Privacy Policy

• Your account — email, first name, display name, username, bio, avatar, and the first three characters of your postal code. The email is how you sign in; the rest is what other people see of you.
• Addresses — the recipient name, phone, street address and postal code for each place you ship from or to. The phone is there so a courier can call about a parcel.
• Payment information — handled by Stripe. We keep Stripe's identifiers for your customer record, saved cards and payout account, never the card number itself.
• Your SIN, but only if you cross the CRA reporting threshold as a seller. It is encrypted before it is stored, and it is used for CRA reporting and nothing else.
• What you list and buy — listings, photos, orders, offers, reviews, and the events on each order.
• Messages — chat with other users, and any photos attached. Contact details in chat are automatically hidden, which requires us to scan message text as it is sent.
• Case evidence — the photos and descriptions you upload when opening or answering a case.
• How you use Pigeon — your searches, the day you were last active, and basic technical logs. Searches are kept for 90 days and used to work out what people can't find.
• Your phone number, if we ever ask you to verify one as a seller.

We ask for each of these at the moment it's needed, not up front — an address at checkout, a card when you make an offer — so you can see why we're asking.

Not public, ever: your email, your phone number, your full address, your postal code, your SIN, your balance, and what you have bought. A seller shipping to you never sees your address — it goes onto the courier label server-side. A buyer never sees where a parcel came from beyond the city.

• Stripe — payments, saved cards, identity checks and payouts. They receive your name, email and, for sellers, the identity details their checks require.
• Stallion Express — the courier. They receive the sender and recipient name, address and phone for a parcel, because that is what a shipping label is.
• Supabase — our database, file storage and sign-in, hosted in Canada (ca-central-1).
• Cloudflare — application hosting.
• Resend — sending email. They receive your email address and the contents of the message.
• Anthropic — automated screening of new listings. They receive the listing's text and its cover photo. Your personal details are not sent, and the content is not used to train their models.
• Twilio — only if we ask you to verify a phone number, and only that number.
• CARTO and OpenStreetMap — the map images on the drop-off map. Your browser requests map tiles directly from CARTO, who draw them from OpenStreetMap data, so CARTO sees your IP address and which part of the map you looked at. We send them nothing about you, your address or your listing.

We also share data when the law requires it — a court order, a CRA reporting obligation, a police investigation — and if Pigeon were ever sold or merged, in which case we'd tell you first.

• Your account and its content: 30 days after you close it (you can reactivate until then), and then we delete your addresses, saved cards, chats, photos, tax details and profile, and release your email address. What's left is a "Former member" record that your past orders point at.
• Orders, receipts and ledger entries: seven years after the order, because tax law requires it. This survives closing your account.
• Case evidence: as long as the case record.
• Chat: until you delete it, or 30 days after you close your account.
• Search history: 90 days.
• Photos on an abandoned draft listing: 24 hours.

No system is perfect. If a breach ever puts you at real risk of significant harm, we will tell you and the Privacy Commissioner of Canada, as the law requires.

Some things we can't delete on request: order and tax records we're required to keep, and content another user needs to resolve an open case. We'll tell you if that applies.

If you're unhappy with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

The person responsible for privacy at VEEBZ INC. can be reached via privacy@getpigeon.ca, or by post at 80 Alton Towers Circle, Unit 1009, Scarborough, ON M1V 5E8.