Privacy Policy

Last updated: September 30, 2026

1. Who we are and who's accountable

LiftPedia ("we," "us," or "our") operates the website at liftpedia.ca (the "Site"). LiftPedia is an independent, unincorporated project, not a registered company, operated by its founders from British Columbia, Canada. You can read about the people behind it on our Who We Are page.

Because we are not incorporated, the people who run LiftPedia are personally responsible for how your information is handled. We mention this not as a disclaimer but because it is the relevant fact: there is no corporate layer between you and the people reading your messages.

Canadian privacy law requires us to name someone accountable for compliance. That role is the LiftPedia Privacy Contact, reachable at [email protected]. Every access, correction, and deletion request goes to that address and is handled by a founder directly.

2. Scope of this policy

This policy covers the Site at liftpedia.ca and the two forms on it, the waitlist signup and the contact form. It does not cover third-party websites you reach by following a link from here; once you leave, that site's own policy applies.

LiftPedia has not launched. There are no user accounts, no app, and no product database yet. When those exist, this policy will be updated before they go live, not after.

3. What we collect

Below is the complete list, matched to the actual fields in our database. We have written this from the code rather than from a template, so it should be exact.

If you join the waitlist

• Email address, the only thing we ask you for.
• Consent record, a flag confirming you checked the consent box, so we can show your permission was given.
• Signup source, a short internal label (for example, "landing") noting which part of the Site you signed up from.
• Unsubscribe token, a random identifier we generate, used only to verify an unsubscribe link is genuinely yours.
• Timestamp, when you signed up.

If you use the contact form

• Email address, required, so we can reply.
• Name, optional.
• Subject, optional.
• Inquiry type, optional (general, partnership, press, feedback, bug, other).
• Your message, whatever you choose to write. Please don't include health details or anything sensitive; we have no need for it and would rather not hold it.
• Timestamp, and an internal flag noting whether we've dealt with your message.

Bot protection

Both forms are protected by Cloudflare Turnstile, which checks that a submission came from a person rather than a script. To perform that check, your IP address is sent to Cloudflare along with a one-time token. We do not store your IP address, it is passed through for verification and discarded.

Server logs

Like every website, requests to the Site pass through our hosting provider's infrastructure, which maintains operational logs for security and reliability. These are generated and controlled by Cloudflare under their own policies; we do not build profiles from them and do not copy them into our own records.

4. What we deliberately don't collect

This section exists because what a site chooses not to keep tells you more than what it collects.

• Your quiz answers. The demo quiz runs entirely in your browser. Your age, weight, sex, training history, goals, allergies, and dietary restrictions are never transmitted to us. There is no endpoint that receives them and no table that stores them.
• Your IP address. Not stored in our database at all.
• Your country or location. We previously stored a two-letter country code and deliberately removed it from our database as a data-minimization measure. We don't need it, so we don't keep it.
• Payment or financial information. We take no payments and have no payment processor.
• Government identification of any kind.
• Health records, biometrics, or any special-category data.
• Advertising or behavioural profiles. We run no ad tech and participate in no ad networks.
• Information about you from third parties. We don't buy email lists, append data, or enrich records. Everything we hold, you gave us directly.

5. How we collect it

Two ways, and only two:

1. You give it to us by typing it into the waitlist or contact form and submitting it.
2. Automatically, at the network level, through our hosting provider's standard request handling and bot protection, as described in section 3, and not retained by us.

6. Why we collect it

Each purpose, stated against the data it applies to:

We will not use your information for a new, unrelated purpose without telling you first and, where the law requires it, asking your permission.

7. Consent and withdrawing it

We rely on your express consent for waitlist emails. You give it by checking the consent box, which is not pre-checked and which the form will not submit without. Signing up is the only way onto our list, we never add anyone who didn't ask.

You can withdraw consent at any time, with no explanation needed and no consequence:

• Click the unsubscribe link in any email we send, or
• Use the unsubscribe form on our homepage, which emails you a confirmation link, or
• Email [email protected] and ask.

Unsubscribing deletes your record outright. We do not keep you on a suppression list, a "do not contact" archive, or an anonymized remnant. The row containing your email is removed from our database. The practical consequence is that if you later want back on the waitlist, you'll need to sign up again, we think that's the right trade.

8. Legal bases (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on these bases:

• Consent (Art. 6(1)(a)), for sending you waitlist and launch emails. Withdrawable at any time, as described above.
• Legitimate interests (Art. 6(1)(f)), for replying to a message you chose to send us, and for operating bot protection to keep the Site functional and secure. We have weighed these against your rights and consider them minimal in impact: you initiated the contact, and the bot check retains nothing about you.

We do not rely on "contract" (we have no contract with you), nor on "legal obligation" or "vital interests," for any processing described here.

9. Cookies and similar technologies

This Site sets no analytics cookies, no advertising cookies, and no tracking cookies. We use no Google Analytics, no Meta Pixel, no heatmaps, no session recording, and no third-party advertising or social tracking scripts. We also store nothing in your browser's local storage.

The only technology of this kind on the Site is Cloudflare Turnstile, our bot protection, which may set a short-lived identifier to confirm a form submission is human. This is strictly necessary to provide a service you asked for (submitting the form) and to protect the Site from abuse. Under European ePrivacy rules and Quebec's Law 25, strictly necessary technologies of this kind do not require a consent banner, which is why you don't see one here.

If we ever add analytics or any non-essential tracking, we will implement a proper consent banner first, obtain your explicit opt-in before anything is set, and update this section. We are not interested in doing it the other way around.

10. Who processes your data

Two service providers, listed in full:

Both act as processors on our behalf: they handle your data to provide a service to us and are not permitted to use it for their own purposes. We share your personal information with no one else, no analytics vendor, no advertising network, no data broker, no CRM, no AI training provider.

We may disclose information if we are legally compelled to, a valid court order, subpoena, or binding legal requirement, or where necessary to protect someone's safety or to investigate abuse of the Site. We would resist overbroad requests and, where lawful, tell you.

11. Where your data goes

Both of our providers are United States companies and operate global infrastructure, so your information may be stored or processed outside Canada, including in the United States. While it is there, it may be accessible to authorities in that country under their laws.

For transfers out of the EEA or UK, we rely on our providers' Standard Contractual Clauses and equivalent transfer mechanisms. For Quebec residents, we acknowledge that Law 25 requires a privacy impact assessment before personal information is transferred outside Quebec; we are a pre-launch project with two processors and a single data field, and we assess that transfer as low-risk on that basis.

If you would rather we not hold your email at all, don't join the waitlist, or join and unsubscribe, which deletes it.

12. How long we keep it

Honest caveat about backups: deletion removes your record from our live database immediately. Infrastructure-level backups held by our hosting provider may retain a copy briefly until they age out on their normal cycle. We cannot surgically edit those, and we'd rather say so than imply an instant and total erasure we can't technically guarantee.

13. How we protect it

• Encryption in transit, the entire Site is served over HTTPS, with HSTS enabled so browsers refuse to connect insecurely.
• Injection-resistant database access, every database query uses bound parameters rather than assembled strings, which is the standard defence against SQL injection and is enforced as a rule in our codebase.
• Secrets kept out of the code, API keys live in the hosting platform's encrypted secret store, never in our source repository and never in anything sent to your browser.
• Hardened response headers, including clickjacking protection, MIME-type sniffing protection, and a restrictive referrer policy.
• Bot protection on both forms.
• Minimal access, only LiftPedia's founders can reach the database, and only through authenticated provider tooling.
• Data minimization as a habit, we removed a field we were already storing because we decided we didn't need it. That's the standard we hold ourselves to.

No system is perfectly secure, and we won't claim otherwise. What we can say is that we hold very little, which is the most effective protection available to us.

14. If there's a breach

If personal information under our control is lost or accessed without authorization and it creates a real risk of significant harm to you, we will:

• Report it to the Office of the Privacy Commissioner of Canada as soon as feasible, as PIPEDA requires;
• Notify you directly, at the email address we hold, describing what happened, what was involved, and what you can do;
• Keep a record of the incident, as required by law;
• Notify the relevant European or UK supervisory authority within 72 hours where GDPR applies.

15. Your rights

Everyone, regardless of location, may ask us to do any of the following, we don't gate rights by geography:

• Access, get a copy of what we hold about you.
• Correct, fix anything inaccurate or incomplete.
• Delete, have it erased.
• Withdraw consent, stop our emails, without affecting the lawfulness of what we did beforehand.
• Port, receive it in a structured, machine-readable format.
• Object or restrict, challenge processing we base on legitimate interests, or ask us to pause it.
• Challenge our compliance, question how we've handled your information and get a substantive answer.
• Complain to a regulator, as described in the next section but one.

Specific additional notes:

• Quebec (Law 25): you also have the right to data portability and the right to request that we cease disseminating your information or de-index a link where dissemination contravenes the law or a court order.
• California (CCPA/CPRA): you have the right to know, delete, and correct, and to opt out of the "sale" or "sharing" of personal information. We do not currently sell or share personal information as those terms are defined, see section 22, and if that ever changes we will publish a "Do Not Sell or Share My Personal Information" link before it does. We do not use or disclose sensitive personal information beyond what's described here, and we run no financial-incentive or loyalty programs. We will not discriminate against you for exercising any right.
• Global Privacy Control: we honour GPC signals. Since we run no tracking and currently sell no data, there is in practice nothing for the signal to switch off today, and we will not add anything that ignores it.

16. How to exercise your rights

Email [email protected] and tell us what you want. There is no form to fill in and no fee.

• We respond within 30 days (and within one month where GDPR applies). If a request is genuinely complex and we need longer, we'll tell you before the deadline, with a reason.
• We may need to confirm you control the email address in question, usually by replying to it, so that we don't disclose or delete someone else's data to whoever asks.
• If we refuse a request, we will tell you why, and tell you how to complain about that refusal.

17. How to complain

Please come to us first at [email protected], we would rather fix something than have you escalate it. But you never have to go through us, and you can complain to a regulator at any time:

• Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec K1A 1H3 · 1-800-282-1376 · priv.gc.ca
• Office of the Information and Privacy Commissioner for British Columbia, oipc.bc.ca
• Commission d'accès à l'information du Québec, cai.gouv.qc.ca
• EEA residents, your national data protection authority.
• UK residents, the Information Commissioner's Office, ico.org.uk

18. Children's privacy

The Site is not directed at children. You must be at least 13 to use it or join the waitlist, as our Terms of Service set out. We do not knowingly collect personal information from anyone under 13.

In some EEA countries the minimum age for consent-based processing is higher, up to 16. If you are under the applicable age where you live, please don't submit your email without a parent or guardian's involvement.

If you believe a child has given us their information, email [email protected] and we will delete it promptly, no verification hoops.

19. Automated decision-making

The demo matcher and quiz on this Site run entirely in your browser using fixed sample data. They send nothing to us, make no decision about you, and have no effect of any kind outside the page you're looking at.

When the real personalization engine launches, it will rank supplement products against preferences you choose to give it. That is a product recommendation, not a decision with legal or similarly significant effects on you, it does not determine access to credit, employment, insurance, healthcare, or any service. If that ever changes, we will tell you before it does, explain the logic involved, and provide the right to human review and to contest the outcome, as European and Quebec law require.

20. Affiliate links and outbound clicks

LiftPedia intends to earn commissions on purchase links once it launches. Our Affiliate Disclosure explains that model in full, including why it cannot influence rankings.

In privacy terms: when you follow a link to a retailer, you leave our Site and that retailer's privacy policy governs what happens next, including any cookies they set to attribute the referral. What comes back to us is aggregate commission reporting, that a sale happened and what we earned. We do not receive your identity, your address, your payment details, or a list of purchases linked to you. We do not currently operate any affiliate links at all.

21. Email and CASL

We comply with Canada's Anti-Spam Legislation. Specifically:

• We send commercial email only with your express consent, obtained through an unchecked box with plain-language wording about what you're agreeing to.
• Every message identifies us and includes working contact information.
• Every message carries a one-click unsubscribe link that stays valid for at least 60 days, and we action unsubscribes immediately, well inside the 10 business days the law allows.
• We don't use misleading subject lines or sender names.
• We send infrequently. This is a waitlist, not a newsletter treadmill.

22. Selling or sharing your information

We want to be straight with you about this rather than make a promise we might not keep.

We do not currently sell, rent, trade, or license your personal information to anyone. No third party has ever received your email address from us for their own marketing or commercial purposes. As of the date at the top of this page, this has never happened and nothing of the kind is in place.

We are not promising it will never happen. LiftPedia is a pre-launch project still working out how it pays for itself, and we would rather tell you that honestly than publish a "we will never" that a future version of us quietly walks back. Plenty of companies have made that promise and broken it; we'd rather not join them.

What we will commit to, because it costs you nothing to hold us to and because the law requires it of us anyway:

• We would ask you first. Canadian privacy law fixes the purpose of personal information at the moment it is collected. You gave us your email to hear about our launch, that is the only purpose you consented to, and selling or sharing it would be a new and different purpose. We cannot lawfully repurpose it that way without obtaining fresh, specific, informed consent from you, and we won't try to.
• It would be opt-in, never opt-out. You would have to actively agree. Silence, inaction, or continued use of the Site would not count as agreement, and declining would never cost you anything, you would stay on the waitlist exactly as before.
• You would get clear notice before anything changed, by email to the address we hold, explaining who would receive your information and for what, not a silent edit to this page.
• If we ever did sell or share personal information within the meaning of California's privacy laws, we would publish a conspicuous "Do Not Sell or Share My Personal Information" link, honour Global Privacy Control signals, and update this policy before doing so, not after.
• We will not disclose your information as part of a sale, merger, or wind-down of LiftPedia without first giving you notice and a meaningful opportunity to have your record deleted instead.

Our intended business model is commissions on purchases people choose to make and an optional paid tier, see our Affiliate Disclosure. If that ever broadens to include anything involving your personal information, you will hear it from us directly and you will get to say no.

23. Changes to this policy

We may update this policy as LiftPedia develops, particularly when accounts, reviews, and the real product database launch. The "last updated" date at the top always reflects the current version.

For material changes, a new category of data, a new processor, a new purpose, or anything that reduces your protections, we will email everyone on the waitlist rather than quietly changing the date and hoping you don't check. Where a change requires fresh consent under applicable law, we will ask for it rather than assume it.

24. Contact us

Privacy questions, requests, or complaints:

LiftPedia, Privacy Contact
[email protected]
liftpedia.ca

For anything else, including general questions about the product, write to [email protected].

A real person reads both.

Terms of Service  ·  Affiliate Disclosure  ·  Who We Are  ·  Our Commitments  ·  Back to liftpedia.ca