Privacy Policy

Last updated: July 21, 2026

Panoui! is built to respect your privacy. You can use most of the app without an account, and if you choose to create one, you stay in control of your data and can delete it at any time. This policy explains what we collect, why, and for how long. It reflects what the app actually does today, and it will be updated if that changes.

Using the app without an account

No sign-up is required to browse the map. Settings you set while signed out, like your permit zones, watched spots, parked-car and chosen language, are stored only in your browser's local storage, on your device.

Accounts and how you sign in

Accounts are optional and add cross-device sync, saved spots, the community features, and problem reports. We use a sign-in service (better-auth) and you can sign in with an e-mail magic link or one-time code, an e-mail and password, or Google. We store your e-mail address, a password only if you set one (hashed, never in plain text), and, if you use Google, the basic profile Google shares. You also get a nickname you can change, and your language preference is stored on your account so it follows you between devices.

Your synced profile

If you're signed in, your profile is synced to our server so it follows you between devices. It contains: your vehicles (including licence plates and fuel type, gas or electric, only for the details you choose to fill in), your permit zones, your saved and watched spots, your parked-car location and an optional photo (the photo is kept only for the current parking session and is discarded when the session ends), and your app settings. You choose what to put in here; you can leave plates, fuel type, and photos out.

Live presence (drivers nearby)

Live presence is optional and off until you turn it on. The first time you open the map signed in, we ask whether you want to share; you can change your choice anytime in Profile ("Share my live position"). Sharing is mutual: you see other drivers only while you share too. When you have sharing on and the app is open, it shares your live position and heading so other members can see that drivers are around. To others you appear as an anonymous car marker in the skin you picked, with no name or identity attached, and the position is coarsened to about 100 m so nobody can follow one specific car. We keep no movement history: these rows are deleted within about ten minutes of your last update, including if you close the app or go offline. While sharing, you can additionally turn “Show me to others” off in Profile: your car is then hidden from other members' maps, but you're still counted anonymously in the “drivers nearby” totals. The counts you see (“N drivers nearby”, “parked here today”) are aggregate numbers, not people, and appear whether or not you share.

Driving distance and drive points

Drive points ride on live presence, so they also apply only if you have turned sharing on. While sharing is on, the app is open and you are signed in, the server compares your consecutive location updates to work out how far you have driven that day, so it can award drive points once you cross a distance threshold. Only a running daily-distance total and your latest position are kept for this; we never build or store a route or trajectory of where you have been. Like the rest of your live presence, this is deleted within minutes of you going offline, and the daily total resets each day.

Community check-ins

When you park with the app or mark a spot freed, we store the spot's coordinates (rounded to about 1 m) with your account. These power the freed-spot signals and the aggregate counts other members see; we never store your route or movement between spots.

Points and leaderboard

We keep a ledger of the points you earn from contributions (parking, marking spots freed, driving with the app live, reports, and approved sign scans). Your nickname and total points are visible to other members on the leaderboard. Your e-mail and identity are not shown there. Points and levels are a deterministic scoring system based on your own contributions; see “No automated decisions” below.

No automated decisions

The app does not make automated decisions that produce legal or otherwise significant effects about you. Points, levels, and leaderboard rank are simple, deterministic gamification, not profiling: they are computed directly from actions you took, and nothing about your account or access is decided by an algorithm without a person able to review it.

AI sign scan

When you photograph a parking sign for a reading, the photo is sent to Google (the Gemini API) to read it, along with the map coordinate of where you placed the sign (used only as locality context). We do not store the image ourselves. We record only the AI token usage for cost tracking, with no image or text content. If a staff member captures a reading for map corrections, the reading (its text and coordinates, not the image) goes into an internal review queue and may be approved into a map correction.

Location

If you allow it, your device's location centres the map, finds nearby parking, and powers live presence and drive points as described above. When you submit a report, the coordinates of that specific spot are attached to it.

Usage analytics

To understand which features are used and to improve the app, we log minimal usage events: a feature or event name, a timestamp, your app version, and a coarse platform (iOS / Android / other). No location and no personal content travel in these events. They are tied to your account while signed in, and used only to guide product decisions, never for advertising. We keep the raw events for 90 days, then keep only daily aggregate counts.

Notifications

If you enable background alerts, we store your browser's push subscription and mirror your parking timer on our server so a scheduled task can send the heads-up and time-up alerts even when the app is closed. Expired parking timers are cleared from our server within 24 hours.

Devices

We track up to three devices per account, each with a name and platform derived from your browser's user-agent, so you can stay signed in on your devices and so an admin can see and, if needed, block a device.

Referrals and invitations

If you invite a friend, we store the e-mail address you invite, tagged with the fact that you invited them, so we can send the invitation and let you manage it. Anyone you invite can write to [email protected] to have their e-mail address removed from our records.

E-mails

We send transactional e-mails (sign-in links and codes, ticket replies, account and deletion confirmations) and occasionally a product announcement. These go out through Resend.

Anti-leak watermark

During the private pilot, your signed-in e-mail is drawn faintly across the screen so any screenshot is traceable to who shared it. This is drawn in your browser only and is never sent anywhere.

Where your data is stored

Panoui! runs on Cloudflare's global infrastructure. Depending on the service, your data may be stored and processed on servers located outside Quebec and Canada, including in the United States or the European Union. By using the app, you acknowledge this cross-border storage and processing. Wherever your data is held, it travels encrypted in transit, is encrypted at rest, and is protected by access controls that limit who can reach it, and it remains subject to this policy regardless of where it is processed.

Service providers

We use trusted providers to run Panoui!: Cloudflare (hosting, database, and storage, including nightly database backups kept about 30 days), Resend (e-mail), Google (Google sign-in, and the Gemini model for sign scans), and open map/geocoding providers for tiles and address search. Some requests include your IP address and are handled under those providers' own privacy policies. We also display Environment Canada and City of Montreal open data in the app; that is public information, not your personal data. Staff actions in our admin tools are logged for accountability. We do not sell your personal, identifiable information, and we do not use ad trackers or advertising cookies; the only cookie we set is the one that keeps you signed in.

Aggregated and published statistics

If we ever publish or make commercial use of usage or parking-demand insights (for example, general patterns of where and when spots free up), those statistics will be irreversibly anonymized in accordance with applicable regulations, computed only in aggregate, and will never identify you or any other individual.

How long we keep it

Account data is kept while your account exists. Live-presence rows and daily driving-distance totals are deleted within about 10 minutes of your last update. Raw usage events are kept 90 days, then only as daily aggregates. Nightly database backups are kept about 30 days. Expired parking timers are cleared from our server within 24 hours. Records of pilot signups (the name and NDA acceptance captured at the entry gate) are kept as a record of that agreement, independently of your account.

Delete your account

You can delete your account from within the app. For safety, we e-mail a confirmation link to your own address, and the account is erased only when you confirm it. Deleting your account permanently removes your account, sessions, and synced profile, including vehicles and plates, permits, saved spots, park history, and settings, along with your points ledger, registered devices, push subscriptions, and parking timers. Your reports are anonymized rather than deleted outright: your e-mail and identity are removed from them, but the report text, location, and any photos may be retained in anonymized form so the map data they contributed to stays accurate. You can also remove your parked car and other locally stored data from the map at any time, whether or not you have an account.

Your rights (Quebec, Law 25)

You may access, correct, or delete your personal information, and withdraw consent, at any time; deleting your account does this for the data described above. You can also request a copy of your personal information in a structured, commonly used format. Until self-serve export is available in the app, write to our privacy officer, Igal, at [email protected], and we will provide it. Use the same address to exercise any of your rights or to ask a question.

Age

Panoui! is intended for licensed drivers and is not directed at children. You must be at least 16 years old to create an account; under Quebec law, anyone under 14 additionally needs a parent or guardian's consent before we can collect their personal information, and we do not knowingly collect it from a child that age without it.