Privacy policy

Who we are and how to contact us

TCHF is a registered Ontario charity. We run My TCHF, which connects volunteers with neighbours who need a hand, starting with Shovel For Seniors (snow clearing) and Donate Blood with TCHF.

We follow Canada's private-sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), and its fair information principles.

Our privacy officer is the President of TCHF, who is responsible for how we handle personal information. Contact them at:

• Email: info@tchf.ca (please write "Privacy" in the subject line)
• Mail: Privacy Officer, Trillium Community Help Foundation, 2030 Bristol Circle, Suite 210, Oakville, ON

What is available now and what is coming

My TCHF is the website my.tchf.ca and the My TCHF phone app (Android and iPhone). With it you can ask for help at home, volunteer, join Donate Blood with TCHF, donate, and talk to TCHF. TCHF staff use a staff area to run it. This policy covers the website and the app.

Available today: households and requests for help (with photos and a map pin for the home), messages between a home and its volunteer, support conversations with TCHF, volunteer applications and checks, guardian consent for volunteers under 18, confirmation letters for police record checks, shifts, hours and hours letters, location during shifts, alerts to volunteers about homes near them, Donate Blood with TCHF, and donations with official receipts. When we add or change a feature in a way that affects your information, we update this policy.

What we collect

We collect information from you directly, from the people who manage a household with you, from our service providers (such as Stripe), and from how you use the app. What we collect depends on how you use My TCHF.

Why we use your information

We use your information only for these purposes:

• To create and run your account, sign you in and keep your account secure.
• To approve households, match requests with volunteers, and tell households when a volunteer is coming and when the job is done.
• To keep residents safe: to check volunteers' identity and police record checks, get guardian consent for minors, and record the volunteer agreement.
• To record volunteer hours and provide hours letters, for example for Ontario high-school community-involvement hours.
• To send you emails and in-app messages about your account, requests, checks and volunteering.
• To answer your questions and support requests.
• To keep records of donations and issue official donation receipts for income tax purposes.
• To report to our board, funders and the public using totals only (for example, hours volunteered in a city), never your name without your consent.
• To protect the service, prevent misuse and meet our legal duties.

We do not use your information for advertising, and we do not sell it or rent it to anyone.

Your consent and how to withdraw it

When you create an account, you tick a box to agree to this policy. We ask again, in plain words, when a feature needs something more, such as the identity check, the police record check, photos or guardian consent. Some things are needed for a service to work: for example, we cannot send a volunteer to a home without an address, and we cannot activate a volunteer without the required checks.

You can withdraw your consent at any time by emailing info@tchf.ca. We will explain what it means for you — for example, you may no longer be able to volunteer or request help. Withdrawing consent does not undo what we did before, and we may need to keep some records for the time explained in "How long we keep things".

Who we share it with

We never sell your information, and we do not share it for advertising. Inside TCHF, staff see only what they need for their role, and city coordinators see only their own cities. In staff lists of users and volunteers, only Admins see each person's age (worked out from their date of birth).

We share information only in these cases:

• Within a household. The people who manage a household can see its requests, status updates and photos. Households see the volunteer's public name, their expected arrival time and the messages about the visit, never the volunteer's legal name, phone, address or location.
• With the volunteer on a job. The volunteer assigned to a job sees what they need to do it: the address, access notes, what needs clearing and the request photos. Volunteers never see the age or health answer about the person who needs help.
• With guardians. A guardian can see their linked minor's checks, shifts, jobs and hours, and receives copies of the minor's job updates.
• With police services — only through you. We do not send your information to the police. You take your confirmation letter to your police service. A police service can confirm the letter on our verify page if it has both the Digital Document ID and the issue date.
• With Canadian Blood Services — we don't. You join TCHF's team directly with Canadian Blood Services, under their own privacy policy. They show TCHF only team totals, not names. The bookings and donations you log in My TCHF are only what you choose to report to us.
• With service providers who run parts of My TCHF for us. They may use your information only to provide their service to TCHF.
• When the law requires it, for example a court order, or to protect someone's life, health or safety in an emergency.

Our service providers are:

• Supabase — our database, sign-in and private document storage (Canada Central region).
• Vercel — hosts the website and app.
• Cloudflare R2 — private storage for photos, support attachments and archived records.
• Stripe — identity checks (Stripe Identity) and donations.
• Google — optional "Continue with Google" sign-in, and Gmail SMTP, which sends our emails (such as sign-in links and updates) from app@tchf.ca. Replies go to info@tchf.ca.
• Google Analytics and Google Tag Manager — only if you click Accept on the cookie notice, Google counts visits to the pages of my.tchf.ca and how people found us (for example, from one of our emails). Before a page address is sent, we remove record numbers, invitation codes and everything else that could identify you or your home, and we never send your name, email, account or anything you type. TCHF staff pages are never measured. Google's advertising features are turned off. The My TCHF phone app does not use Google Analytics.
• Expo, Google Firebase and Apple send notifications to your phone when you use the My TCHF app. We keep your phone's notification code (a token, not your phone number) linked to your account. A notification is a short line, the same as the notice in the app; it never includes the text of a message.
• OpenStreetMap services (Photon and Nominatim) — when you type a household address, we send what you type to these free OpenStreetMap-based address lookup services to find suggestions and coordinates. We store the coordinates, not the raw address lookup. Until a volunteer accepts a job, they see only an approximate area, not the exact address. If a volunteer gives a postal code for home alerts, we send only that postal code to Nominatim to find its rough location.

Photos and location

• Photos help your volunteer see what is needed and show that the job was done.
• Photos are made smaller and location data (GPS) is removed from the photo file before it is stored. If a photo still has hidden location data, we reject and delete it.
• Separately, when a volunteer adds a before or after job photo, we record where the photo was taken (the phone's location at that moment, if the volunteer allows it), to confirm the job was done at the right address. This is kept apart from the photo and is visible only to TCHF staff, never to households, Family & friends or other volunteers. If the volunteer does not share their location, the photo still uploads and is marked "location not captured".
• Photos are kept in private storage. Only the people who manage the home, the volunteer who took them and TCHF staff can see them, through links that stop working after a few minutes.
• Before and after photos taken by the volunteer are required for the service: volunteers must take them at every job, showing only the work area. Adding your own photos to a request is optional. We use a photo publicly (social media, newsletters, reports) only if you say yes separately.
• Your volunteer moments. Volunteers may choose to email photos, or links to videos, of their volunteering to info@tchf.ca. TCHF may share them on its social media and in its emails. Please don't show residents' faces, house numbers or addresses, and send photos of other people only if they said yes. Volunteers under 18 should ask their parent or guardian first. You can ask us to remove a post at any time by emailing info@tchf.ca.

Volunteer location during shifts. This applies to every TCHF program with in-person volunteering, including Shovel For Seniors, Lawn Care for Seniors, Promote TCHF (such as door knocking and flyer delivery) and future programs, and only if the volunteer allows location access.

• Why we record it: to keep volunteers safe, to confirm that a visit or activity really happened, to look into complaints or incidents, and to send the nearest volunteer when help is needed.
• In the My TCHF phone app: we record the phone's location at each check-in (start shift, on my way, arrived, done, and when a job photo is taken), and about every 3 minutes or every 150 metres while a shift is running. Recording stops when the shift ends or is paused. While it is on, the phone shows a "Location on" notice.
• On the website: we record location only at those check-in moments, only while the page is open, and only if your browser allows it.
• When we do not record it: outside shifts, while a shift is paused, for online tasks (such as sharing on social media), or when a volunteer has no phone. TCHF staff may also check a volunteer in or out on their behalf.
• Location is not needed to sign up, book shifts or volunteer online. For an in-person home visit, marking Arrived and Done asks for your location once, to confirm you are at the address. If you seem far from the home's map pin (for example, when the pin is in the wrong spot), you can confirm you are there: we save where you are, and TCHF staff see that it was far from the pin. If your phone cannot give a location, your coordinator can confirm the step for you.
• Who can see it: TCHF staff (including coordinators for that city) can see a volunteer's current position only while their shift is active. The full location history is available only to TCHF Admin and Operations staff, and only for audits, complaints or incidents. Volunteers can see their own shift trail. Households, Family & friends and other volunteers never see a volunteer's location. Households see only an expected arrival time (for example, "around 2:40 pm").
• How long we keep it: locations saved at check-ins (start shift, on my way, arrived, done and job photos) are part of the service record that proves the visit or activity happened. We keep them with the shift and job, and with the volunteer's hours records, for 7 years (the same period as TCHF's volunteer service records). The in-between location points recorded every few minutes during a shift are deleted automatically after 90 days.
• Volunteers under 18: the same rules apply. The parent or guardian's consent includes this location recording.
• You can withdraw consent at any time by turning off location for My TCHF in your phone or browser settings, or by emailing info@tchf.ca. Recording during shifts then stops. Marking Arrived and Done at a home will ask for your location again, or your coordinator can confirm those steps for you.
• We protect location data with encryption, limit access by staff role and log who views location history. We never sell location information or use it for advertising.

Children and youth

• People under 18 can volunteer with Shovel For Seniors only with the consent of a verified parent or guardian. The guardian must pass Stripe Identity, confirm the minor's date of birth and sign consent for the service and season.
• Under Ontario and federal law, police services generally do not give record checks to people under 18 for a charity like TCHF. So minors do not do a police record check or an identity check.
• A guardian can see their minor's activity and can pause them at any time.
• A minor's information is visible only to their guardians and TCHF staff, except that a home they help at sees their public name, expected arrival time and messages about the visit.
• Volunteers aged 14 to 17 can take outdoor home jobs on their own, in daylight only, and never go inside a home. Their guardian gets copies of their job messages.
• People under 18 are never TCHF staff.
• Canadian Blood Services sets its own minimum age to donate blood.

How long we keep things

We keep personal information only as long as we need it for the purpose we collected it, or as long as the law requires. Then we delete it or make it anonymous (so it can no longer identify you). Our current rules are:

• Police record checks, identity check results, guardian consent, volunteer agreements, signed agreements (Get Help, Donate Blood, staff confidentiality) and confirmation letters: kept as a permanent safety record, by default for 7 years after your last activity with TCHF. We keep them even after you stop volunteering, so we can show that volunteers were properly checked.
• Job and request photos: deleted automatically after 30 months (913 days). Photos you or a volunteer upload that are never attached to a saved request, job or message are deleted after 1 day.
• Shift locations: locations saved at check-ins (start shift, on my way, arrived, done and job photos) are kept with the service record for 7 years; the in-between points recorded every few minutes during a shift are deleted automatically after 90 days.
• In-app messages you have read: deleted after 90 days.
• Our security log (audit log): kept in the database for 12 months, then moved to a private, compressed archive.
• Emails we send you: we keep a record of every email My TCHF sends: the address it went to, the subject, what it said, which of our email accounts sent it, when, and whether it was delivered. We keep it as proof of what we told you and when, and to answer questions and complaints. It is kept for 7 years after the email is sent, then deleted, including after your account is deleted. Only TCHF Admins can see it.
• Invitation links: household invitations stop working after 7 days; guardian invitations after 14 days.
• The ID town result (same, different or not sure) is kept with your identity check result, as a safety record.
• Hours letter requests (dates, hours, who asked and the decision) are kept with your hours records.
• Phone notification codes are deleted when you sign out on that phone, when the phone stops accepting notifications, or when someone else signs in on it.
• Health Essentials records (organizations, individual recipients, needs, pledges, purchases and distributions): kept for as long as the program needs them for planning and reporting, and by default for 7 years (charity books and records), then deleted or made anonymous. An individual recipient can ask TCHF to delete their record sooner, unless the law requires us to keep it.
• Everything else — your account, households (including the age and health answer about the person who needs help), requests, support conversations, hours, Donate Blood reports and donation records: kept as long as needed for the purpose, then deleted or made anonymous. Donation records and donation receipts are kept for at least 2 years after the end of the calendar year they relate to, as Canada Revenue Agency requires, and by default for 7 years (charity books and records).

Deleting your account. You can ask us to delete your account from your Profile ("Delete my account"), or by writing to our privacy officer. An Admin checks the request and we respond within 30 days, as Canada's privacy law (PIPEDA) requires. We email you when we receive the request, and again when the account is deleted or, if we cannot delete it yet, to tell you why. You may first need to finish or cancel any booked shifts, jobs or open Get Help requests. When we delete an account we:

• remove your name, email, phone number, date of birth and address, and your emergency contact details;
• remove the address and contact details of any household only you manage, and close it (households you share with others stay with them);
• remove your staff roles, Donate Blood membership, notifications and availability;
• take you off the list of people who agreed to hear from us (Contacts);
• stop you from signing in, for good (including Google sign-in).

Some records must be kept for the times shown above even after your account is deleted: signed agreements, identity and police record check results, guardian consent, confirmation and hours letters, donation records and receipts, hours worked, and our security log. We keep them without your name, under an internal ID number, and delete them when their time is up. Our record of the emails we sent you is the exception: it keeps the email address and what each email said, for the 7 years shown above, so we can show what we told you and when. Messages in support conversations stay with the conversation. Deleting an account cannot be undone.

How we protect your information

• All information sent between your device and My TCHF is encrypted in transit (HTTPS).
• Access controls in the database itself make sure each person sees only what they are allowed to see, on the web and in the app.
• Staff access is based on their role: Admins, Operations managers and City coordinators each see only what their job needs, and coordinators see only their own cities.
• Police record checks and other private documents are kept in storage that only staff can read. Files are shared only through links that expire quickly.
• An audit log records who changed what, and when.
• On the website, we sign you out after a time without activity: TCHF staff after 30 minutes, everyone else after 24 hours. The My TCHF phone app is not affected.
• We limit how often forms can be used, to stop misuse, and our secret keys are never stored in our code.
• If a privacy breach creates a real risk of significant harm, we will tell you and report it to the Office of the Privacy Commissioner of Canada, as the law requires.

Where your information is stored

Our main database, sign-in system and private document storage are hosted by Supabase in its Canada Central region. Some of our service providers (including Vercel, Cloudflare, Stripe, Google, Expo, Apple, and the OpenStreetMap-based services we use for address lookup and map tiles: Nominatim, Photon and OpenFreeMap) may process or store information outside Canada, for example in the United States. When that happens, your information may be available to that country's courts, police and government under its laws.

Place names

City and town names and their approximate locations come from the GeoNames geographical database. Place names from GeoNames, licensed [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) — see [geonames.org](https://www.geonames.org/).

Your rights

You have the right to:

• See the personal information we hold about you.
• Correct it if it is wrong. You can update much of it yourself in your profile.
• Withdraw your consent (see "Your consent and how to withdraw it").
• Ask us to delete your account and information (from your Profile or by email), subject to the records we must keep.
• Ask questions or complain to our privacy officer at info@tchf.ca.

We will answer within 30 days. We may need to confirm your identity first. If you are not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada: www.priv.gc.ca or 1-800-282-1376.

Cookies

We use essential cookies that keep you signed in and keep your session secure, a short-lived cookie that remembers a household invitation while you sign in, and a cookie that remembers your cookie choice. These are always on.

Sign-out cookies. Two small cookies of our own sign you out of the website after a time without activity (see "How we protect your information"): tchf_seen holds the time of your last activity, and tchf_staff remembers whether your account is a staff account (we check again every hour). They last up to 30 days and are removed when you sign out. They are needed for security, so they are always on and do not need your consent.

Analytics cookies (optional). If you click Accept on the cookie notice, Google Analytics sets cookies (their names start with _ga) so we can count visits and see which pages are used, and improve My TCHF. We do not use them for ads. If you click Decline, or make no choice, no analytics cookies are set and nothing from Google Analytics loads. You can change your choice at any time with Cookie settings at the bottom of the website or on your Profile page; if you decline, we delete the analytics cookies. We remember your choice for 12 months, then ask again.

We do not use advertising cookies. The app may also save some pages on your device so it can show a message when you are offline. The My TCHF phone app does not use analytics.

Changes to this policy

We may update this policy as we add features or when the law changes. We will change the version and date at the top and bottom of this page. If a change is important, we will tell you by email or in the app before it takes effect.

Effective date and version

• Version 0.10
• Effective 16 October 2026
• Last updated 16 October 2026