Privacy Policy

1. Who we are

Maple Citizen ("we", "us", or "our") is an independent Canadian citizenship test study aid operated by Zongheng Tian and available as a website at maplecitizen.ca and as an iPhone app (together, the "Service"). This policy applies to personal information we collect through the Service. When you give us personal information after reading this policy, you consent to its use for the purposes described here. Where the law requires a separate consent, such as for analytics or advertising cookies on the website, we ask for it separately. Our person in charge of the protection of personal information is Zongheng Tian, owner (support@maplecitizen.ca).

2. The website and the iPhone app

This policy covers the Maple Citizen website and iPhone app. You can take the 10-question baseline assessment without an account; to keep studying, you sign in (on the website, and in the iPhone app from version 1.0.1). With an account, your study progress and purchase access are associated with your account and synchronized through Supabase. Smart Review, a Pro feature, uses your answers and progress to pick practice questions for you, only when you start a Smart Review session (see section 3). Google sign-in may provide your name, email, account identifier and profile-image URL; the URL may be stored in shared account metadata. The website may display that image; the current iPhone app displays an initial avatar and has no photo-library upload feature. Leaderboard participation is optional; the iPhone leaderboard displays a name and XP.

The cookie, ad-measurement and analytics provisions below describe use of the website in a browser and are marked "website". Ads in iPhone app versions 1.0.3 to 1.1 are described in section 3, under "Older iPhone app versions". The iPhone app does not embed Google Ads, and versions after 1.1 contain no ad software. From version 1.3, it shares usage data with PostHog, as described in section 3 under "Analytics in the iPhone app". The sign-in providers and software libraries it uses may process authentication and service-usage data as described in their own disclosures: for example, Google sign-in may process a user identifier, and an approximate location derived from your IP address to help prevent fraud (Google's disclosure).

You can delete your account on the website under Profile › Delete account, or in the iPhone app under Profile › the gear icon › Settings › Delete account. If your account is linked to Sign in with Apple, we ask you to confirm with Apple again, and we then revoke Maple Citizen's Apple authorization.

3. Information we collect

Account information

You can take the 10-question baseline assessment without an account. When you sign in, we collect your email address. If you sign in with Google, we may also receive your name, a profile-image URL, and a Google account identifier, according to your Google account settings and the permissions you grant. If you sign in with Apple, on the website or in the iPhone app, we receive an Apple account identifier, the email address you choose to share (Apple may give us a private relay address instead of your own) and, the first time only, the name you choose to share. On the website, choosing Sign in with Apple takes you to Apple's own sign-in page; nothing from Apple loads before that. Apple then sends the result to our server, which signs you in.

Study and usage data

Your quiz attempts, answers, mistakes, flagged questions, module progress, readiness score, streaks, and badges, your settings, such as your display and test languages, and, if you answer them, how you heard about Maple Citizen, your province and when you plan to take the test — so we can save your progress, keep your settings on all your devices and personalize your review. We also look at how many accounts use each language, in totals only, to decide which languages to support and where to tell people about Maple Citizen. Before you sign in, this information stays on your device. When you sign in, it is synced to your account so it is available across your devices.

Personalized practice (Smart Review)

Choosing practice questions from your past answers is a form of profiling under Quebec law. Smart Review does this only when you start a Smart Review session: our server then scores your synced answers to pick about 18 questions and returns only their numbers. It doesn't run in the background, and its results are never used for advertising or shared. If you don't want it, don't start a session. You can also erase your answers by resetting your progress or deleting your account. Separately, mock tests (a Pro feature) can include questions you missed before; you can turn this off with the "Mix my mistakes into mock tests" switch on the Mock test page (in the iPhone app, the Test tab).

Leaderboard data (opt-in)

If you choose to join the leaderboard, your display name and, on the website, (if available) your profile photo are shown publicly to other users, along with your score or standing. The iPhone leaderboard shows your name and XP. Participation is optional, and you can leave at any time.

Payment information

Purchases on the website are processed by Stripe. We do not collect or store your full payment card number. We receive limited information from Stripe, such as your subscription or entitlement status, plan, and transaction identifiers needed to give you access, and we record when a 7-Day Sprint ends.

Purchases in the iPhone app are made through Apple's In-App Purchase system and are processed by Apple. We never see your payment details. We receive purchase and subscription information from Apple (such as the product, its status and transaction identifiers) to give you Pro access, and we record it against your account if you are signed in, including when a 7-Day Sprint ends.

Technical information

Website: like most websites, we and our providers automatically collect limited technical data such as IP address, device and browser type, and log/diagnostic data, and we use cookies and similar local-storage technologies (see section 6). When you sign in on the website, Cloudflare Turnstile runs an automatic check, usually invisible, to tell people from automated programs (bots). For this, Cloudflare processes your IP address and information about your browser and device, such as their type and settings; it doesn't read what you type. Cloudflare uses this information to run the check and, under its own responsibility, to improve it (Cloudflare's Turnstile privacy addendum). In the iPhone app, our hosting and sign-in providers receive standard network information, such as your IP address, when the app signs you in or syncs your progress.

Where you are: when you open the app, sign up or buy Pro, we use the province your IP address points to, which our hosting provider Cloudflare works out, to check that you are not in Quebec, where Maple Citizen isn't offered (see our Terms of Service). When you sign up or buy Pro, we keep the province code, not your IP address, with your account as a record of that check.

Analytics and product improvement (website)

To understand how the website is used and to improve it, we use Cloudflare Web Analytics and PostHog. Cloudflare Web Analytics is privacy-friendly and does not use cookies. What PostHog does depends on your choice in the cookie banner:

• Until you choose, PostHog records nothing.
• If you reject analytics, PostHog only counts visits and the steps people take, such as finishing the baseline assessment or signing in, without cookies or anything else stored on your device. To tell visits apart for a single day, PostHog's servers combine your IP address and browser details with a random value that changes every day and is then deleted. We don't keep your IP address, and these counts are never linked to you or to your account.
• If you accept analytics, PostHog stores a random ID in a cookie and in your browser's local storage, and records how you use the website: the pages you view, what you tap or click, your answers to practice questions (right or wrong, by question number), when you start or finish a unit, see the Pro page or buy, your display and test languages, and your device and browser type. It may also estimate your approximate location, such as your city, from your IP address; we don't keep the IP address itself. If you sign in, we link this information to your account with our internal account ID, never with your name or email address. PostHog also makes session recordings, so we can see where people get stuck: a recording shows the pages as you saw them and where you tapped, clicked or scrolled, but hides what you type and your name and email address. PostHog may also show you a short survey, at most once a week and never in the middle of a set of questions; answering is optional, and your answers are linked to your account if you are signed in.

We use this information only to understand and improve Maple Citizen. We never use it for advertising, and we don't sell it. PostHog, Inc. processes it for us and stores it in the United States (see section 8). We keep usage information for one year and session recordings for up to 30 days; when you delete your account, we ask PostHog to delete the information linked to it. You can change your choice at any time with the "Cookie settings" link at the bottom of every page; if you withdraw your consent, PostHog stops recording, deletes its random ID and goes back to counting visits without cookies.

Analytics in the iPhone app (version 1.3 and later)

To see where people get stuck, the app sends PostHog a limited set of usage events:

• Opening the app and the baseline assessment: when you open the app and see the welcome screen; when you start the baseline assessment, finish it or leave it before the end, and how far you got.
• Signing in: when you see the sign-in screen; which way you choose to sign in (Apple, Google or email); when we send you a code; whether you sign in, and whether your account is new; if you cancel on Apple's or Google's screen; if you close the sign-in screen, at which step; and, if signing in doesn't work, at which step and why, such as a wrong or expired code or a network problem, with the error code given by the system or the sign-in service (never the error message).
• After you sign in: when you see the question about how you heard about Maple Citizen, and your answer or that you skipped it, with the order the choices were shown in; when you see your study plan, and whether you start it or leave it for later.
• Leaving the app midway: if you switch to another app or your home screen, or lock your phone, while you're on one of the screens above or in your first unit, which screen you were on and how far you got.
• Studying and buying: when you start or finish a unit, or leave it before the end, and how far you got; your answers to practice questions (right or wrong, by question number); and when you see the Pro page or buy.
• Your settings and device: when you change your display or test language; your display and test languages; your time zone; and your device type and app version.

The app keeps a random PostHog ID in its own storage. If you sign in, we link these events to your account with our internal account ID, never with your name or email address. The app makes no session recordings, doesn't send what you type and doesn't use your location. PostHog may also show you a short survey in the app; answering is optional. This starts when you first open the app, before you sign in, and stays on unless you turn it off in the app under Profile › the gear icon › Settings › Share usage data; if you turn it off, the app stops sending data to PostHog and deletes its random ID. If the app finds that you are in Quebec, this stays off unless you turn it on. We use, keep and delete this information as described above for the website.

Reminders in iPhone app version 1.4

Version 1.4 of the iPhone app could show reminders on your lock screen if you turned them on. From version 1.5, the app shows no reminders and doesn't ask to send you notifications. When you open it, it cancels the reminders an earlier version set up and removes the ones still in Notification Center.

For come-back reminders, version 1.4 sent our server a device token (a code from Apple that lets an app on your iPhone receive notifications), your display language and your time zone. We never sent a come-back reminder. We no longer keep this information: our server discards it when version 1.4 sends it, and we deleted what we had on November 10, 2026.

Measuring our own ads (website)

If you arrive from one of our Google ads, we keep the ad's click ID with your account, and the website tells Google Ads when you sign up or buy (with the purchase amount), so we can measure our ads. Until you accept advertising cookies, this is sent without cookies. The website itself shows no ads.

Older iPhone app versions (1.1 and earlier): ads

Versions 1.0.3 to 1.1 of the iPhone app show ads to free accounts until you update the app. Versions after 1.1 contain no ad software: they show no ads, don't show Apple's tracking prompt or Google's consent message, and collect none of the information described in this subsection. In the rest of this subsection, "the app" means versions 1.0.3 to 1.1.

From version 1.0.3, the iPhone app shows ads to free accounts, served by Google AdMob. From version 1.1, other ad networks also bid, through Google, to show these ads: DT Exchange, Liftoff Monetize and Unity Ads, whose software is in the app, and Index Exchange, Magnite, PubMatic, OpenX and Smaato, which receive Google's ad requests and have no software in the app. The app shows Apple's prompt once, asking whether to allow tracking. If you allow it, Google and these ad networks may get your device's advertising identifier (IDFA) and personalize your ads: they can use the IDFA to link your activity in this app with information from other companies' apps and websites, to choose ads and to measure them. After you allow it, the ad networks may also use your approximate location and information about the ads you see and tap for this tracking. If you don't allow tracking, or don't answer, no one gets the IDFA and we ask Google and the ad networks for non-personalized ads only: they are not based on your interests or on your activity in other apps and websites. You can change your choice at any time in your iPhone's Settings › Privacy & Security › Tracking. If you use the app in the United Kingdom, Switzerland or the European Economic Area (for example, Norway or Iceland), Google's consent message also asks, before ads load, for your choices about personalized ads and about storing and reading information on your device; you can change them at any time in the app's Settings, under Privacy choices. In all cases, to show ads, limit how often they appear, measure them and prevent fraud, the ad software in the app may collect your IP address (to estimate your approximate location, such as your city, which can be used to choose ads), device and app information, a device identifier limited to our app, information about the ads you see and tap, and crash and performance data (Google's disclosure); some ad networks' software may also collect information about purchases made in the app. Some of this information, such as performance data, may be linked to your device's identifiers. The ad networks that bid through Google receive similar information with each ad request. If you report an ad with the ad's own controls, the ad network that showed it receives your report. Google and these ad networks also use this information for their own purposes, as their privacy policies explain: Google, Digital Turbine (DT Exchange), Unity, Liftoff, Index Exchange, Magnite, PubMatic, OpenX and Smaato. They may process it outside Quebec and Canada (see section 8). We do not share the study data in your account with Google or the ad networks. Ads can't be turned off in the free version: Maple Citizen Pro has no ads, and the app does not start any ad software for Pro accounts. You can read about ads at any time in Settings › Help › About ads, and report an ad in Settings › Help › Report an ad.

Older iPhone app versions (1.1 and earlier): gems

Gems were only in version 1.1 of the iPhone app, and they ended in all versions on October 22, 2026 (see our Terms of Service). Within 90 days after that date, we delete gem balances and gem history, check-in streaks, the count of ads watched for gems, and the time zone we kept for gems. Until then, we keep the gem data described below.

In version 1.1, free accounts in the iPhone app could earn and use gems, a free reward inside the app (see our Terms of Service). For this, we recorded with your account your gem balance and a history of the gems you earned and used: what each change was for (for example, a daily check-in, a finished unit, an ad, or a mock test unlocked with gems), the number of gems, and the date and time. We also recorded your check-in streak, how many ads you watched for gems each day, and your iPhone's time zone, so that each day started at your own midnight. When you chose to watch an ad for gems, our server gave the app a random one-time code, which the app passed to Google with the ad request; we didn't give Google your account ID, your email address or your study data. When the ad had been watched to the end, Google's server sent ours that code with details of the reward: an ID for the reward, the ad unit, the ad source, the number of gems, the time, and a digital signature. We used the code to add the gems to the right account, and kept the reward's ID in your gem history so that each ad paid only once. Otherwise, ads that gave gems worked like the other ads in the app, as described above.

4. How we use your information

• to provide, operate, and secure the Service and your account;
• to check that you are not in Quebec, where the Service isn't offered;
• to save and sync your progress across devices;
• when you start Smart Review, to pick practice questions from your answers and progress;
• to run the leaderboard, if you opt in;
• to run gems in iPhone app version 1.1 until they ended on October 22, 2026: adding and using them, applying the daily limits, and preventing cheating;
• to process payments and manage your Pro access, including when a 7-Day Sprint ends;
• to send you transactional messages about your account and security (for example, sign-in links);
• to prevent fraud and abuse and to comply with legal obligations;
• in iPhone app versions 1.0.3 to 1.1, to show ads to free accounts and measure them, and, if you allow tracking, to let Google and its ad partners personalize them (Maple Citizen Pro has no ads); and, on the website, to measure our own Google ads;
• to ask for your feedback: short, optional surveys on the website and in the app and, once, an email if you don't come back within 7 days after signing up (you can unsubscribe);
• to understand and improve the Service.

We do not sell your personal information for money. The website shows no ads, and only iPhone app versions 1.0.3 to 1.1 do; see section 3 for how advertising-related information is handled there and the choices you have. We do not use the study data in your account — your answers, mistakes, and progress — to target ads.

5. Consent

We collect, use, and disclose personal information with your consent, which may be express or implied depending on the sensitivity of the information and the context. You can withdraw your consent at any time (subject to legal or contractual limits) by deleting your account or contacting us; doing so may limit your ability to use parts of the Service. On the website, we ask for your consent before we use PostHog with cookies, session recordings and surveys (see section 3), and before we use advertising cookies to measure our own ads; you can withdraw either consent at any time (see section 6). In the iPhone app (version 1.3 and later), usage data is shared with PostHog unless you turn off Share usage data in Settings; if you are in Quebec, it stays off unless you turn it on (see section 3). In iPhone app versions 1.0.3 to 1.1, ads are personalized only if you allow tracking when Apple's prompt asks, and you can withdraw that permission at any time in your iPhone's Settings › Privacy & Security › Tracking (see section 3); versions after 1.1 don't ask.

6. Cookies and local storage (website)

This section describes the website. The iPhone app does not use browser cookies; it keeps your progress and settings in its own storage on your device, along with PostHog's random ID while Share usage data is on (see section 3). On the website, we use cookies and browser local storage to keep you signed in, remember preferences (such as your light/dark theme), and store your progress on your device. With your consent, we also use PostHog's analytics cookie and local storage, and advertising cookies to measure our own Google ads (see section 3); the website shows no ads. Without your consent, PostHog only counts visits, without cookies (see section 3). You can review or change your analytics and advertising cookie choices at any time using the “Cookie settings” link in our website footer, or clear or block cookies in your browser settings (though some features may not work properly without them).

7. How we share information — our service providers

We share personal information only as needed to run the Service, with providers acting on our behalf:

• Google — authentication (sign-in); measuring our Google Ads on the website; in iPhone app versions 1.0.3 to 1.1, ads through Google AdMob and Google's consent message in the United Kingdom, Switzerland and the European Economic Area; and older support emails (received before October 9, 2026), which remain in a Gmail account;
• Ad networks (iPhone app version 1.1 only) — bidding to show ads to free accounts, and receiving reports made with an ad's own controls: DT Exchange, Liftoff Monetize and Unity Ads, whose software is in the app, and Index Exchange, Magnite, PubMatic, OpenX and Smaato, through Google (see section 3);
• Apple — Sign in with Apple, on the website and in the iPhone app; In-App Purchases in the iPhone app; and our support inbox (emails to support@maplecitizen.ca are delivered to iCloud Mail);
• Supabase — account, authentication, and database hosting (stores your account, synced progress and, until they are deleted, gems);
• GitHub (Microsoft) — our daily database backup: GitHub's servers make the backup and encrypt it right away, and only the encrypted copy, which only we can open, is kept;
• Resend — sending sign-in emails and codes, notices about your account, and the feedback email described in section 4;
• Stripe — payment processing on the website, and management of existing Monthly plans;
• Cloudflare — website and serverless hosting, privacy-friendly (cookieless) web analytics on the website, and the automatic check against bots when you sign in on the website (Turnstile);
• PostHog — product analytics, session recordings and surveys on the website, and product analytics in the iPhone app (see section 3); PostHog stores this information in the United States.

These providers are expected to use the information only to provide their services to us; Google and the ad networks also use ad data from iPhone app versions 1.0.3 to 1.1 for their own purposes, as described in section 3. We may also disclose information if required by law, to enforce our Terms, or to protect rights, safety, and security.

8. International data transfers

Our service providers, and Google and the ad networks named in section 3, may store and process your information on servers located outside your province and outside Canada, including in the United States and other countries. While in another country, information may be subject to that country's laws, including lawful access by courts, law enforcement, and government authorities. Before we entrust your information to a provider outside Quebec, we assess whether it will be adequately protected, and we rely on our written agreements with that provider, as Quebec law requires. You may contact us for more information about our providers and where they process data.

9. How long we keep your information

We keep personal information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. When you delete your account or ask us to delete your information, we will delete or de-identify it within a reasonable period, except where we must retain certain records (for example, transaction records for tax or accounting purposes). You can delete your account yourself on the website under Profile › Delete account, or in the iPhone app under Profile › the gear icon › Settings › Delete account; if the account is linked to Sign in with Apple, we ask you to confirm with Apple again and then revoke Maple Citizen's Apple authorization. A subscription bought through Apple continues until you cancel it in your Apple subscription settings. Section 15 lists how long we keep each kind of information.

10. Your privacy rights

Subject to applicable law, you have the right to:

• access the personal information we hold about you and ask how it is used;
• correct inaccurate or incomplete information;
• withdraw consent and delete your account and associated data;
• leave the leaderboard at any time;
• where applicable under Quebec's Law 25, request portability of certain information and, in some cases, that information be de-indexed or no longer disseminated.

To exercise these rights, write to support@maplecitizen.ca. We may need to verify your identity. We reply in writing within 30 days. If you ask for portability, we send the information you gave us, including your answers and progress, in a structured, commonly used format such as JSON.

11. Security

We use reasonable administrative, technical, and physical safeguards — including encryption in transit and access controls provided by our hosting and authentication providers — to protect personal information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

12. Children's privacy

The Service is intended for adults preparing for the Canadian citizenship test and is not directed to young children. We do not knowingly collect personal information from a child without appropriate consent. If you believe a child has provided personal information without consent, contact us and we will take appropriate steps to delete it.

13. Data breaches

If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify you and the appropriate authorities — such as the Office of the Privacy Commissioner of Canada and, where applicable, Quebec's Commission d'accès à l'information — as required by law, and we will keep records of breaches as required.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we change the "Last updated" date above. Before an important change takes effect, we post a notice at the top of this page for at least 30 days and, for the iPhone app, mention it in the App Store's update notes; we may also tell you by email or in the app. If a change would let us use your information for a new purpose, we ask for your consent first where the law requires it.

15. How we manage personal information

These are our rules for handling personal information. They are approved by our person in charge of the protection of personal information.

• Who is responsible. Zongheng Tian, owner, is the person in charge of the protection of personal information. Maple Citizen has no employees: he is the only person who can access account data, and only to run the Service, answer requests or fix problems. Our providers (section 7) handle information only under their written agreements with us.
• How long we keep it. Account and study data: while your account exists, then deleted from our database when you delete your account (copies in our hosting provider's backups are erased on its schedule, and copies in our own encrypted daily backups within 30 days). Gem data: until 90 days after gems ended on October 22, 2026, or until you delete your account if that comes first. After a deletion we keep only a coded form of the account's internal ID (not your email address) and the deletion date, for up to 31 days, so that the account stays deleted if we restore a backup. Without an account: only on your device, until you clear it. Reminder details sent by iPhone app version 1.4 (device token, language and time zone): we don't keep them (see section 3). Copies of this information in backups are erased in the same way as account data. Purchase and tax records: six years, as the Canada Revenue Agency requires. Support emails: up to two years after your request is closed. Analytics (PostHog): usage information for one year and session recordings for up to 30 days; when you delete your account, we ask PostHog to delete the information linked to it. Visit counts made without cookies aren't linked to anyone and are kept for one year.
• How to make a privacy complaint. Write to support@maplecitizen.ca with "Privacy complaint" in the subject. We answer in writing within 30 days and keep a record of every complaint. If you're not satisfied, you can contact the authorities listed in section 16.
• Incidents. If personal information is lost, accessed or disclosed without authorization, we act to reduce the risk, record the incident, and notify you and the regulators when there is a risk of serious injury (section 13).

16. How to contact us & how to complain

For privacy questions, requests or complaints, write to our person in charge of the protection of personal information: Zongheng Tian, owner, support@maplecitizen.ca.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca). Residents of Quebec may also contact the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).