Privacy policy

In short

• An account is optional. Without one, OneGo keeps no information about you.
• With an account, we keep your email address, your first and last name if you give them to us, and what you buy.
• Your card number is entered with Stripe, our payment provider. It never reaches OneGo.
• A shop never receives your email address, your phone number or your mailing address. It sees your first name, the initial of your last name and your pickup code.
• Your location stays on your phone. It is never sent to OneGo.
• No advertising, no tracking, and we never sell information.
• You can delete your account at any time: here is how.

Who is responsible

Your information is the responsibility of 9465-0785 Québec inc., which operates OneGo. Address: 411 rue Dalbec, St-Paul, Quebec J0K 3E0.

Person in charge of the protection of personal information: President of 9465-0785 Québec inc., who can be reached at support@onegomarket.com.

What happens without an account

The app downloads the list of shops and their photos from our servers. As with any internet connection, your phone sends its IP address to receive these files. OneGo does not use it to identify you. To block abuse, our hosting provider keeps a sample of it for a few hours at most.

The shops you follow and your notification choices are saved on your phone only. They are not linked to any account. They are gone if you uninstall the app, unless your phone's backup kept them.

Location, camera and notifications

Your phone asks for your permission before the app can use any of these. You can withdraw it at any time in your phone's settings.

• Location. Used on your phone, while the app is open, to sort shops from nearest to farthest. OneGo never sends it anywhere: it never reaches our servers. Without it, the app shows the shops in Montreal.
• Camera. Used only when you scan a shop's code. The image is read on your phone and then discarded: it is neither saved nor sent.
• Notifications. To be able to receive notifications, the app gets an identifier for your device from Firebase Cloud Messaging, a Google service; on an iPhone, it goes through Apple's notification service. When you turn on notifications for a shop, your phone subscribes to that shop's channel with that service. OneGo does not keep that identifier and does not know which devices subscribe to which shop.

What we keep if you create an account

You create an account by signing in with Apple or Google, or with a link we send you by email. We keep:

• your email address, as Apple or Google gives it to us after verifying it, or the one where you received our link. If you hide your email with Apple, we get an Apple relay address instead of yours;
• the identifier Apple or Google gives your account, so we recognise you the next time you sign in. It is not a password: OneGo has none. A link sent by email works once and expires after 15 minutes;
• your first name and last name, if you give them to us. Google gives them to us when you sign in, Apple only the first time you sign in, and you can type or change them on your account screen. With an email link, we receive neither;
• your language, French or English;
• the version of the terms of use and of this policy you accepted, in which language and when;
• your sessions: when each was opened, last used and when it expires. The session token stays on your phone or in your browser; the server keeps only a fingerprint of it, which cannot be turned back into the token;
• the shops you asked us to add to OneGo, with their name and address;
• if you sign in with Apple: the state of email forwarding to your hidden address (on or off, and since when), so we do not write to an address that goes nowhere, and the notices Apple sends us about your account (the kind of notice, what OneGo did and the dates, without your email address). The receipts of these notices are erased 90 days after we receive them;
• the date your account was created.

Our database does not keep your phone number, your mailing address or your card number. It keeps your IP address in one place only: when you ask for a sign-in link by email, to limit the number of requests. It erases it after a day. Our technical logs record each request (what was asked, the response and how long it took), without your email address or your IP address, and are erased after 30 days. To block abuse, our servers limit the number of requests per IP address. Our hosting provider keeps a sample of these requests, IP address included, for a few hours at most.

What we keep when you buy

When you buy a box, by subscription or as a one-off, we also keep:

• your subscriptions: the box, the pickup day, the start and end dates, the months skipped and your pickup code, which lets the shop hand you your box;
• your orders: the box, the shop, the pickup date, the price, the taxes, the payment, any refunds and when the box was handed to you;
• the waitlists where you are waiting for a spot;
• your card: its number is entered with Stripe, our payment provider, and never reaches OneGo. We keep the customer identifier Stripe gives us, and the card's brand, last 4 digits and expiry date, to show you which card will be charged. We give Stripe neither your name nor your email address. Stripe sends us notices about each payment, which can include the name entered with the card and, if you pay with Stripe's Link, the email address you gave it. We erase them after 30 days, or as soon as your account is deleted;
• the notices we send you about your orders and your waitlists, such as a declined payment or a refund. They are erased 90 days after they are sent or expire.

What the shop sees

The shop you buy from never receives your email address, your phone number or your mailing address, and OneGo does not pass them on. For each subscription and each order, the shop's team sees:

• your first name and the initial of your last name, if you gave them to us (for example "Marie L.");
• your pickup code;
• the box, the extras, the pickup location and dates, and the state of your orders.

The shop's employees see only the boxes to pack and hand over. The shop may use this information only to pack and hand over your boxes. After a subscription ends, the shop still sees it for 12 months, then no longer.

Why we use it

• to create your account, recognise you when you sign in, and protect it;
• to show that you accepted our terms and this policy;
• to take your payments for the shop, issue your receipts and make your refunds;
• to let the shop pack your box and hand it to you;
• to write to you in your language, including about your orders;
• to answer your questions and requests;
• to keep the records tax law requires;
• to run the app and keep it secure.

We never use it for advertising or to build a profile of you, and we sell it to no one.

Who else can see it

Only the people at OneGo who need it to run the service can see your information. The shop you buy from sees what the section "What the shop sees" describes. OneGo uses these providers:

• Amazon Web Services, which hosts our servers and our database in its Ohio region in the United States (us-east-2), sends our emails, and delivers the app's and the website's files over its worldwide network;
• Apple and Google, for sign-in: they give us your email address, your account identifier and, when they provide them, your first and last name. When you delete an account opened with Apple in the app, we ask Apple to remove OneGo's access. Apple also tells us when you stop using Apple to sign in to OneGo, when you delete your Apple Account, and when you turn forwarding to your hidden address on or off;
• Stripe, which receives your card and takes your payments for the shop. Stripe handles your card number and what you enter with it under its own terms;
• Google (Firebase Cloud Messaging) and Apple, to deliver the notifications you turned on;
• Expo, which delivers app updates: your phone checks with its servers whether a new version exists, and Expo then receives the phone's IP address and a random identifier specific to this installation of the app;
• Google Workspace, where the emails you send us and our replies arrive and are kept.

OneGo also uses an artificial intelligence service, OpenRouter, to translate and correct shops' text and improve shops' photos. No information about customers is sent to it.

We may also disclose information when the law requires it.

If you work at a shop

If you are an owner, manager or employee of a shop on OneGo, we also keep:

• your email address, your language and your role in the shop. The other members of the team can see your email address and your role, and who handed over an order;
• the record of the versions of the merchant agreement you accepted, in which language and when;
• the shop's profile: its name, legal name, address, phone, contact email, website and GST/HST and QST numbers;
• the email address, language and role of the people you invite to the team, kept until the invitation is accepted or cancelled;
• the bank's name and the last 4 digits of the account the shop's payouts go to.

Stripe keeps your identity and your bank account; OneGo does not keep your full bank account number. When the shop's Stripe account is opened, OneGo sends Stripe the shop's name, legal name, address, phone, contact email (or yours, if the shop has none), website and tax numbers.

To find the shop's address, what you type in the address search is sent to Google. The shop's texts and photos go through OpenRouter to be translated, corrected and improved, then they are published in the app, for anyone to see.

What remains of a departed shop's account, without its email, is kept for three years. Your rights are the same as those described below; for a complaint, what counts is where your shop is. The merchant agreement also describes this information.

Information kept outside Canada

Our servers are in the United States, and Apple, Google, Stripe, Expo and OpenRouter also handle information outside Canada. Your information is therefore sent outside Canada, where it is subject to the laws of the place where it is kept.

How we protect it

• traffic between the app and our servers is encrypted;
• our database is encrypted;
• session tokens are kept as a fingerprint, never as they are;
• your card number is entered with Stripe and never reaches OneGo;
• access to our systems is limited to the people who need it, each with their own sign-in;
• our test and production environments are separate: our customers' information is never copied into a test environment.

If a confidentiality incident presents a risk of serious injury, we notify you and Quebec's Commission d'accès à l'information or the Office of the Privacy Commissioner of Canada, as the law that applies requires.

How long we keep it

• your account, your subscriptions and your orders: until you delete your account;
• a session: it expires after 7 days without use, and after 180 days at most;
• after a request to delete an account: your waitlists and the shops you asked for are erased at once. Your email address, your first name, your last name and the link to Apple or Google are kept, as are your devices (for pickup reminders) and your upcoming notices, until your account closes, which is 30 days after your last scheduled pickup and at most 60 days after your request. They are then erased, and we ask Stripe to delete your saved card. Nobody can sign in to your account in the meantime. After closing, your email address can remain for up to a day in the sign-in link records. What remains is an anonymous account number, your language, the dates the account was created and deleted, the record of the documents you accepted and the dates of your sessions. We keep this remainder for three years, to show the consent we received and to meet our legal obligations. The exception: the receipts of the notices Apple sent us about your account, tied to that anonymous number: they remain for up to 90 days after we receive them, so sometimes after your account has closed, and are then erased.
• your orders, their payments (with the card's brand and last 4 digits) and your ended subscriptions also remain after deletion, without your email address or your name, for as long as tax law requires;
• Apple's notices about your account: erased 90 days after we receive them;
• backup copies of our database: they are erased automatically after 14 days at most. Deleted information can therefore remain in them for up to 14 days.

Your rights and how to use them

At any time, you can:

• find out what information we hold about you and get a copy of it in a structured, commonly used format;
• have inaccurate information corrected. You can change your language, your first name and your last name yourself in the app. Your email address comes from Apple, from Google or from your mailbox: write to us if it is wrong;
• have your account deleted, yourself in the app or by writing to us: here is how. A subscription in progress must be cancelled first, and a payment in progress must be finished. If you delete your Apple Account, Apple tells us and your OneGo account is deleted by the same rules. If you stop using Apple to sign in to OneGo, we end all your sessions, on all your devices;
• withdraw your consent: turn off a permission in your phone's settings, or delete your account.

To make a request, write to support@onegomarket.com from your account's email address. We will reply to that address to confirm the request comes from you, then deal with it no later than 30 days after we receive it.

If you are not satisfied with our answer, you can file a complaint with Quebec's Commission d'accès à l'information if you live in Quebec, or with the Office of the Privacy Commissioner of Canada if you live elsewhere in Canada.

Changes to this policy

The new version is published on this page with the date it takes effect. If you have an account, the app shows you the new version and asks you to accept it.

Contact us

support@onegomarket.com, or by mail: 9465-0785 Québec inc., 411 rue Dalbec, St-Paul, Quebec J0K 3E0.