Privacy Policy

Two Birds Innovation · St. Thomas, Ontario · Effective 4 July 2026 · Last updated July 2026

Draft, pending professional review. This is a draft template and not legal, tax, or financial advice. Have a licensed Ontario lawyer or accountant review it before you rely on it.

Organization: Two Birds Innovation ("Two Birds", "we", "us", "our"), St. Thomas, Ontario, Canada.

This Privacy Policy explains how Two Birds Innovation handles information in connection with our websites and free digital products, including the Digital Confidence Centre (a free digital-literacy and scam-safety web tool), our job-search tool, and other static web tools we publish (together, the "Products").

We built these Products to be minimal-data by design. In plain terms: we try to collect as little information as possible, and most of our Products collect no personal information about you at all.

This policy is written to be consistent with Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario law. See the "Which laws apply" section below.

1. Summary (the short version)

The Digital Confidence Centre and our other static tools have no accounts and no login, and do not ask you for or collect personal information.
We do not sell, rent, or trade your information to anyone. Ever.
We do not use your information for targeted advertising, and we do not run third-party ad networks on our Products.
Where we measure how our Products are used, we use aggregate, no-personally-identifiable-information (no-PII) analytics. See Section 4.
Some Products may offer an optional email sign-up (for example, to receive an update or a resource). This is opt-in only, and you can unsubscribe at any time. See Section 5.
Data that stays on your own device (such as browser local storage used to remember your progress or preferences) is not sent to us.

If you only read one section, read this one. The rest is the detail behind it.

2. What we do NOT collect

Across the Digital Confidence Centre and our other static web tools, we do not:

create user accounts, profiles, or logins;
ask for your name, address, phone number, date of birth, or government identifiers;
collect payment or financial information (our free Products are free, there is nothing to pay);
require you to sign in with Google, Facebook, or any other identity provider;
sell, rent, license, or trade any information about you;
use your information to target ads to you, or allow third parties to do so on our Products;
build advertising or tracking profiles about you.

Where a specific Product does collect something (for example, an optional email address you choose to provide, see Section 5), that collection is described in this policy, and you are told about it at the point where you provide it.

3. Information we may handle, and why

We keep the categories of information we handle deliberately small:

Category	What it is	Why we handle it	Basis
Aggregate usage data	Non-identifying counts and trends (for example, how many people visited a page, roughly which region a visit came from, which browser type) via privacy-respecting analytics.	To understand which tools are useful and to improve them.	Implied consent / legitimate low-risk purpose (see Section 6)
Technical / server data	Standard information your browser and our hosting/CDN provider exchange to serve a page (for example, IP address at the network layer, timestamp, requested file). We do not use this to identify individuals and it is handled by our hosting/CDN provider.	To deliver the site, keep it available, and protect it from abuse.	Necessary to provide the service; security
Optional email address	Only if you choose to submit it through an opt-in form on a Product.	To send you the specific thing you asked for (for example, an update or resource).	Express opt-in consent (see Section 5)
On-device data (local storage)	Progress, answers, or preferences a tool saves in your own browser. This stays on your device and is not transmitted to us.	So a tool can remember where you were or what you set.	Stays on your device; not collected by us

We do not combine these categories to identify you, and we do not attempt to re-identify aggregate analytics data.

4. Analytics (aggregate, no personal profiles)

To understand whether our free Products are actually helping people, we may use privacy-respecting, aggregate analytics. Where analytics are used, they are chosen and configured to measure trends in the aggregate, such as page views and referrers, not to build a profile of you as an individual. We do not use them to sell data or to serve targeted ads.

If and when we add, remove, or change an analytics tool, we will update this section. If you want to see exactly what is in use on a given day, contact us (Section 12).

5. Optional email capture (opt-in only)

Some Products may include an optional form where you can choose to give us your email address, for example, to receive a specific resource, an update, or a notification you requested.

If you use one of these forms:

Giving your email is entirely optional. The Product still works without it.
We use your email only for the specific purpose stated on the form.
We do not sell or share it, and we do not add you to unrelated mailing lists.
You can unsubscribe or ask us to delete it at any time, use the unsubscribe link in any message, or contact us (Section 12).
Emails you submit may be stored or processed by our email or form provider.

If a Product does not show an email form, then that Product does not collect your email.

6. Consent

Under PIPEDA, we rely on consent appropriate to the sensitivity of the information:

Express (opt-in) consent for anything you actively submit, such as an optional email address (Section 5). You choose to provide it, for a stated purpose.
Implied consent for low-risk, non-identifying aggregate analytics and the standard technical data needed to serve a web page, where the purpose is one a reasonable person would consider appropriate.

You can withdraw consent at any time (subject to legal or contractual limits), for example by unsubscribing, asking us to delete an optional email, or clearing your browser's local storage. To withdraw consent, contact us (Section 12). Withdrawing consent will not affect the lawfulness of anything done before you withdrew it.

We do not require you to consent to the collection, use, or disclosure of information beyond what is needed to provide a Product, as a condition of using that Product.

7. How we use information

We use the limited information described above only to:

deliver, host, and secure the Products;
understand, in the aggregate, how the Products are used, so we can improve them;
respond to you and provide anything you specifically requested (for example, via an optional email form);
comply with legal obligations.

We do not use information for automated decision-making that produces legal or similarly significant effects about you.

8. Disclosure and service providers (third-party processors)

We do not sell your information and we do not disclose it for anyone else's independent marketing.

We do rely on a small number of reputable service providers ("processors") to operate the Products. These are listed here generically; specific vendors may change over time:

Hosting / static site delivery: GitHub Pages, serves the website files.
Content delivery network (CDN) / security: our CDN provider, delivers content quickly and helps protect against abuse.
Analytics: see Section 4.
Email / form handling (only where an optional form exists): see Section 5.

Each provider only handles the information needed to perform its function, and is expected to protect it with safeguards comparable to those in this policy. We may also disclose information if required by law (for example, in response to a valid legal request), or to protect the rights, safety, or property of Two Birds, our users, or the public.

Storage outside Canada

Some providers may store or process data outside Canada (for example, in the United States or other countries). When data is handled outside Canada, it may be subject to the laws of that country, including lawful access by foreign courts, law enforcement, or government agencies. We choose providers we consider reputable and, where practical, prefer providers or configurations that keep data in Canada.

9. Cookies and local storage

Our static Products aim to be cookie-light. Where our privacy-respecting analytics can work without cookies, we prefer that configuration.
Some tools use browser local storage on your own device to remember your progress, answers, or preferences. This stays on your device and is not transmitted to us. You can clear it any time through your browser settings.
Any provider listed in Section 8 may set limited technical cookies needed for security or delivery; where an optional analytics tool sets a cookie, that is disclosed in Section 4.

You can control or block cookies through your browser settings. Blocking cookies will not stop our core static tools from working, though it may affect features that rely on remembering your on-device preferences.

10. Data retention

Aggregate analytics are retained only in non-identifying, aggregate form, for as long as it is useful to understand usage trends, in line with the retention period of the analytics tool in use.
Standard server / CDN logs are retained by our hosting/CDN provider for a limited period for security and operations, then discarded, according to that provider's practices.
Optional email addresses are retained only until you unsubscribe or ask us to delete them, or until they are no longer needed for the purpose you gave them for, whichever comes first.
On-device local storage is retained on your device until you clear it.

We do not keep personal information longer than necessary for the purpose it was collected for, or as required by law.

11. Security

We take reasonable steps to protect information appropriate to its sensitivity, including:

serving Products over encrypted connections (HTTPS);
minimizing what we collect in the first place (the strongest protection is data we never hold);
relying on reputable hosting, CDN, and (where used) email/form providers with their own security safeguards;
limiting who can access any optional email data we do hold.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we ever become aware of a privacy breach that creates a real risk of significant harm, we will respond in accordance with our obligations under PIPEDA, which may include notifying affected individuals and the Office of the Privacy Commissioner of Canada.

12. Your rights: access, correction, and questions

Subject to legal limits, you have the right to:

Ask what personal information we hold about you (in most cases, for our static tools, the answer is "none");
Access that information;
Correct it if it is inaccurate;
Withdraw consent or ask us to delete an optional email you provided;
Ask how your information has been used or disclosed.

To make a request, contact our privacy contact:

Privacy contact: Aaron Patzalek, Two Birds Innovation
Contact: contact form
Ontario, Canada

We will respond within the timeframe required by PIPEDA (generally 30 days), and will let you know if we need more time or cannot fulfill a request (with reasons). There is normally no charge; if a request would involve a cost, we will tell you first.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (www.priv.gc.ca). For matters that fall under Ontario provincial oversight, you may also contact the Information and Privacy Commissioner of Ontario (www.ipc.on.ca).

13. Younger users (including Digital Confidence Centre youth users)

The Digital Confidence Centre is designed to be safe for a wide audience, including seniors and youth.

For youth users of the Digital Confidence Centre and our other free tools: we do not collect personal information, do not create accounts, and do not run targeted advertising. There is nothing to sign up for and nothing that profiles a young person.
We do not knowingly collect personal information from children. If a Product ever offers an optional email form, it is not directed at children, and we ask that anyone under the age of majority in Ontario not submit personal information without a parent or guardian's involvement.
If you believe a child has provided us personal information (for example, through an optional email form) and you would like it removed, contact us (Section 12) and we will delete it.

We treat information from younger users with extra care, consistent with PIPEDA guidance on obtaining meaningful consent from, and protecting, minors.

14. Which laws apply

Two Birds Innovation is based in Ontario, Canada, and operates under Canadian federal and Ontario provincial law.
Our handling of personal information in the course of commercial activity is governed primarily by Canada's PIPEDA.
Depending on the activity, other laws may apply, such as Canada's Anti-Spam Legislation (CASL) for any commercial electronic messages (for example, an optional email you opt into), and applicable Ontario law.
If you access our Products from outside Canada, you understand your information will be handled as described in this policy and under Canadian law.

Nothing in this policy limits any rights you have under applicable law.

15. Changes to this policy

We may update this Privacy Policy from time to time (for example, if we change an analytics tool or add an optional feature). When we do, we will change the "Last updated" date at the top. Material changes will be highlighted on the affected Product where practical. Your continued use of a Product after an update means you accept the revised policy.

16. Contact

Two Birds Innovation
Attn: Aaron Patzalek, Privacy Contact
Contact: contact form
Ontario, Canada

Questions, access requests, corrections, or complaints about privacy can all be sent to the address above. We take them seriously and will respond promptly.