Privacy Policy

Last updated: October 23, 2026 · Version 2026-10-23

itwala (“we”, “us”) is a website operated by itwala, a business in Canada. On itwala people can see the work we do, read about our services, and connect, post and chat with us and with each other. We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and its ten fair information principles, Canada’s Anti-Spam Legislation (CASL) and, for members in Quebec, the Act respecting the protection of personal information in the private sector (as amended by Law 25). This policy explains what we collect, why, who sees it, how long we keep it, and the choices you have.

1. Who is responsible

itwala is responsible for personal information on itwala. Our Privacy Officer (the person in charge of the protection of personal information) is accountable for this policy and answers questions and complaints: hello@itwala.ca.

2. What we collect and why

• Account details — first and last name, email address and password. Your password is stored only as a one-way scrypt hash. We email you a code to confirm the address belongs to you.
• About you — at sign-up we ask which best describes you (for example student, freelancer or business owner) and what you want to do on itwala. We use your answers to understand who uses the site, to show you relevant services, and to follow up if you said you want to hire us. Only you and our administrators can see them; you can change them in Settings.
• Birthday — used only to confirm you are 16 or older. It stays hidden unless you choose to show the month and day to your friends.
• Optional profile details — profile picture, about me, work, current city, hometown, relationship status, education, interests, favourite quote, website and links to your other social profiles. You choose whether to add any of these.
• Things you post and send — status updates, photos, videos, links, comments, likes, shares, nudges and messages, photos and files you send in chat, plus who can see each post (Public, Friends or Only Me). Each post is labelled with the kind of device it was posted from (for example “via iPhone”), worked out from your browser. We never see your device’s name.
• Photos and videos you upload — before a photo or video is saved we automatically remove hidden information that phones and cameras add, such as the GPS location where it was taken, the camera make and serial number, and comments. Videos from members can be up to 30 seconds long. The first time you upload, we record that you confirmed you have the right to share what you upload.
• Reports — if you report a post, person or message, we keep your report, the reason you chose and, for messages, copies of the messages you reported, so an administrator can review them.
• Friends and blocks — used to decide who can see your profile and posts and who can message you. People you block aren’t told.
• Security information — your IP address, browser type and, when the network provides it, the approximate city and country of your connection; the time of sign-ups, logins, failed logins, two-factor checks and account changes; the devices you are logged in on; and devices you marked as trusted. If you turn on two-factor authentication we store your authenticator secret (encrypted) and one-way hashes of your backup codes. We use this to protect accounts, stop spam and abuse, warn you about new logins and unusual activity, and block networks that attack the site.
• “I’m not a robot” check — when you sign up, reset your password, or after wrong passwords, your browser completes a check that proves a person is using it. See section 7 for who provides it.
• How people find itwala — when you open a page, your browser sends the page and the site you came from (for example google.com), with any campaign tags in the link. We don’t store your IP address for this: we keep a one-way code made from it, your browser and the date, which changes every day, plus the approximate place (city, region, country) and device type (phone or computer). When you sign up or log in we also record where you came from that time, the approximate place and the device type. No cookies are used for this. We use it to see which sites, posts and campaigns bring people to itwala. Kept 13 months.
• Activity counts — how many requests, messages, posts, uploads and friend requests an account makes in a short time, kept in memory for an hour, so we can spot spam and hijacked accounts.
• Credit and the top 10 — your welcome credit and any free credit we give you, and how it was used; if you buy credit: the amount, date, currency, the Stripe payment reference, and any refund or dispute; your bids and headlines. Stripe (our payment processor) collects your card details and billing information directly — we never see or store your card number. If you bid in the top 10, your name, profile photo, the amount you bid, headline, what you offer, your website and your linked social profiles are shown while you are listed — in members’ home pages for all 10 places, and publicly on the front page (including to people who aren’t logged in) for places 1 to 3 — and any member can message you; you agree to this each time you bid.
• Automatic checks of public text and photos — posts, comments, names, profile details and top 10 listings are checked automatically for explicit words and slurs, which are refused. When photo scanning is turned on, each photo you upload is sent to Google Cloud Vision to check for explicit or graphically violent content before it is saved; Google analyses it and doesn’t keep it. Private messages aren’t scanned for content and chat photos and files are never sent to Google; they’re only checked for their real file type, for hidden programs, macros or scripts, and against a list of files our administrators have blocked (for example child sexual abuse material).
• Photos and files in chat — a photo or file you send in a private chat can be opened only by you and the person you sent it to. It’s stored encrypted on our server, hidden location and camera details are removed from photos, and an administrator can open it only right after opening that conversation for one of the reasons below (both steps are recorded in the audit log). A file you attach but don’t send is deleted within a day; sent files are deleted with the conversation or either person’s account, and encrypted backup copies within 30 days after that.
• Projects, quotes, invoices and reviews — when you use a project room: the brief, status changes, notes, messages and files; quotes and invoices (the items, prices, taxes, your tax number if you enter one, and dates); and reviews you write or receive. We use these to run the project room and to show your rating.
• Username and public page — if you choose a username, anyone with the link itwala.ca/yourname (including people without an account and search engines) can see your name, profile photo, work, current city, about me, badges, rating, public portfolio items and your latest reviews. Your posts, friends, messages, email and birthday are never shown there. You can turn the public page off in Settings → Profile; then it shows only your name.
• Current city — you pick it from a list of real places (from GeoNames), so it can be shown on your profile and on a map at the city’s centre (never your address). If you choose “Confirm with my device”, your browser shares a rough position once (about 10 km); we only check it’s within 75 km of your city and keep the date of the check — not the position.
• Free @itwala.ca forwarding — if you turn it on: your address, the email it forwards to (your account email), and when you turned it on or off. Forward Email (Forward Email LLC) receives the email and forwards it to you; it isn’t stored by itwala and itwala doesn’t read it. If your username was used for an @itwala.ca address, we keep that username after your account is deleted, only so it’s never given to someone else.
• Portfolio — the projects you add to your profile: title, your role, status, dates, description, link, picture, client name (only if you say they agreed) and, if you choose, a link to one of your itwala projects. Logged-in members (or only your friends, if you choose) can see them; people you block can’t.
• “Looking for…” posts and replies — the title, details, category, city, budget and deadline you post, and replies and prices offered.
• Verification — for a website badge, the website address and the date it was checked. To check, our server visits a page on your website once (it doesn’t follow links or store the page). For a business badge, the business name, Canada Revenue Agency business number and province you enter, plus the administrator’s decision and note. Your business number is seen only by you and administrators; other members see only the badge.
• Listing stats — if you are in the top 10, daily counts of how often your listing was shown, viewed, clicked and led to a message. These are numbers only; we don’t record who viewed or clicked.
• Directory and weekly summary — whether you chose to be listed in the People directory, your category, and whether you turned on the weekly summary email (with a consent record).
• Verified badge (ID verification) — if you apply: photos or PDFs of your business documents, photos of your government ID (front and back), a live photo of you holding a one-time code, your legal name, your business’s legal name, the type of ID, the code shown, and your consent. We use them only to decide whether to give the badge, to help resolve project disputes and fraud, and to answer legal requests. A person compares the photos; no face-recognition or biometric template is made. They’re stored encrypted, separately from the rest of itwala, are never shown to other members, and administrators can open them only with a stated reason, which is logged. Your subscription is handled by Stripe; we keep the subscription status and payment dates and amounts, never your card number.
• Portfolio proofs — for a website proof our server looks up the site’s DNS records and visits two addresses on it (the verification file and the home page) once, and again every 30 days. For a GitHub proof you sign in with GitHub; we receive your GitHub username and whether you can change the repository you named, keep those and the date, and revoke the GitHub access token straight away — we don’t keep it or read anything else.
• Client confirmations — when someone confirms (or declines, or withdraws) a project on your portfolio, we keep who did it, when, and the network address used, to help resolve disputes.
• Notification settings — which emails and browser notifications you want. If you turn on browser notifications we store the push address your browser gives us (provided by Google, Apple, Mozilla or Microsoft, depending on your browser).
• Consent records — when you accepted our Terms and this policy, when you confirmed upload rights, and when you gave or withdrew consent to emails, with the IP address used.

We do not collect gender, phone numbers, precise (GPS) location or contact lists, and we do not use advertising trackers, profiling for advertising, or third-party analytics. We don’t sell or rent personal information.

3. Consent and your choices

By creating an account you agree to the collection and uses described here. We ask for separate, express consent for news and offers by email (an unticked box at sign-up). Each notification email (for example a new message or friend request) can be turned on or off in Settings → Notifications, and every one has a one-click unsubscribe link. Privacy is set high by default: your profile details are visible to friends only, your birthday is hidden, and you can appear offline in chat. You can withdraw consent at any time by changing these settings or deleting your account; some services (like logging in securely) can’t be provided without the related information.

4. Who can see your information

• Everyone signed in can see your name, profile picture, linked profiles and posts you mark Public, and can find you in search.
• Your friends can see your profile details, friends list and posts you mark Friends. Everyone who joins starts as friends with itwala; you can unfriend itwala at any time. You can choose to show your profile details to everyone instead.
• Only Me posts are visible only to you (and to administrators — see section 5).
• Messages are visible to you and the person you are messaging, and to administrators only as described in section 5. They are encrypted while travelling over the internet (HTTPS) but are not end-to-end encrypted: they are stored on our servers.
• People you block can’t see your profile or posts, message you, nudge you or add you.
• Verification records are seen only by administrators. In a dispute about a project, we may tell the other member of that project your verified legal name and business name. Your ID and live photo are given to police or a court only when the law requires it (see section 12).

5. How we monitor itwala

To keep members safe, stop spam and abuse, protect accounts and meet our legal obligations, itwala’s administrators (the owner and people the owner appoints) can:

• see a live activity list of sign-ups, logins, posts, comments, uploads, new friendships, reports and security events, and who is online;
• see every post, comment, photo and video, including ones marked Friends or Only Me, and remove anything that breaks our Terms or Community Guidelines;
• see who has messaged whom and when. Administrators read the content of private messages only to review a report, investigate a safety concern (such as threats or exploitation), investigate a security problem (such as spam, fraud or a hijacked account), meet a legal obligation, or when you ask us to. They must choose one of these reasons first, and every time they open a conversation — or a photo or file in it — their name, the time and the reason are recorded in an audit log;
• temporarily “view itwala as” a member to check a reported problem. This is read-only: nothing can be posted, sent or changed, you don’t appear online, and every use is recorded with a reason;
• receive automatic security alerts (see section 6) and suspend accounts or block networks.

Administrators are bound by this policy, use the least information needed, and their access is logged and reviewed. We never use monitoring to sell to you or to profile you for advertising.

6. Automated decisions

Some security decisions are made automatically, without a person reviewing them first:

• after 2 wrong passwords for an email (or 5 from one network) you must pass the “I’m not a robot” check;
• after 5 wrong passwords in a row, logging in with that email is paused for 15 minutes, doubling each time it happens again (up to 4 hours) — “Forgot password” still works;
• a network that keeps failing logins or the robot check can be blocked automatically for a period set by the owner;
• sign-ups are refused from throwaway email services, from email domains that can’t receive mail, when a hidden form field is filled in, or when a network creates too many accounts;
• unusual activity (for example a login from two places too far apart for the time between them, or hundreds of messages in a few minutes) creates an alert: we email you a warning and tell our administrators, but nothing is blocked until a person decides.

If an automated decision affects you, you can ask us what information was used and the main reasons for it, ask us to correct that information, and ask a person to review the decision: email hello@itwala.ca.

7. Service providers and where data is stored

We share personal information only with service providers that help us run itwala, under contracts that require them to protect it and use it only for us, or when the law requires it:

Some of these providers may store or process information outside your province or outside Canada (for example in the United States), where it may be accessible to courts and authorities under local law. Before sending information outside Quebec we assess whether it will be adequately protected, as Quebec law requires.

8. Cookies and embedded content

We use only essential cookies, all HttpOnly so scripts can’t read them: itw_sid keeps you logged in (up to 30 days); itw_td is set only if you tick “Trust this device” at a two-factor login (30 days); itw_back is used only by administrators while viewing as a member (1 hour). There are no advertising or tracking cookies, so there is no cookie banner. If Cloudflare Turnstile is enabled it may use its own essential cookie while the check runs. Details: Cookie notice.

When someone shares a YouTube, Vimeo, SoundCloud, Spotify or Apple Music link, we show a preview but nothing loads from that service until you press play. When you do, that service’s player loads and its own privacy policy applies. YouTube videos use YouTube’s privacy-enhanced mode, and YouTube preview images come from YouTube’s image server.

9. How long we keep it

Legal holds. If we receive a legal demand to preserve information (for example a preservation order from police, or a lawsuit), we may keep an account’s data until the matter is over, even if the account is deleted. The account is deactivated and hidden in the meantime.

10. How we protect it

Passwords are hashed with scrypt; two-factor authentication is available; logins are rate-limited, protected by a robot check and locked after repeated failures; attacking networks can be blocked; every request is checked against cross-site forgery; pages use a strict content security policy; uploaded files are checked and served safely; authenticator secrets and backups are encrypted (AES-256); data is sent only over HTTPS; and administrator access is restricted and logged. No system is perfectly secure. We keep a record of every breach of security safeguards. If a breach creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada (and, for Quebec residents, the Commission d’accès à l’information) as the law requires.

11. Your rights

• Access and portability — download a copy of your data in a structured, commonly used format any time from Settings → Your information, or ask us for anything else we hold about you.
• Correction — edit your profile in Settings, or ask us to correct anything else.
• Deletion — delete your account in Settings → Your information. This removes your profile, posts, comments, likes, messages you sent and files you uploaded, your reviews, portfolio, “Looking for…” posts, directory listing and business-number details (subject to a legal hold, above). Your name stays on quotes and invoices the other member of a project keeps for their records. Verified badge records are kept for 2 years after deletion (30 days if they were never approved), then deleted — see section 9. Deleting your account cancels your subscription.
• Withdraw consent — change your settings, unsubscribe, or delete your account.
• Security review — see where you’re logged in and your recent login activity in Settings → Security, and log out other devices.
• Automated decisions — ask for the reasons and a human review (section 6).
• Questions or complaints — email hello@itwala.ca. We reply within 30 days. If you’re not satisfied, you can contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.

12. Reporting to authorities

Canadian law requires us to report child sexual abuse material to the national tip line (Cybertip.ca) and to police, and to preserve related data for 21 days when we do. We also cooperate with valid court orders and preservation demands. In these cases we may share the information needed with police without telling the account holder, when telling them could interfere with an investigation.

13. Age

itwala is for people 16 and older. If we learn that someone younger has an account, we will delete it.

14. Changes

If we make important changes we will post them here, update the version number above, and tell members on the site before they take effect. This policy is published in English.