Cookie policy
Our approach
PoliPost Canada uses no advertising, profiling or third-party tracking cookies. Informational pages (home, pricing, help, this policy) set no cookies at all until you use a feature that needs one. In line with s. 8.1 of Québec's Law 25, every optional technology is off by default.
What we set
| Name | Type | Purpose | Duration |
|---|---|---|---|
| ppdraft:v1:* / ppwz:* | Essential (local storage) | Recovery copy of content entered in long forms. It stays only in this browser, excludes passwords and files, and lets you resume after an interruption. | Up to 7 days; cleared after submission, draft discard, or explicit sign-out |
| polipost | Essential | Session cookie: sign-in security, the anti-CSRF token, and your in-progress letter while you write. | End of session |
| polipost_emb | Essential | Session cookie used only by campaign forms embedded on another organization's website. Kept separate from the main session; it holds just your in-progress form and its security token. | End of session (8 hours at most) |
| pp_cc | Essential | Remembers your consent choice (including a refusal). | 180 days |
| pp_dev | Essential (security) | Set when you sign in. A random identifier, not a fingerprint, that helps us recognize your returning devices, so we can email you when your account is signed in to from a device we don't recognize. | 2 years |
| pp_a11y | Preference (local storage) | Your display settings, large text, dyslexia-friendly font. Stored only if you switch on device preferences. | Until cleared |
| pp_lang | Functional | Remembers your language preference. First-party, non-tracking; set only when you switch language. | 1 year |
| (analytics) | Analytics | Set by the configured analytics tool; loaded only after you opt in. | Per the tool |
Legal grounding
Strictly necessary cookies (session, security, remembering your choice) do not need an opt-in: PIPEDA treats consent for them as implied, and Law 25 and the EU ePrivacy rules exempt them from consent. Everything else, device preferences, analytics, requires your active opt-in, and refusing is exactly as easy as accepting: both buttons carry equal weight, with no dark patterns.
Payments
Organization payments happen on Stripe's hosted pages; cookies set there are governed by Stripe's policy. No Stripe script runs on our public pages.
Withdraw or change your choice
Any time: , also linked in the footer of every page. Withdrawal applies going forward and takes effect immediately; stored preferences are deleted from your device.
Who is responsible & complaints
The person in charge of personal-information protection is Avery Campbell (privacy@polipost.ca). You may also contact the Office of the Privacy Commissioner of Canada, Québec's Commission d'accès à l'information, or your EU supervisory authority.