Privacy Policy
Effective date: 4 October 2026 · Version 1.1
1. Who we are
Püper is operated by Sedlex Services Inc., incorporated in Quebec, Canada. 1100, avenue des Canadiens-de-Montréal, Suite 354A, 3e étage, Montréal (Québec) H3B 2S2 · contact@puperapp.com
This policy meets the requirements of Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25.
2. The short version
- Search and view restrooms without an account.
- We store your location only if you turn on Premium real-time alerts.
- We never collect or host photographs.
- We never sell your personal information or share it with advertisers.
- Your listings, ratings and written reviews are public by design.
3. What we collect, and why
Account information — email and an authentication identifier; with Google sign-in, your email, your Google identifier, and your Google name and profile-photo address, which our authentication provider keeps as Google sends them and which we do not display (never your Google password). Your email and identifier are used to authenticate you and link your contributions.
Your display name — when you create an account we assign a neutral default (for example, "User" followed by digits). You may change it at any time. It is shown next to your public contributions. It is not derived from your email.
Your contributions — listings, ratings, written reviews, amenity selections, floor information, access-type reports and votes. Public; see section 5.
Subscription information — that your account holds an active subscription and a customer identifier from our payment processor. We never receive, see, or store your card number.
Location — only as described in section 4.
Push notification registration — a delivery endpoint and keys if you enable notifications. It does not tell us where you are.
Technical and error information — diagnostic data when the app errors, including an account identifier if you are signed in. Used only to fix defects.
Communications — correspondence you send us.
4. Location
If you do not use Premium real-time alerts, we do not store your location. Straight-line distances are calculated in your browser. If you are signed in, walking distances to the 25 nearest restrooms are calculated by the OpenRouteService service, operated by HeiGIT in Germany: our servers send it your location rounded to about 100 metres and the location of those restrooms, without your IP address or any identifier.
Geocoding. To convert place names and addresses into map locations, and map locations into addresses, we use the LocationIQ geocoding service, operated by Unwired Labs (India) Pvt Ltd. Requests are sent from our servers, not from your device, so the provider receives neither your name, your email address, your IP address nor your account identifier. It does, however, receive the text you type and the locations described in the next paragraph. The provider and its subcontractors may process these requests outside Quebec, including in the United States and the European Union.
The precision of what we send depends on the feature you use. When we look up the name of an area — the one you are in, for example to show your city, or the one shown on the map — the location is rounded to approximately one kilometre before it is sent. When you search for a place or an address, the text you type is sent as entered. When you add a restroom, two things may be sent. If you have allowed access to your location, it accompanies your search, rounded to approximately one kilometre, to favour nearby results. If you place a pin on the map, its exact location is sent so that the provider can suggest the matching address; if you placed the pin using your current location, this is your precise location at that moment. This information is sent only when you use these features, and only to obtain the result you requested.
We temporarily keep search results and area names in a cache for no more than 24 hours, without your name, email address, IP address or account identifier, other than anything you type into the search yourself. The exact location of a pin is never cached.
When you look up supplementary restroom data, an approximate location, coarsened to about one kilometre, is sent through our own servers to REFUGE Restrooms; your precise coordinates and IP address are never shared with it.
Map tiles. Map tiles are downloaded directly by your browser from CARTO, not through our servers. CARTO therefore receives your IP address, the technical information your browser sends and the coordinates of the map areas you view; when the map is centred on your location or shows a pin, those areas correspond to your approximate or exact location. When you download an area for offline use, CARTO also receives the coordinates of that area.
Opening hours. When you add a restroom and pick a venue whose opening hours are not known or could not be read, we query OpenStreetMap's Overpass service through our own servers, sending only the location of the venue you picked; your IP address is never shared with it.
Push notifications. If you turn on notifications, our servers deliver each one to your browser's notification service (for example Google, Mozilla, Apple or Microsoft), which receives your device's delivery address and an encrypted message it cannot read.
Municipal open data. For some cities, our servers query the city's open-data portal with the centre or bounds of the map area on screen, without your IP address or any identifier.
If you enable Premium real-time alerts, we store one current location for your account, to match restrooms just marked clean or restocked against your position. Storage is opt-in; it is a single current position for proximity matching, not a movement history; it is deleted when you turn alerts off and when your subscription lapses or is cancelled; it is never shared with facility managers, other users, or any third party. Free-tier locations are never stored.
5. Your contributions are public
Listings, ratings, reviews, amenity selections, floor details, access-type designations and correction votes are visible to everyone, including logged-out visitors, and may feed a restroom's public confidence score. Do not put personal information into a review; reviews are text only.
6. What we do not collect
Photographs (the app has no photo upload); payment card numbers; movement history; your contacts, calendar, microphone, camera or files; health information. We do not sell personal information or share it with advertisers or data brokers. Advertising currently shown is our own first-party content with no third-party tracking; introducing a third-party ad network would require updating this policy and obtaining any required consent first.
7. Service providers and where information is processed
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication, real-time infrastructure |
| Vercel | Application hosting and delivery |
| Stripe | Subscription payments and billing (web) |
| Resend | Transactional and authentication email (via SMTP) |
| Sentry | Error and crash diagnostics |
| Optional sign-in | |
| LocationIQ | Geocoding: place and address search, and the address of a map location (server-proxied; see section 4) |
| CARTO | Map tiles (requested directly by your browser; see section 4) |
| OpenStreetMap (Overpass) | Opening hours when adding a restroom (venue location only); importing and daily refreshing of map data, by area. Always server-proxied; see section 4. |
| OpenRouteService (HeiGIT) | Walking distances to the 25 nearest restrooms, for signed-in users (server-proxied; location rounded to ~100 m; see section 4) |
| Browser push services (e.g. Google, Mozilla, Apple, Microsoft) | Delivery of push notifications you turn on: your device's delivery address and an encrypted message (see section 4) |
| Municipal open-data portals | Public restroom data for some cities: centre or bounds of the map area on screen (server-proxied; see section 4) |
| REFUGE Restrooms | Supplementary restroom data (server-proxied, ~1 km coarsened) |
Our infrastructure and service providers are located primarily in the United States and Europe, so your personal information is stored and processed outside Quebec, where it may be subject to the laws of those jurisdictions, including lawful access by foreign authorities. The geocoding service is operated by a company based in India, and its requests may be processed in, among other places, the United States and the European Union. CARTO's map tiles are delivered through a content delivery network, from the server nearest to you, which may be in Canada or abroad. Before communicating personal information outside Quebec, we carry out a privacy impact assessment to ensure it will receive adequate protection, in accordance with the Act respecting the protection of personal information in the private sector. We contractually require our hosting and infrastructure providers to maintain adequate protection by Quebec standards. Requests sent to the geocoding service contain neither your name, your email address nor your IP address. They do, however, include the text you type and, when you add a restroom, the exact position of the pin, as described in section 4. By using Püper, you acknowledge this transfer.
8. Cookies and on-device storage
Strictly-necessary browser storage: a session token and your language and display preferences. If you use offline maps, tiles and a snapshot of nearby restroom data are cached on your device; this stays on your device, is not transmitted to us, and you can clear it any time. This data is deleted automatically the first time you open Püper more than 28 days after the area was downloaded or last updated, when you sign out or delete your account on the device where it is stored, and when we find that your Premium subscription has ended. If your account is deleted another way, for example at your request by email or from another device, it is deleted under the same 28-day rule. No advertising cookies or third-party tracking pixels.
9. How long we keep information
Account and profile — while open, deleted on request. Public contributions — retained in the community database (see section 11). Stored alert location — until you disable alerts or your subscription lapses. Notifications — 7 days after being read, 30 days if unread. Push registration — until disabled or revoked. Offline maps — on your device only, deleted under the rules in section 8. Error diagnostics — per our provider's standard retention. Billing records — as tax and accounting law requires.
10. Your rights
Access; correction; withdrawal of consent (including location for alerts); deletion; portability; de-indexation; and to be informed of the reasons and principal factors behind any decision based exclusively on automated processing (section 12). Exercise them by emailing contact@puperapp.com, or delete your account yourself — signed in, from your profile screen; or from puperapp.com/delete-account, which explains what is removed and what is retained. We respond within 30 days. Unsatisfied, you may complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).
11. Account deletion and what survives it
Deleting your account removes your profile, email, alert settings, any stored location, your notifications, and the text of your reviews. Restroom listings you added and your star ratings remain, disassociated from your name, because other people rely on them. Deletion is immediate. If your account also manages a facility or holds a Püper Pro licence, deletion is handled by writing to contact@puperapp.com rather than automatically.
12. Automated processing
Püper computes a rules-based confidence score per restroom (listing age, number and recency of ratings, known-category match, community corrections). It describes a restroom, not a person. If we later introduce contributor trust scores affecting how a person's contributions are treated, we will update this policy, tell you when such a score applies to you, and on request explain the information used and the principal factors, with a right to submit observations and to human review.
13. Confidentiality incidents
If an incident involving your personal information presents a risk of serious injury, we will notify you and the Commission d'accès à l'information promptly and take reasonable measures to reduce harm. We keep a register of confidentiality incidents as the law requires.
14. Children
Not directed at children. Under-14s may not create an account without parental authority; information collected from a child under 14 without that consent is deleted.
15. Person responsible for the protection of personal information
Marc Réjouis, President · Sedlex Services Inc. · contact@puperapp.com · 1100, avenue des Canadiens-de-Montréal, Suite 354A, 3e étage, Montréal (Québec) H3B 2S2
16. Changes
Material changes — especially to location use or a new collection category — are notified in the app or by email before taking effect, with consent sought where required. The date at the top reflects the current version.