HeyBloo Family — Privacy Policy

Version	v1.0-2026-05-15
Effective Date	2026-05-15
Operator	Plentidots, a sole proprietorship in Ontario, Canada

1. Introduction and Scope

Plentidots, a sole proprietorship, an Ontario-registered business, operates the HeyBloo Family platform (the "Platform"), a free discussion forum for parents and caregivers. This Privacy Policy explains how Plentidots collects, uses, discloses, and protects personal information in connection with the Platform.

This Privacy Policy applies to the HeyBloo Family forum only. It does not govern the HeyBloo merchant or business-listing products, which have separate privacy practices.

By creating an Account or using the Platform, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy, read together with the Terms of Service. If you do not agree, you must not use the Platform.

Plentidots' practices are designed to comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. Quebec's Act respecting the protection of personal information in the private sector (Loi 25) has not been specifically assessed for this MVP; the Platform is Ontario-primary. Revisit if Francophone Quebec residents represent a material portion of users.

2. Definitions

For the purposes of this Privacy Policy:

• "Personal Information" means information about an identifiable individual, as defined under PIPEDA and applicable provincial law.
• "Sensitive Information" means Personal Information that, if disclosed without authorisation, could cause significant harm to the individual (e.g. health information, financial information, information about children).
• "Anonymous Content" means Content submitted under an anonymous handle as described in Section 5.4 of the Terms of Service. The public display omits the User's identity; however, Plentidots retains an internal link between the post and the Account for moderation and legal-compliance purposes.
• "Account," "Content," "Platform," "User," "Moderator," "Admin" have the same meanings as in the Terms of Service.

3. Information We Collect

3.1 Account Information

When you register, we collect:

• Email address;
• Password (stored as a secure hash by our authentication provider, not in plaintext — Plentidots does not have access to your raw password);
• If you sign in via Google OAuth: your Google account ID, display name, and email address as provided by Google.

3.2 Profile Information

You may optionally provide:

• Display name (public-facing username);
• Anonymous handle (displayed instead of your name when posting anonymously);
• Profile bio or description.

3.3 User-Generated Content

We collect and store all Content you submit to the Platform, including:

• Thread posts and replies;
• Reactions (e.g. likes, emoji responses);
• Saved collections and followed content;
• Uploaded images and file attachments;
• Reports filed by you about other Users' Content.

Content you post publicly (including under an anonymous handle) may be visible to any visitor of the Platform, including signed-out visitors. Anonymous Content is displayed without your identity, but the internal linkage is retained as described in Section 8.

3.4 Usage and Log Data

We automatically collect certain technical data when you use the Platform, including:

• IP address;
• Browser type and version;
• Device type and operating system;
• Pages and content accessed, and timestamps;
• Referring URLs.

This data is collected via our operational logging infrastructure in Canada (Toronto region) and is used for security, abuse detection, and service operation.

3.5 Cookies and Similar Technologies

We use session cookies to maintain your authenticated session. These cookies are set by our authentication service and are strictly necessary for the Platform to function. We also use Google Analytics 4 to understand, in aggregate, how the Platform is used. Analytics operate under Google Consent Mode: analytics storage and the analytics cookie are denied by default and are enabled only after you accept the Terms of Service and this Privacy Policy at sign-up. We never send the analytics provider your name, email address, the content of your posts, or your search queries; where a signed-in identifier is sent, it is a one-way SHA-256 hash that cannot be reversed to your account. We do not use advertising cookies, and we do not use analytics for individual profiling or advertising. See Section 12 for details and how to opt out.

4. How We Use Your Information

Plentidots uses your personal information for the following purposes:

• Service operation: To create and maintain your Account, authenticate you, display Content, and enable Platform features.
• Moderation and abuse prevention: To investigate reports, take moderation actions, and — where necessary — identify the account behind Anonymous Content for abuse-investigation purposes, as disclosed in the Terms of Service and Section 8 of this Policy.
• Communications: To send transactional emails (e.g. account verification, password reset, material Terms or Privacy Policy updates). We do not send marketing or promotional emails without your explicit opt-in.
• Security and fraud prevention: To detect, prevent, and investigate unauthorised access, abuse, or illegal activity.
• Service improvement: To understand how the Platform is used in aggregate (no individual profiling for advertising purposes).
• Legal compliance: To comply with applicable laws, court orders, or regulatory requirements.

5. Legal Basis for Processing

Under PIPEDA, Plentidots relies on the following legal bases for processing Personal Information:

• Consent: Your consent at sign-up (acceptance of the Terms of Service and this Privacy Policy) is the primary basis for collecting and using your information. You may withdraw consent as described in Section 10.
• Legitimate interests: For security, fraud prevention, abuse detection, and moderation, where these interests do not override your privacy rights. These processing activities are necessary to operate a safe online community and are proportionate to the privacy impact.
• Legal obligation: Where processing is required to comply with applicable law (e.g. responding to a valid court order or fulfilling PIPEDA breach-notification obligations).

6. Information Sharing and Third Parties

6.1 Service Providers (Sub-Processors)

We share Personal Information with the following third-party service providers to operate the Platform. Each provider processes data only as necessary for the stated purpose and is subject to confidentiality and security obligations. Where a provider is hosted in the United States, the transfer relies on PIPEDA adequacy assessment and standard contractual clauses where contractually available. See Section 13 for full cross-border transfer disclosure.

Category	Purpose	Data Shared	Location
Authentication & identity infrastructure provider	Sign-in, session management	Email, password hash, session tokens	United States (cross-border)
Cloud database provider	Forum content storage	Threads, replies, reactions, user IDs	Canada (Toronto)
Cloud object storage provider	Media uploads	User-uploaded images and files	Canada (Toronto)
Search infrastructure provider	Indexed content for search	Public-thread index data	United States (cross-border)
Operational logging provider	Monitoring and abuse prevention	IP, request metadata	Canada (Toronto)
Google OAuth (when user chooses Google sign-in)	Sign-in identity exchange	Name, email from Google	Global
Analytics provider (Google Analytics 4)	Aggregate usage measurement (consent-gated)	Pageviews, in-app events, and a one-way hashed user identifier; never name, email, post content, or search text	Global / United States (cross-border)
Transactional email provider	Account confirmation, password reset	Email address, transactional content	Canada (Toronto)

6.2 Legal Disclosures

Plentidots may disclose Personal Information to government authorities, law-enforcement agencies, or courts where required by applicable law, court order, or valid legal process. Where legally permitted, Plentidots will attempt to notify affected Users of such disclosures.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of Plentidots' assets, your Personal Information may be transferred to the successor entity. We will notify you of any such transfer via in-product notice or email and will require the successor entity to adhere to this Privacy Policy or provide you with notice of any material changes.

6.4 No Sale of Personal Information

Plentidots does not sell your Personal Information to any third party.

7. Children's Information

The Platform is not intended for users under 18 years of age. Plentidots does not knowingly collect personal information directly from individuals under 18. Sign-up requires an age attestation confirming the user is 18 or older.

The Platform's subject matter involves discussion by adult parents about their families. Parents may share information about their own children in the course of their posts. This information is provided voluntarily by the parent User and is subject to the same Terms of Service and Privacy Policy applicable to all UGC. Plentidots applies PIPEDA-compliant best-effort treatment to any children's information that appears in UGC. Users are responsible for what they choose to share about their own family. Users must not post identifying information about minors other than their own children without the consent of that child's parent or guardian.

If you become aware that a minor has created an Account or that information about a minor has been shared inappropriately, please contact hello@heybloo.ca so we can take appropriate action.

8. Anonymous Content Privacy

When you choose to post using the anonymous-posting feature (where enabled), the following applies:

• Your public display name and account identity are not shown to other Users or visitors. Your Anonymous Post is attributed only to the anonymous handle you have configured.
• Plentidots retains, internally, the link between your Anonymous Post and your Account. This linkage is used exclusively for: (a) moderation and enforcement of the Terms of Service; (b) responding to legally valid requests (e.g. court orders) to identify the author of harmful Content; and (c) internal abuse investigation. The linkage is not used for any advertising, profiling, or commercial purpose.
• The existence of this linkage is disclosed to you at sign-up via the Terms of Service (Section 5.4) and in this Privacy Policy. By accepting the Terms of Service and this Privacy Policy at sign-up, you consent to this retention. No additional consent is required at the point of posting.
• If you delete your Account, anonymous posts that remain on the Platform will have their internal account linkage removed or anonymised within 30 days of account deletion, subject to any legal-hold obligations.

9. Data Retention

Data Category	Retention Period	Notes
Account data (email, profile)	Duration of active Account; deleted or anonymised within 30-day soft-delete grace period following account deletion	30-day grace period allows recovery of accidental deletions
User-generated Content	Anonymised and retained post-account-deletion (identifying info purged within 30-day grace period)	Anonymised UGC preserved to maintain thread continuity for other users.
Operational logs (IP, request metadata)	90 days default; extended for active security incidents or legal holds (no fixed cap for investigation purposes)	Extended retention is investigation-purpose only and not used for profiling
Soft-deleted records	30-day grace period before hard deletion	Allows recovery of accidental deletions during grace period
Moderation records	Duration of Platform operation or until no longer needed for legal-compliance purposes	Retained for moderation-history and potential legal-compliance purposes; subject to PIPEDA minimum-necessary principle
Anonymous post — account linkage	Removed or anonymised within 30 days of account deletion, subject to legal-hold obligations	See Section 8 for full disclosure

Upon account deletion, Plentidots will initiate deletion or anonymisation of your Personal Information within 30 days of confirmed account deletion, subject to any legal-hold obligations.

10. Your Rights

Under PIPEDA and applicable law, you have the following rights with respect to your Personal Information held by Plentidots:

• Access: You may request a copy of the Personal Information we hold about you.
• Correction: You may request corrections to inaccurate or incomplete Personal Information.
• Deletion: You may request deletion of your Account and associated Personal Information. Deletion is subject to legal-hold obligations and the UGC retention terms described in Section 9.
• Portability: You may request an export of your Personal Information in a structured, commonly used format.
• Withdrawal of Consent: You may withdraw consent to optional processing at any time. Withdrawal of consent to essential processing will require account deletion.
• Complaint: If you believe Plentidots has not handled your Personal Information appropriately, you may file a complaint with the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca or by calling 1-800-282-1376.

To exercise any of these rights, contact hello@heybloo.ca. Plentidots will respond within 30 days of receiving a verifiable request, as required by PIPEDA.

11. Security Measures

Plentidots implements the following technical and organisational measures to protect your Personal Information:

• Encryption in transit: All communications between your browser and the Platform are protected by HTTPS/TLS.
• Encryption at rest: Data stored in our cloud database and object storage providers is encrypted at rest using provider-managed keys. Sensitive configuration values are encrypted using cloud key management services.
• Access controls: Least-privilege access controls are applied to all infrastructure. Production environments are segregated from development environments.
• Authentication: Session management is handled by our authentication provider, using JWT-based tokens with appropriate expiry.
• Bridge-layer enforcement: All API requests pass through the cm-app-service authentication layer before reaching any backend data service.
• Audit logging: Sensitive operations are logged in our operational logging infrastructure for audit and security-incident investigation purposes.

No security measure is perfect. In the event of a data breach involving your Personal Information, Plentidots will notify the Office of the Privacy Commissioner of Canada within 72 hours and will notify affected Users as soon as practicable, in accordance with PIPEDA's breach-reporting requirements.

12. Cookies and Tracking

The Platform uses the following cookies:

• Essential session cookies: Set by our authentication service to maintain your authenticated session. These are strictly necessary for the Platform to function.
• Analytics cookies (Google Analytics): Set only after you accept the Terms of Service and this Privacy Policy (for example, the _ga cookie). Used to measure aggregate Platform usage. These are not set before consent and are never used for advertising.

Analytics are provided by Google Analytics 4 under Google Consent Mode. Before you accept the Terms of Service and this Privacy Policy, analytics storage is denied and no analytics cookie is set. We do not use advertising cookies. We never transmit your name, email address, the content of your posts, or your search queries to the analytics provider; any signed-in identifier sent is a one-way SHA-256 hash. You can disable analytics for a given browser at any time by appending ?ga_optout=1 to any Platform URL, by withdrawing consent (Section 10), or through your browser’s cookie controls. If our use of tracking technologies materially changes, this Privacy Policy will be updated and you will be notified prior to deployment.

13. Cross-Border Data Transfers

Some of your Personal Information is stored or processed outside Canada. Plentidots discloses these transfers explicitly and relies on PIPEDA's accountability principle and, where contractually available, standard contractual clauses (SCCs) with US-hosted sub-processors:

• Authentication infrastructure provider: Hosted in the United States. Your authentication credentials and session data may be stored on US-based infrastructure. Transfer relies on PIPEDA adequacy assessment and standard contractual clauses where contractually available.
• Search infrastructure provider: Hosted in the United States. Indexed content used for search may be stored on US-based infrastructure. Transfer relies on PIPEDA adequacy assessment and standard contractual clauses where contractually available.
• Google (OAuth): OAuth authentication data is processed by Google on its global infrastructure. Transfer relies on PIPEDA adequacy assessment and Google's standard data-processing terms.
• Google (Analytics): Consent-gated analytics data — in-app events and a one-way hashed identifier, with no name, email, or content — is processed by Google on its global infrastructure. Transfer relies on PIPEDA adequacy assessment and Google's standard data-processing terms.

All other data — community content (cloud database), media (cloud object storage), logs (operational logging), and transactional email — is stored in Canada (Toronto region).

By using the Platform, you acknowledge and consent to these cross-border transfers as described above.

14. Changes to This Policy

Plentidots may update this Privacy Policy at any time. When we make material changes, we will: update the version date at the top of this Policy; send notice to the email address on your Account; and display an in-product banner for the 30-day advance notice period. Material updates are effective 30 days after notice is provided. Continued use of the Platform after the 30-day notice period constitutes acceptance of the updated Policy. The privacyVersion field (separate from termsVersion) on each user record tracks the version of the Privacy Policy accepted.

If you do not agree to the updated Policy, you must delete your Account before the 30-day period expires. Current version: v1.0-2026-05-15.

15. Contact

Purpose	Contact
Privacy inquiries and rights requests	hello@heybloo.ca
Data breach notifications (incoming) and security concerns	hello@heybloo.ca
General Platform inquiries	hello@heybloo.ca
Business address	Ontario, Canada

Office of the Privacy Commissioner of Canada: https://www.priv.gc.ca / 1-800-282-1376

---

Cross-reference: Terms of Service (see also: HeyBloo Family — Terms of Service).

Document version v1.0-2026-05-15. Last updated 2026-05-15.