Privacy Policy

How we handle your personal information.

Demos exists to help you engage with Canadian Parliament — not to collect data about you. This policy explains exactly what we collect, why, who we share it with (almost nobody), and the rights you have over your information.

Effective date: 2026-05-18 · Version: 1.0 · Jurisdiction: British Columbia, Canada

The plain-language version

We collect your email, your postal code (for matching you to your Member of Parliament), and the values you tell us about in our survey. We use it only to surface Parliament activity relevant to you. We don't sell it, don't share it for advertising, don't send your data to AI providers for processing, and don't track you across the web. Our servers are in Canada. You can download or delete your data at any time from your dashboard. Quebec residents have additional rights under Law 25, summarized in Section 6.

  1. Who we are
  2. What we collect
  3. Why we collect it
  4. Who we share it with
  5. How long we keep it
  6. Your rights
  7. How we protect it
  8. Cookies and tracking
  9. Minimum age
  10. Where your data lives
  11. Changes to this policy
  12. Contact and complaints

1. Who we are

Demos is a Canadian civic-engagement service operated by Alex Makosz ("we," "us"), the founder and current privacy officer for the service. Demos is in closed beta at the time of this policy's effective date. The contact email for privacy matters is hello@demosvoice.ca.

This policy describes how we handle personal information when you use demosvoice.ca, including the public landing page, the closed-beta app, the public preview, and the explainer pages.

2. What we collect

We try to collect the minimum information needed to do what Demos does. Here is everything we collect:

When you create an account

InformationWhy we need it
Email addressTo log you in, send password resets, and deliver any digests you've opted into
Password (bcrypt-hashed)To authenticate you. We never store your password in readable form — we only store a one-way hash. Even we cannot recover your password.
Postal codeTo look up your Member of Parliament (MP) so we can show you their voting record and let you contact them

When you complete the survey

InformationWhy we need it
Your survey responses (24 questions)Used only to derive your values profile. Individual responses are stored so you can later review or change your profile, and so we can show you the reasoning behind your scores.
Your values profile (6 spectra positions)To match you with bills and petitions relevant to your values
Special issues you selectAdditional topics you've flagged as personally important, used to surface relevant content

From your activity in the app

InformationWhy we need it
Your Yes/No ratings on bills and petitionsSo you can see your previous rating, change your mind, and contribute to a constituent-wide tally we may later show your MP. Aggregate counts are never shown to other users.
Petition drafts you authorStored so you can resume drafting later. If you submit a petition through Parliament's portal, the petition itself becomes a public record on ourcommons.ca — we keep our draft copy with you.
Language and notification preferencesSo we send digests at the cadence you chose, in the language you chose
AI assistance preferencesSo we know when to offer AI-drafted petition or email text and when to leave you alone
Account timestamps (created, last login)For security audit and to detect dormant accounts

When you join the waitlist (no account required)

InformationWhy we need it
Email addressTo send your beta invite when capacity allows
IP address and user agentFor abuse detection only (signup-spam protection). Discarded once your account is created or the signup is withdrawn.
Which page you signed up fromTo understand which parts of the site lead to signups, so we can write better copy
Any free-text note you writeIf you choose to tell us why you're interested. Optional. Read by humans.

What we deliberately do NOT collect

3. Why we collect it

Under PIPEDA, we are required to identify the specific purposes for collecting personal information and to use it only for those purposes. We use your information to:

  1. Run your account: log you in, recover your password, let you change settings
  2. Match you with the bills, petitions, and votes most relevant to your values and your MP
  3. Send you the digest emails you've opted into, at the cadence you chose
  4. Let you contact your MP, share content, sign petitions on Parliament's portal, and (optionally) draft your own petition
  5. Detect abuse and protect the service (login throttling, signup-spam blocking)
  6. Generate aggregate tallies of constituent sentiment that we may later show MPs about their own riding — never shown to other users, never associated with names

We do not use your information for advertising, market research, profiling for any purpose other than the matching described above, or selling to third parties — not now, not ever.

4. Who we share it with

The honest short answer: almost nobody. The detailed answer:

We share content (never your identity) with these AI providers

We use these service providers to operate Demos

We use these public Parliament sources as inputs

We read from LEGISinfo, OpenParliament.ca, and ourcommons.ca to build our database of bills, votes, debates, and petitions. We never send them your data.

We do not

Legal disclosure

If we receive a valid court order or warrant from a Canadian court compelling disclosure of specific information, we will comply with the narrowest reasonable interpretation of that order. We will notify the affected user unless the order specifically prohibits notification. We have not received any such order to date and will publish a transparency note if and when we do.

5. How long we keep it

We keep personal information only as long as needed for the purposes above. Specifically:

InformationRetention
Account data (email, password hash, postal code, profile)Until you delete your account, or after 24 months of complete inactivity (with notice before deletion)
Your survey responses and values profileUntil you delete your account or retake the survey
Your ratings on bills/petitionsUntil you delete your account, then anonymized (not deleted) so the aggregate constituent tally for your MP remains accurate. Once anonymized, the rating can no longer be traced to you.
Petition drafts you authoredUntil you delete your account or abandon the draft, then hard-deleted
Digest send history12 months, then deleted
Waitlist signupsUntil you're invited and either confirm or decline. If you never respond, deleted after 12 months.
Password reset tokens1 hour from creation. Cleaned automatically nightly.
Login timestampsAccount-lifetime. Used to detect dormant accounts and to give you a "last login" indicator.
Admin login audit logs180 days (these are about our staff, not about you, but listed here for transparency)

6. Your rights

Under PIPEDA and (if you reside in Quebec) Quebec's Law 25, you have these rights over your information:

Right to access

You can see everything we hold about you. Use the "Download my data (JSON)" button at the bottom of your dashboard — it produces a single file containing your account, profile, ratings, petition drafts, and digest history. The file is generated on demand from our live database.

Right to portability

The same download is in a structured, machine-readable JSON format, suitable for transferring to another service if such a service emerges. This satisfies Quebec Law 25 §27.

Right to correction

You can update your email, postal code, survey responses, special issues, and notification preferences from your dashboard at any time. If you find inaccurate information that's not directly editable in the app, email hello@demosvoice.ca and we'll correct it within 30 days.

Right to deletion

You can delete your account from your dashboard. When you do:

Right to withdraw consent

You can withdraw consent for any optional processing at any time. This includes turning off all notification emails, disabling AI-assisted drafting, or deleting your account entirely.

Right to complain

If you believe we've mishandled your information, contact us first at hello@demosvoice.ca. If we don't resolve your concern to your satisfaction, you have the right to file a complaint with:

7. How we protect it

If a privacy incident occurs. If we discover unauthorized access to personal information presenting a real risk of significant harm, we will notify affected users by email within 72 hours of confirming the incident, and notify the Office of the Privacy Commissioner of Canada and (where applicable) Quebec's Commission d'accès à l'information within the timeframes those agencies require. We will publish a public transparency note on demosvoice.ca describing what happened and what we did.

8. Cookies and tracking

Demos uses only one cookie: a session cookie set when you log in, used solely to keep you logged in. It contains no personal information beyond the session identifier itself, expires when your session ends, and is deleted when you sign out.

We do not use:

Because our only cookie is strictly necessary to operate the service, we do not require a cookie consent banner under Quebec Law 25's "strictly necessary" exception. We will revisit this if we ever add any other tracking technology — though we don't intend to.

9. Minimum age

You must be at least 18 years old to create a Demos account. We chose this age to align with eligibility to vote in federal elections, which is the primary action Demos is built to inform. If we learn that someone under 18 has created an account, we will delete it.

10. Where your data lives

All personal information collected by Demos is stored on servers in Canada and processed under Canadian law. Specifically:

Because all of our infrastructure is Canadian-owned and located in Canada, your data is not subject to the US CLOUD Act or other foreign-government compulsion. Canadian data stays in Canada, under Canadian law. This is a deliberate design choice.

The only exceptions are:

11. Changes to this policy

If we make a material change to this policy — meaning a change that affects how your personal information is collected, used, or shared — we will:

  1. Email registered users at least 14 days before the change takes effect, explaining what's changing and why
  2. Update the effective date and version number at the top of this page
  3. Keep the previous version archived and link to it from the new version for at least one year

Non-material changes (typo fixes, link updates, clarifications that don't affect the meaning) are made without notice but still reflected in the version history.

12. Contact and complaints

Privacy questions, access requests, correction requests, or complaints all go to the same address: hello@demosvoice.ca.

We commit to responding to privacy requests within 30 days, the standard window under PIPEDA. If a request will take longer (e.g., a complex access request involving large amounts of historical data), we'll tell you why within 30 days and give you a realistic timeline.

If you're not satisfied with our response, your external complaint paths are:

About this policy

This policy is governed by the laws of British Columbia, Canada, and the federal laws of Canada applicable therein. It is grounded in:

We've completed a Privacy Impact Assessment (PIA) covering Demos's data practices, as required by Quebec Law 25 §3.3 before deploying technology that handles personal information. The PIA is an internal document; if you have specific questions it might address, write to hello@demosvoice.ca.