XYRO respects your privacy and handles personal information in line with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada’s Anti-Spam Legislation (CASL). This policy explains what we collect, why, and your choices. Our privacy contact is privacy.
What we collect
- Mailing list: your email, and optionally your first name and city, with a record of when and how you consented.
- Photo submissions: your name or handle, email, the photos you send, and optional credit, show details and notes.
- Contact messages: your name, email, organisation (optional) and message.
- Visit counter: an anonymous tally of page views, visits and the visitor’s country (from Cloudflare’s network, not your IP address). Nothing identifies you and no cookie is set.
- Security data: to stop spam and attacks, our server keeps a one-way scrambled (hashed) version of your IP address and short-lived request counters. We do not keep your raw IP address with your submissions.
We don’t use advertising trackers, analytics cookies or social media pixels.
How we use it
- To send the emails you asked for (only with your express consent).
- To review, credit and, if selected, publish submitted photos.
- To reply to your messages.
- To keep the Site secure and prevent abuse.
We never sell, rent or trade your personal information.
Who processes it
The Site and its forms run on Cloudflare, which hosts files and handles security checks (including Cloudflare Turnstile). If we use an email service to send the newsletter, your email is shared with that provider only to send it. These providers may store data outside Canada, including in the United States, where it may be subject to local laws. Fonts load from Google Fonts, and videos load from YouTube only after you press play. Those services receive your IP address when they load.
How long we keep it
- Mailing list: until you unsubscribe. Unsubscribes are actioned within 10 business days.
- Photo submissions not selected: deleted within 90 days. Published photos stay up until you ask us to remove them.
- Contact messages: up to 24 months.
- Security counters: minutes to hours. Hashed security logs: up to 30 days.
Photos and location data
Before we publish any photo, we strip its hidden metadata, including GPS location. Don’t send photos where a child is the main subject.
Your rights
You can ask to see, correct or delete the personal information we hold about you, or withdraw consent, by emailing privacy. We’ll reply within 30 days. You can also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
Security
The Site uses HTTPS, strict security headers, verification checks, rate limits and file-type checks. Submitted files are held privately until reviewed. No system is perfect, but we work to protect what you share.
Young fans
If you’re under 16, please get a parent or guardian’s okay before joining the list or sending photos.
Changes
If we change this policy, we’ll update the date at the top. Significant changes will be flagged on the Site.