Privacy

What happens to your answers

When you fill in a form, your answers travel to our server, get written into the PDF, and come back to you in the same response. They are not saved anywhere along the way.

We are specific about this because a vaguer promise would be easier to make and worth less. Your answers are not in a database table, not in a log file, not in an error report, and not in a queue. The part of our service that handles them cannot write a log line at all — we removed its permission to do so, so that the promise does not depend on us remembering.

Why they reach our server at all

Filling a government PDF properly means writing into fields by name, which has to happen where the document is. Some questions cover several boxes at once — an address is one thing you know and eight boxes on the form — and working out which part goes where uses a language model.

Sensitive fields never go to a model. A social insurance number, a passport number and a date of birth are written straight into the document by our own code and are never described to anything outside our service.

What we do keep

Search questions, for one week. When somebody asks "how do I renew my passport", we keep the question and the answer briefly so the next person asking gets it instantly and for free. These are not tied to you, and they are deleted after seven days.

An email address, if you give us one — either to be told when a form is ready to fill, or to have your finished form sent to you. It is used for that one message and deleted when the message is sent. It is not an account and not a mailing list.

Ordinary technical records that any website keeps to stay online and to work out what it costs us: which pages were served, and when.

Payments

Payments are handled by Stripe. We never see or hold your card details. What we learn from Stripe is whether a payment succeeded.

Counting visits

We use Google Analytics to count visits, so we can see which forms people actually need. It is switched off until you allow it, and if you do not it never runs — declining is one tap and we do not ask again.

It tells us pages and referrers, not who you are. We have turned off the settings that would join your visit to an advertising profile, and it never sees anything you type into a form.

Where this happens

Our servers and our storage are in Canada (AWS ca-central-1). The language models we use are reached through providers that do not retain or train on what is sent to them, and some of those run outside Canada.

Your rights

Because we do not keep your answers, there is usually nothing of yours for us to show you or delete. If you have given us an email address and want it removed before we use it, write to us and we will delete it.