Privacy Policy

This policy explains what personal information Technical Recreation Solutions Inc. (“Rectonic”, “we”) collects when you use our website and embedded schedule widget, why we collect it, and what you can do about it.

Who this applies to

Rectonic has two kinds of user, and we treat them differently:

• Visitors browsing schedules on our site or through a widget embedded on a recreation provider’s website. You do not need an account, and we do not ask you for any personal information.
• Organization staff who create an account to publish their facility’s schedules. You give us an email address, and we store the information you enter about your organization.

What we collect

If you create an account

• Email address and password. Authentication is handled by Supabase. Your password is stored only as a salted hash — we never see or store the password itself.
• Organization profile. Name, description, logo, website, phone, email, and postal address — whatever you choose to enter. This is business contact information intended to be shown publicly on your facility’s page.
• Staff invitations. If you invite a colleague, we store the email address you entered until the invitation is accepted or revoked.
• Schedule content. Facilities, spaces, programs and sessions you publish. This is public by design.
• Billing status. Your Stripe customer identifier, plan and subscription state. Card numbers are handled entirely by Stripe and never reach our servers or database.

If you are just browsing

We record aggregate usage events — a widget being loaded, a program being clicked, a facility page being viewed — so that providers can see whether their listings are working. Each event stores the event type, the facility or program involved, the referring page, your browser’s user-agent string, and a timestamp.

We do not store IP addresses. Your IP address is combined with a secret salt that rotates daily and then hashed with SHA-256; only that hash is written. Because the salt changes every day, yesterday’s hash cannot be matched to today’s, so these events cannot be linked into a profile of you over time, and the original address cannot be recovered from them. The same kind of daily-salted hash is used, briefly, to limit how many requests one visitor can make.

Cookies

Rectonic sets cookies only to keep you signed in. There are no advertising, profiling or third-party tracking cookies, and no tracking pixels. The analytics described above run server-side and do not set a cookie.

Your browser’s local storage holds one setting you choose yourself: the dashboard’s light or dark theme. It stays on your device and is never sent to us; clearing your browser data removes it.

Because our cookies are strictly necessary to provide a service you asked for, most privacy laws do not require us to obtain consent for them, and we do not show a consent banner. If you block them you will be unable to sign in, but browsing public schedules will still work.

Who we share it with

We do not sell personal information, and we do not share it for advertising. We use these service providers to operate Rectonic:

We may also disclose information where the law requires it, or to protect our rights or the safety of others.

Where your data is held

Our database is hosted in [region]. Some providers listed above operate internationally, so your information may be processed outside your country, including in the United States. Where required, these transfers rely on the providers’ standard contractual clauses.

How long we keep it

• Account and organization data — for as long as the account is open, then deleted within [30] days of a deletion request.
• Analytics events — retained for [12 months], then deleted. These are already non-identifying.
• Billing records — kept as long as tax and accounting law requires, typically seven years.

Your rights

Depending on where you live — under Canada’s PIPEDA, the EU/UK GDPR, or California’s CCPA/CPRA — you have some or all of the following rights:

• Ask what personal information we hold about you, and get a copy.
• Have inaccurate information corrected.
• Have your information deleted.
• Receive your data in a portable, machine-readable format.
• Object to or restrict certain processing.
• Withdraw consent where we relied on it, without affecting what we did before you withdrew it.

California residents: we do not sell or share personal information as those terms are defined by the CCPA, and we will not discriminate against you for exercising any right.

To exercise any of these, email us at [privacy@yourdomain]. We respond within [30] days. If you are unhappy with our response you may complain to your local data protection authority — in Canada, the Office of the Privacy Commissioner.

Security

Data is encrypted in transit with HTTPS and encrypted at rest by our database provider. Access to each organization’s data is enforced at the database level, so one organization cannot read another’s. Passwords are hashed, IP addresses are hashed with a rotating salt, and administrative access is limited to those who need it.

No system is perfectly secure. If we discover a breach affecting your personal information, we will notify you and the relevant regulator as the law requires.

Children

Rectonic is intended for recreation providers and adults browsing schedules. We do not knowingly collect personal information from children under [13]. If you believe a child has given us information, contact us and we will delete it.

Changes

If we change this policy we will update the date at the top, and for significant changes we will tell account holders by email before the change takes effect.

Contact

Technical Recreation Solutions Inc.
[postal address]
[privacy@yourdomain]

See also our Terms of Service.