Privacy Policy

1. Controller

The controller for personal information related to Caserne+ and kalouva.ca is Kalouva Innovation Inc., Québec, Canada.

For privacy questions or requests: francis@kalouva.ca.

2. Scope

This policy covers: the kalouva.ca marketing site; the Caserne+ web app; the Caserne+ mobile apps on iOS and Android (native Capacitor shell loading the hosted service); and transactional emails related to Caserne+ (invitations, password reset, internal Kalouva notices).

Caserne+ is for fire departments with organizational access. Members sign in by invitation or after an access request reviewed by Kalouva or the organization.

3. Accounts and authentication

Accounts are managed with Supabase Auth. Members sign in with an email address and password.

Account creation is not open to the public: it goes through a member invitation, service-linked activation, or a reviewed access process (demo / registration request).

• Account email
• Password (hashed by the authentication provider — we do not store passwords in clear text)
• Account metadata used by the product (e.g. display name, initial password-setup flag)
• Session tokens required to stay signed in

4. Members, roles, and organization

Each fire department (organization) has its own members, roles, and crews. One service’s data is isolated from others by design (memberships and database access policies).

• Display name, rank/function, role (member, officer, administrator)
• Crew or announcement-group membership
• Member contact phone number, if entered
• Pending invitations (recipient email, token, delivery status)
• Member notification preferences for the service

5. Product content (messages, documents, photos, inventory)

Depending on modules enabled for the service, Caserne+ processes operational content entered by members or managers.

• Calendar, duty shifts, training, attendance, and coverage requests
• Announcements and replies
• Member messages and conversation photos, where used
• Procedure documents (links or files) and the service logo
• Tasks, inventory (vehicles, equipment), and maintenance / test follow-up
• Access or demo requests sent to Kalouva (contact details)

6. Notifications

With the user’s permission, Caserne+ may send notifications about service activity (announcements, duty shifts, training, messages, etc.).

On web / PWA, Web Push subscriptions may be registered. On iOS, notifications use Apple Push Notification service (APNs). On Android, Firebase Cloud Messaging (FCM) may be used when enabled for the app.

• Installation / device identifier
• Push token or endpoint (Web Push or APNs)
• Association with the user account for delivery
• Notification category preferences, when configured

7. Technical data

To operate and secure the service, limited technical data may be processed: server logs, error diagnostics, IP addresses as part of HTTPS traffic, limited technical fingerprints to slow abuse on some public forms, and app version information.

We do not use third-party advertising or cross-app advertising tracking in Caserne+ for the version covered by this policy.

8. Hosting and technical processors

Caserne+ relies on technical providers for hosting and delivery. Depending on the feature, data may transit through or be stored with:

• Supabase — authentication, database, file storage (documents, photos, logos)
• Vercel — hosting for the web app and API routes
• Resend — transactional email (invitations, password reset, Kalouva notices)
• Apple (APNs) — push delivery on iPhone when the native app is used
• Google Firebase Cloud Messaging (FCM) — push delivery on Android when enabled

9. Retention

Member data remains associated with the account and active memberships while the account or organizational access is maintained.

The product does not currently define, in code, a single automatic retention period (for example “delete after X months”) for all service content.

Some operational records of a fire department (duty history, training, documents, inventory, etc.) may need to be kept for the organization’s needs or legal/administrative obligations. Deleting a personal account does not delete the fire service, other members’ data, or histories the organization must retain.

When an administrator removes a member from a service, the product removes access and certain membership-linked data for that service; that is not necessarily a full authentication-account deletion.

10. Account deletion and rights

You can request deletion of your personal Caserne+ account from the app (Profile) while signed in, including if you belong to more than one fire service. The request is sent to Kalouva for processing; it does not automatically delete fire departments, other members’ accounts, or histories organizations must retain.

We may require identity confirmation (signed-in session and/or password) before processing. You will receive an acknowledgment of the request; Kalouva completes the actual processing under applicable rules.

You may also write to francis@kalouva.ca for a privacy question, correction, or request about your personal information.

11. Children

Caserne+ is built for fire departments and adult users authorized by their organization. It is not intended for children.

12. Changes

We may update this policy to reflect product or legal changes. The date at the top of the page will be updated. For material changes, we may also notify customer organizations through usual channels.

13. App Privacy correspondence (App Store)

As a guide for Apple’s App Privacy labels (to be validated before submission), the following categories match current product practices:

• Contact info (email) — yes, linked to identity — auth and invitations
• Identifiers (device / push token) — yes, linked to identity — notifications
• User content (messages, announcements, documents, photos, inventory, etc.) — yes — product function
• Usage data / diagnostics — possible via logs and server errors — reliability and support
• Health, App Store financial data, advertising, precise location — not intended for the use described here
• Tracking (ATT) — not intended if there is no advertising / cross-app analytics