat also notes the day you sent it and the neighbourhood it chose to meet in. That is one line for each day and neighbourhood, with no time of day, no place finer than the neighbourhood and nothing else about the beat. It is kept for 90 days and deleted when you delete your account.

It answers one question about a whole neighbourhood: whether the people who wanted to go out one week came back within the next 7 or 28 days. It is only ever read as a count. Nothing about you is shown to anyone from it, no count we publish from it describes fewer than five people, and your own lines are in the copy of what we hold that you can ask for.

19.3 When a moderator opens your record

Not recorded yet. Once this is switched on, we keep a record each time a moderator opens a report's evidence or a member's page in the moderation console: who opened which record, and when. It answers "who has seen my record?", and it is kept for two years from each opening.

19.4 Other things that are switched off

• Your usuals, kept by us. Today your usuals stay on your phone. A later version may keep them with your account, so that they follow you to a new phone, for as long as the account exists.
• When you last opened the app. A later version may note the date, never the time, on which you last opened the app, kept for 14 days. It would be used only to tell whether a neighbourhood has enough people around to open.
• A test of a new way of putting groups together. It would record, for 14 days, the groups that a different way of grouping would have made, and make none of them. It is switched off.
• Photos. CommonBeat does not ask for a profile photo or a selfie at this stage, and a chat cannot carry an image. If photos ever return, this page changes first, with a new version.
• Anything about a meeting. CommonBeat does not arrange meetings, so at this stage it collects nothing about them: no check-ins, no shared plans, no trusted contacts and no duress records.

20. Changes to this policy

When this policy changes in a way that affects you, its version at the top changes, and so does the version of the terms. The app then asks you to read them and agree again before you carry on. The version and a hash of the exact text are published at /legal/versions.json.

Small corrections that do not change what we do — a typo, a broken link — happen without a new version, and the hash records them.

What changed from the first version

The first published version was dated 2026-09-13. The version dated 2026-09-16 followed CommonBeat's change to linking a group into a text chat and stopping there.

So from that version on, this policy no longer describes a photo, a selfie, check-ins, shared plans, trusted contacts or duress as anything we collect, because none of them is collected at this stage (Amendment 1 A1/A2/A5). Their retention and deletion rules are still listed, marked as applying only if such a record exists. The two location exceptions went with them. It also no longer said that message text goes to an outside moderation service, because at that stage none did. Version 2026-10-21 describes the one that now does.

The draft that circulated before the first version listed processors without their countries. Every version since has named them.

On 2026-09-16 the waitlist moved from the website into the app. The website no longer takes an email address. From that version until 2026-09-18 the app asked for one, with your consent, only while your neighbourhood was not open.

Later on 2026-09-16 the app started confirming that address with a six-digit code, sending a welcome email once it is confirmed, and sending both through Resend in the United States. The sender's name and postal address appear at the bottom of every email.

Version 2026-09-17, written on 2026-09-16: this policy now names Verota Technology Ltd. as the company that runs CommonBeat and is accountable for the personal information it holds, and as the sender named at the bottom of every email. The version before it named an individual. The privacy contact is the same address, and nothing about what we collect, how long we keep it or who receives it changed. The version is a date, and 2026-09-16 was already taken, so this one carries the next day's.

Version 2026-09-18, written on 2026-09-17: every new account now needs an email address. This policy says what it is used for: a code to confirm it, a welcome email and, if your neighbourhood is not open yet, one email when it opens, and nothing else. Before this version the address was optional and asked for only while a neighbourhood was not open, with a box to tick. The version is a date, and 2026-09-17 was already taken, so this one carries the next day's.

Version 2026-09-20, written on 2026-09-20: this version describes a set of questions the app does not yet ask. They are a walking limit, a home area, one more area you are often near, and a coarse cell for one beat. They also include an answer to "would you come?", the record of who invited you, and an optional answer to "did your group meet?". The new section says what each one would be for, and the rules they would be held under. A home area is a name rather than a position. A second area is dropped after 90 days unused. The answers would be used to find groups you can get to and for nothing else. Nothing in this paragraph is collected today, and this version is a draft. The app begins to ask only in the release that follows this version being in force, which is why the wording is published before the questions are.

Version 2026-10-13, written on 2026-10-13: this version adds the section "Whether people come back". It describes one line for each day you send a beat, holding the neighbourhood and the date and nothing finer. The line is kept 90 days, deleted with your account and read only as a count of whether people come back within 7 or 28 days. Nothing in this paragraph is recorded today, and this version is a draft. It begins in the release that follows this version being in force.

Version 2026-10-21, written on 2026-10-21: chat is now checked automatically for illegal and unsafe messages. This version says how, under "Messages". OpenAI's free moderation service scores every message, and Anthropic's Claude reads the ones it picks out with a few earlier messages for context. Neither receives a name, number or account identifier, and only a person closes an account. Both companies' rows in the table above now say what each receives and how long each keeps it, and that nothing is sent until the check is switched on. The check is switched on only once this version is in force.

On 2026-10-21 version 2026-10-21 went in force, signed by the operator as published. It is the first version of this policy in force. Two parts of it describe things that are still not collected, and each says so where it is described. They are the questions about where you are usually around and how far you will walk, and the record of the days you sent a beat. Each begins only on a date this history will record.

On 2026-10-23 the summary that opened this page, "The short version", was removed. It said that the sections below it are the policy, and every point it made is still in them, so the policy did not change and neither did the version.

Version 2026-10-29, written on 2026-10-29: we rewrote this policy in full, as numbered sections, and checked every statement in it against the product. It now covers your device record, sign-in sessions and the sign-in log, which is kept for 90 days. It also covers repeating beats and the new-sign-in notice, which makes four kinds of email rather than three. Further new parts are the decisions software makes and how to ask a person to review one, your consent and how to withdraw it, and breaches. It also covers text messages, the website, and Alberta's law. It says how long reports, bans and blocks really last after an account is deleted, and that the site reaches the database in three ways, not two.

On 2026-10-30 version 2026-10-29 went in force, signed by the operator as published.

This page first said that this version went in force on 2026-10-29, the day it was written. That date was corrected to 2026-10-30, the day it was published. Nothing else changed, so the policy did not change and neither did the version.

On 2026-11-09 the Twilio row in section 10 was corrected. It said that the number our texts come from is Canadian. From that day our texts come from a toll-free number, which is registered in the United States. Twilio still sends them, and what it receives and where it handles it did not change, so the policy did not change and neither did the version.

Version 2026-11-10, written on 2026-11-10: a new account now needs you to be 19, the age of majority in British Columbia, instead of 18. An account opened at 18 before then is not closed, but cannot put out a beat until its holder turns 19. A new account on a phone number with a Quebec area code is refused until the terms exist in French, and an account already open on one keeps working. Reports and decisions about a deleted account are now deleted two years after it. A ban decision and the report it rests on are kept for good, and so is what a legal hold, a child-safety case or a police request needs, until it no longer does. The midpoint of a room's cells is now cleared when the room closes, instead of 30 days later. A limit on an account now lifts on its own after 7 days, unless a report about the account is still open. The app's notice on the email step now names all four emails. Because the terms changed with this policy, the version changed and the app asks you to accept them again.

On 2026-11-10 version 2026-11-10 went in force, signed by the operator as published.

Version 2026-11-11, written on 2026-11-11: this policy now says that the website reaches the database in four ways, not three, because the page listing neighbourhoods reads them all in one public, read-only call that holds nothing about any person. It also says that the app's offer to send a beat every week is paused for now, and that repeating beats already saved are unchanged. The terms changed with this policy only to say that CommonBeat's neighbourhoods are across Metro Vancouver.

On 2026-11-11 version 2026-11-11 went in force, signed by the operator as published.

Version 2026-11-12, written on 2026-11-11: your neighbourhood is now the one you live in. It counts you toward that neighbourhood opening, and we tell you when it opens. It is no longer shown to the people in a room with you, who see the room's neighbourhood instead. Each beat now names the neighbourhood it meets in, chosen from those that are open, so a beat can go out while the neighbourhood you live in is still closed. A beat starts from your phone's position only when that is inside the neighbourhood you chose, and otherwise from that neighbourhood's centre, and the app sends the position only when it is inside. "Now" is offered only in the neighbourhood you live in and in a neighbourhood your phone's approximate position is inside. This policy also says how versions of the app from before this version, which have no "Meet in", still work. The neighbourhood you live in can be changed at most once every 7 days, and we keep the time you last changed it. This policy now also describes the rules for changing your first name, in force since 2026-11-10. It can be changed at most once every 30 days after your first day, and not while you are in a room that has not closed. We keep the time you last changed it. Both times are deleted with your account. The app now asks "Would you come?" while your neighbourhood is not open. This policy says what an "I'd come" holds, who sees its counts, that you can take it back, and that it is deleted after 90 days. A count under five is never sent to the app as a number. The offer to send a beat every week is back. Each repeating beat now has its own neighbourhood and goes out with both flexibility switches off, and the app asks before each week whether you are still on. The terms changed with this policy to say the same about beats and neighbourhoods.

On 2026-11-11 version 2026-11-12 went in force, signed by the operator as published.

This version was written for 2026-11-12 and was published a day early, on 2026-11-11, at the operator's request. It went in force when it was published, so on 2026-11-11 version 2026-11-11 was in force from midnight until then, and this version from then on.

21. Reaching us

Write to the privacy officer at info@commonbeat.ca. A person reads it, and every message is answered by email within the time the safety page promises.