Villagely

Privacy Policy

Last updated: June 9, 2026

Villagely is a private community portal that helps parents organize events, RSVPs, polls, a family directory, and curated local kids' activities. This policy explains what we collect, how we use it, and the choices you have. It applies to our website and mobile apps. The service is operated by PanBuddha Digital Solutions Limited (British Columbia, Canada; admin@panbuddha.ca), referred to here as "we" or "us."

Who can use the service

Accounts are for parents and guardians aged 18 or older. Children do not create accounts and do not use the service directly. Parents may choose to add limited information about their own children so other parents in their private group can recognize each other's families.

Information we collect

• Account: your email address and password. Authentication is managed by the app; passwords are stored only as salted bcrypt hashes, never in plain text. (A migration to Supabase Auth is in progress; this policy will be updated when it completes.)
• Profile you provide: your name, and — if you choose to add them — your children's first names and ages, profile and family photos, and an optional emergency contact phone number.
• Community activity: events, RSVPs, poll votes, reviews, comments/messages, and the groups you belong to.
• Photos: images you upload for profiles, kids, and family banners.
• Location: the venue locations of events you or your group create (to show them on a map) and, if you choose to set it, your home location — visible to another member only after you approve their request, and then only as an approximate area. We do not continuously track your device location.
• Payments: if you purchase a subscription or use a paid feature, payments are processed by Stripe. We do not store your full card number — Stripe handles card data directly under its own PCI-compliant systems.
• Notifications: a device push token, so we can send event reminders and group updates if you opt in.

How we use your information

• To run the service — accounts, the event calendar, RSVPs, polls, reviews, the family directory, and notifications.
• To power AI-curated local activity suggestions. These are generated on our server, and no personal information is sent to the AI provider.
• To process payments for paid features (via Stripe).
• To keep the community safe and to respond to your support requests.

How your information is shared

• Within the community: your profile is visible to other signed-in members, and group activity content is visible to members of that group. It is not public. Our server authenticates every request and checks group membership before returning group content. (Database-level row security is being added as part of our backend migration.)
• No selling, no ads, no ad-tracking: we never sell your data and do not use third-party advertising or analytics trackers.
• Service providers (sub-processors): we use trusted providers only to operate the service — Railway (cloud hosting for our database and uploaded files), Brevo (transactional email), Stripe (payments), Expo and the Apple/Google push services (notification delivery), OpenStreetMap Nominatim (venue address lookup), Jitsi (8x8) (live video rooms), Anthropic (AI activity discovery — receives no personal data), and Supabase (authentication migration in progress). They process data on our behalf under data-processing agreements.
• Legal: we may disclose information if required by law.

Where your data is stored (data residency)

Your data is currently hosted with Railway (cloud infrastructure). As part of our backend migration we are moving to Canadian-region hosting, and this section will be updated when that completes. Some service providers (e.g. Stripe, Brevo) may process limited data in other countries to deliver their services; where they do, they provide appropriate safeguards.

Children's information

Villagely is intended for parents (adults). It is not a children's app and is not directed to children. We do not knowingly allow anyone under 18 to create an account, and we do not knowingly collect personal information directly from children. Parents may choose to add limited information about their own children (first name, age, photo) so other parents in their private group can recognize each other's families; this parent-provided information is visible only within the group and can be edited or removed at any time. If you believe a child has provided us information without a parent's involvement, contact us and we will delete it. We comply with the U.S. Children's Online Privacy Protection Act (COPPA) and applicable children's-privacy laws in Canada.

Your choices and rights

• Access & update: view and edit your profile in the app at any time.
• Delete your account: go to Profile → Delete account. This permanently deletes your account and associated personal data and cannot be undone.
• Notifications: opt out anytime in your device settings.

Your rights in the United States

If you are in the U.S., you may have rights under state privacy laws (such as California's CCPA/CPRA): to know what we collect, to access or delete it, and to opt out of any "sale" or "sharing" of personal information. We do not sell or share personal information for advertising. California residents may also designate an authorized agent. To exercise any right, email admin@panbuddha.ca.

Your rights in Canada

If you are in Canada, your information is handled in accordance with PIPEDA and applicable provincial laws (including Quebec's Law 25 and British Columbia's PIPA). You may request access to, correction of, or deletion of your personal information, and withdraw consent. You may also contact our privacy contact below, and you have the right to complain to the Office of the Privacy Commissioner of Canada (or the relevant provincial regulator, such as the Commission d'accès à l'information du Québec).

Data retention & security

We keep your information while your account is active. When you delete your account, we delete your personal data. Security measures include encryption in transit (HTTPS/TLS) and at rest, hashed passwords, and server-enforced access controls that scope each group's data to its members.

Changes to this policy

We may update this policy as the app evolves. We'll revise the "last updated" date above and, for material changes, notify members in-app.

Contact

Questions about your privacy, or to exercise a right? Email our privacy contact at admin@panbuddha.ca (PanBuddha Digital Solutions Limited, British Columbia, Canada).