Privacy Policy

This privacy policy explains how CFL Québec ("we", "our", "CFL Québec") collects, uses, retains, shares, and protects your personal information when you use the cflquebec.com website and related services.

We operate from Quebec, Canada, and comply with Quebec's Act respecting the protection of personal information in the private sector (commonly known as Law 25), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and the principles of the EU General Data Protection Regulation (GDPR) for European visitors.

We encourage you to read this policy carefully. By using cflquebec.com, you accept the practices described here. If you do not agree with this policy, please do not use the platform.

In accordance with Law 25, we have designated a person responsible for personal information protection:

• Name: Pascal Grenon
• Role: Founder and privacy officer
• Email: info@cflquebec.com

Any access, rectification, withdrawal request, or complaint can be sent to this contact. We respond within a maximum of 30 days from receiving your request.

CFL Québec is part of a family of sports news sites operated by the same person, each devoted to a different sport. These sites share a single member database: the account you create on one of them identifies you on all the others.

In practice, your email address, username, avatar and password are stored once and let you sign in everywhere without creating another account. The comments, articles and messages you publish, by contrast, stay attached to the site where you published them.

This is not a disclosure to a third party: the same controller remains the sole holder of your information, and this policy applies identically to each site. No data is passed to another company as a result of this sharing.

The consequences are the same everywhere: a request to delete your account deletes it across all of the sites, and a ban issued on one site applies to the others. If you only want a presence on a single site, you need not visit the others — but your account will technically exist there.

We collect only the information strictly necessary for the platform's operation (data minimization principle).

Data you provide at registration:

• Email address (mandatory, used for authentication)
• Username (public alias displayed on the platform)
• Password (stored as a cryptographic hash, never in clear)
• Optional: profile picture, first name, last name, short bio

Data generated by your activity:

• Messages you post in chat tribunes
• Articles, podcasts, and comments you submit
• Reactions (likes, confidence gauge votes)
• Communities you join

Technical data collected automatically:

• IP address (used for security and abuse prevention)
• Browser type and operating system (user agent)
• Pages visited, visit duration, referrer (aggregated analytics)
• Session cookies and preference cookies (see dedicated section)

We do not collect your postal address, phone number, social insurance number, banking details, or any other sensitive information not required for the service.

We use your information for the following purposes:

• Providing the service (contract performance): account management, authentication, content display, tribune participation.
• Security and fraud prevention (legitimate interest / legal obligation): abuse detection, rate limiting, spam blocking, connection logs.
• Service improvement (legitimate interest): aggregated usage analysis, performance diagnostics, bug resolution.
• Account-related communications (contract performance): registration confirmation, password reset, security notifications.
• Advertising (consent): Google AdSense ad delivery, with or without personalization based on your preferences.
• Legal compliance: response to authorities' requests, log retention when required by law.

We use different types of cookies. A consent banner lets you accept or refuse non-essential cookies from your first visit.

Strictly necessary cookies (always active):

• Supabase authentication cookies (maintaining your session)
• Security cookies (CSRF protection, security headers)
• Language preference (fr/en) and cookie-consent cookies

Audience measurement cookies (consent-based): anonymized aggregated usage data collection to understand site activity.

Third-party advertising cookies (consent-based): placed by Google AdSense to display ads and measure performance. You can opt out of personalized advertising in your Google Ads settings or by blocking third-party cookies in your browser. Ads will still be shown, but without personalization.

You can withdraw consent at any time via the "Cookie preferences" link at the bottom of each page, or by deleting cookies in your browser settings.

To operate the platform, we rely on carefully selected technical subprocessors. These companies process your data only for the described purposes and are bound by contractual confidentiality and security commitments.

• Supabase Inc. (Singapore / United States): database hosting, authentication, file storage. Data is hosted in a specific geographic region of our choosing.
• Vercel Inc. (United States): web hosting, CDN, technical request logs.
• Google LLC — AdSense (United States): ad delivery, impression and click measurement.
• Transactional email provider: sending registration confirmation and password reset emails (e.g. Supabase Auth or an equivalent SMTP service).

We never sell your personal information to third parties. We do not share your data with advertisers. AdSense advertisers do not access your profile, your email, or your detailed browsing history on our site.

In accordance with section 17 of Quebec's Law 25, we inform you that your personal information may be transferred, stored, or processed outside Quebec — mainly in the United States and Singapore — by our technical subprocessors identified above.

Before any transfer, we assess whether the level of protection offered by the destination country is equivalent to that applicable in Quebec. When necessary, we put in place contractual safeguards (standard clauses, confidentiality and security commitments) to ensure adequate protection.

You may, at any time, request further information about transfers and the safeguards applied by writing to info@cflquebec.com.

We keep your personal information as long as necessary for the purposes described, then delete or anonymize it.

• Active user account: as long as the account exists.
• Inactive account: after 24 months without login, we may send you a notice before deletion or anonymization of the account.
• Account deleted at your request: deletion within 30 days, except legal retention obligations (security logs, applicable tax obligations).
• Published content (messages, articles, podcasts): kept as long as the community remains active. Upon account deletion, your content may be anonymized (shown as "[Deleted user]") to preserve community-conversation consistency, unless you explicitly request its deletion.
• Technical logs: max 90 days for request logs, 12 months for security logs.

Under Quebec's Law 25, Canada's PIPEDA, and the EU's GDPR, you have the following rights regarding your personal information:

• Right of access: obtain a copy of the information we hold about you.
• Right to rectification: have inaccurate, incomplete, or outdated information corrected.
• Right to erasure: request deletion of your data when no longer necessary.
• Right to portability: receive your data in a structured, commonly used format.
• Right to withdraw consent: at any time, for consent-based processing (e.g. personalized advertising).
• Right to de-indexing: request that personal content about you no longer be referenced by search engines.
• Right to file a complaint: with the Quebec Access to Information Commission, the Office of the Privacy Commissioner of Canada, or your country's data protection authority (for EU residents).

To exercise these rights, write to info@cflquebec.com. We may ask for reasonable proof of identity to protect your account. We respond within a maximum of 30 days.

We implement reasonable technical and organizational measures to protect your data against unauthorized access, loss, disclosure, or alteration, including:

• Encrypted communications (HTTPS / TLS 1.3) site-wide
• Encryption of data at rest on Supabase servers
• Cryptographic password hashing (never stored in clear)
• Strict Content Security Policy (CSP) with dynamic nonces
• HTTP security headers (HSTS, X-Frame-Options, etc.)
• Row-level security (RLS) on the database
• Rate limiting to prevent abuse
• Regular dependency security updates

In the event of a privacy incident presenting a risk of serious harm, we will notify you without undue delay in accordance with Law 25 and GDPR obligations, and notify the competent authorities.

We display ads through Google AdSense to fund free access to the platform. Google acts as a third-party vendor and uses cookies and advertising identifiers to deliver relevant ads, measure effectiveness, and prevent ad fraud.

Google may combine data collected on our site with data from other partner sites to personalize ads. We do not control and do not share your direct personal information (name, email) with Google AdSense; only technical browsing data on our site is accessible to Google via your browser.

For more information on Google's ad practices, see:

• Google Advertising Policy
• Google Ad Settings (manage your personalized-ads preferences)
• AdChoices Canada (industry-wide opt-out)