Privacy policy

Last updated: 9 October 2026

OnSpecial ("we", "us") is a community guide to what's on in the cities it covers, starting with Regina, Saskatchewan. This policy explains what we collect, why, who helps us run the service, and the choices you have. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

The short version

You can browse without an account.
We don't sell your data or show ads. We use Google Analytics to understand visits and app actions, with advertising tracking disabled.
An account is an email address, a display name and a handle. Only you see your display name. What you post, confirm and vote on is public under your handle (like @LuckyTaster42).
We measure page speed and errors so the app stays fast and working, and count anonymous usage events to see what people look for and how they found us. None of it is linked to an account.
If you have an account, you can download your data or delete your account from Settings.

What we collect

When you browse

Requests: every request passes through Cloudflare, which sits in front of the site. It sees your IP address, your browser, the page you asked for and when, to deliver the page and block attacks.
Performance measurements (Web Vitals): how quickly pages load and respond, which page, whether you're on a phone or a computer, and your connection type. Not linked to an account.
Error reports: when something breaks, the error, the page it happened on and your browser. When it breaks on our server, the report also carries the request's headers, which include your IP address. Cookies and sign-in tokens are removed before anything is logged.
Abuse protection: to stop spam and automated abuse, including repeated sign-in attempts, we count requests per account, or per network address. An address is never stored: the counter holds a keyed one-way hash of it. A daily clean-up deletes counters that have been idle for a day.
Venue maps: a venue's page shows a map that loads from openstreetmap.org, which receives your IP address and your browser when the map is shown, as any site you load something from does. We send it nothing else about you, and tapping the map opens directions in Google Maps.

Venue place confirmation

When you add a venue and check its name, our server sends the venue search and city to Google Maps to suggest a matching business and address. We do not send your account details with this lookup. Selecting a result fills the name and address for you to confirm, and we retain the place ID to recognize an existing venue. You can enter details manually instead. Google processes these requests under Google's privacy policy.

Anonymous usage events

To see what people look for, and to fix what doesn't work, the app records anonymous usage events: a search, a filter, chip, day or range picked, the Today list or the Events tab shown, the list of what ended earlier opened, a venue or listing opened, a venue page opened from a QR code at the venue, a tap on directions, call or a venue's website link, and how long it took to reach a first venue.

What's in one: the kind of event, when it happened, the venue or listing it was about, which filter, day or range it was, which screen a listing was opened from and whether it's an event or a deal, and whether a first venue was reached by opening it or by tapping its directions (each as the app's own short name for it, never words you typed), and a few numbers, like how many results a search found, where a listing sat in the list, or how long something took.
How the visit started, noted once when the tab opens the app and sent with each of its events: where the visit came from, as one of a few kinds (a search engine or an AI assistant, naming Google or Bing, a QR code at a venue, social media, another site, a link inside OnSpecial, or directly), and the kind of page it started on (Today, a venue, a special or event, a topic, and so on). Never the page's address, the words searched for, or the address of the site you came from. A QR code at a venue adds a marker to its page's address, which the app removes as soon as it has noted it.
Search words, trimmed to 80 characters. Anything that looks like an email address or a phone number is removed on your device before it's sent.
A random id for the browser tab, made the first time the tab records an event and kept in that tab's session storage, which the browser discards when the tab is closed for good. It shows that a search led to a venue, not who searched. A new tab gets a new id (a duplicated tab starts with a copy of it). The same storage keeps how the visit started, and notes which page the tab opened on and when, and whether the tab's first venue was already counted, so a venue page opened from a shared link isn't counted as one you found in the app, the time to a first venue is counted from the start, and it's counted once; none of these is sent.
What isn't in one: your account, your name or handle, your IP address, your browser or your location. No cookies are set or read for them, and they look the same whether you're signed in or not. The one difference: when a venue's own owner, manager or staff opens that venue's page or taps its directions, call or website link while signed in, that view or tap isn't sent, so the venue's numbers count its customers. Signed out, we can't tell them from anyone else, so theirs are sent like everyone's.

Usage events are deleted after 90 days.

Google Analytics

Google Analytics measures page visits and app actions, such as searches, venue and listing opens, directions, calls, saves and confirms. It uses first-party analytics cookies to group visits and receives browser/device information and network requests. Google states that GA4 does not log or store individual IP addresses. We send cleaned page addresses without search words, tokens or other query values, and bounded campaign labels. Private account screen names are kept, with private IDs removed. We do not send your account ID, email, name, phone number, raw search words or the anonymous ID used by our own analytics. Advertising features and Google signals are disabled. User and event data are retained in Google Analytics for up to 14 months after activity; aggregated reports can remain longer.

Analytics cookies expire after six months. You can block Google Analytics with your browser's privacy tools or Google's Analytics opt-out browser add-on. If you previously declined analytics on this device, we continue to honor that choice for its original six-month duration. Blocking future collection does not delete data Google has already received. Our own anonymous usage events continue as described above. Google may process analytics data outside Canada, including in the United States. See Google's privacy policy.

The launch list

While OnSpecial is in preview, you can leave your email address to hear when it launches. We store the address and when you left it, nothing else, and it isn't tied to an account or a device. We use it once, to send the launch announcement, then delete the whole list. We don't use it for anything else and don't give it to anyone but the email provider that sends the announcement. To come off the list sooner, email info@onspecial.ca.

Votes for the next city

On Today you can vote for the city you'd like OnSpecial to open in next, or type the name of one that isn't listed. We store the city you picked (as you typed it, if you typed it), when you voted, and a scrambled (hashed) form of a random code your browser keeps, so each device counts once per city. That code is kept in a cookie called os_voter for one year from your first vote; we never store the code itself, and none of this is tied to an account, your name or your IP address. If you leave your email address after voting, we use it for one email, when that city opens, and then delete it. We don't use your vote or your email for anything else, and we don't give them to anyone except the email provider that sends that one email. To take your email off sooner, or to ask anything about your vote, email info@onspecial.ca.

When you create an account

Email address and password. The password is stored as a salted hash, so we can't read it.
Display name. The name you give us, or your Google name if you sign up with Google. Only you (and our moderators) see it. You can change it in Settings.
Handle. We give every account a random handle (like @LuckyTaster42). It's how everyone else sees you: on what you post, on a card you confirmed (while "Show my name on leaderboards and on what I confirm" is on), in Best Of and on the leaderboard.
Google sign-in (optional): Google shares your name, email address, profile photo and Google account ID. We use the email to identify you, the name as your display name and the photo as your avatar, both seen only by you.
Sign-in sessions: sign-in cookies keep you signed in. Each session is stored with the IP address and browser it started from, to help detect account misuse. Sessions end 7 days after you last use the app, or when you sign out, and an ended session is deleted, address and all, within a day.

When you contribute

What you post: specials, happy hours, events, prices, venues you add, suggested edits, Best Of questions, nominations, votes and comments, and tips. These are public, with your handle.
Signals: confirms, "gone" flags, "going" and saves. Confirm and "going" counts are public, and confirming often at one venue can list you among its Regulars. Your saves are private.
Points, streaks, milestones, roles and tier, worked out from your activity. Your points, roles and active days show on your profile, and your points beside your handle on the leaderboard. When you confirm a listing, its card may credit you by your handle ("Confirmed today by @you"). Turn off "Show my name on leaderboards and on what I confirm" in Settings to leave the leaderboards and a venue's Regulars and never be named on a card; your points and confirms still count.
Hosts: a host or performer you name on an event is public, by the name and kind you give it. If you say it's you ("This is me"), it's linked to your account, and deleting your account deletes it, along with everyone's follows of it.
Hosts you follow: private; used only to tell you about their new dates. Deleting your account deletes your follows of them.
Reports you file about content, seen only by moderators. An owner correction also carries the email or phone number you give, so our moderators can confirm it's you; only they see it, and it's deleted 30 days after they answer, or with your account.
Contact messages: your email address and message are sent to our support inbox through Resend so we can respond. They are not published or added to a marketing list, and the contact form does not save them in the app database.
Venue claims: if you claim a business, the contact name and phone number or email you give us, used only to verify the claim and reach you about it.
Photos of specials: a photo or PDF of a venue's specials that you send us, and, from a venue's owner or manager, a link to a page of their website. It's kept privately on our own server, only for a short while (see below): only you and our admins see it, through links that last five minutes, and it's never shown on a listing. Photos are re-saved without their location data. Anthropic reads it and writes out the listings it finds, for you to check before anything is posted: the file and the venue's name are sent, nothing about you.

If you manage a venue

The weekly check-in email goes to the venue's owner and managers. We keep a record of which week we emailed you, and delete it with your account. Turn off business alerts in Settings to stop it.
Check-ins: each check-in records who made it; if you delete your account, it stays with the venue without your name.

Settings and your device

Your notification preferences and the notifications we show you in the app.
Stored only in your browser, never sent to us: your recent searches, whether you've dismissed the install banner, whether this tab has shown the swipe hint, and a count that times the occasional thank-you after you contribute.
The venues you looked up, stored only in your browser: when you tap Directions or Call on a venue, or Going on something tonight, your device remembers that venue (and, for a Going, the event) and when, so Today can ask once, the next day, how it was. The list never leaves your device. It's cleared 36 hours after the visit: after your tap, or for a Going after the event starts, if that's later. To ask, the app looks up what that venue had on, sending only that venue, roughly when you looked it up (to the hour) and, for a Going, the event's listing, never your account.

We don't collect your precise location, your contacts or any payment details.

Cookies and offline storage

Two cookies remember your feed on this device, so the app opens where you left it: the day you picked, for 12 hours, and the neighbourhood you picked, for 30 days. They hold only that date or that neighbourhood's name, and they aren't tied to an account. Picking Today deletes the first, and clearing the neighbourhood deletes the second.
os_voter: a random code, set when you first vote for a city, for one year, so your device counts once per city.
If you have an account, essential sign-in cookies keep you signed in, plus a short-lived one during Google sign-in.
Google Analytics sets _ga and _ga_* cookies to distinguish browsers and sessions, for up to six months. We do not use advertising cookies.
The app's service worker saves pages and images you've viewed on your device so OnSpecial works with a weak signal. Pages that show your account (inbox, settings, profile, dashboard) are never saved.

How we use it

To run the service: show listings, keep freshness honest, work out points and rankings, and send the notifications you've turned on.
To keep it trustworthy: spot spam, vote stuffing and fake accounts, and enforce the community rules.
To keep it working: performance and error monitoring.
To reach you: the launch announcement if you joined the launch list; sign-in, verification and password emails if you have an account, and a security notice when its password or email address changes or it's deleted; and, if you claim or help run a venue, the answer to your claim, a note when you're added to its team, and its weekly check-in email.

We don't sell or rent personal information, and we don't use it for advertising.

Who we share it with

These providers process data for us, only to run OnSpecial:

DigitalOcean hosts the server that runs OnSpecial and its database, in Toronto, Canada, and the photos of specials people send while they're kept.
Cloudflare sits in front of the site and carries every request to our server. It also stores our encrypted database backups.
Resend delivers contact-form messages to our support inbox and sends our email: the launch announcement, account and security email, and email about the venues you run.
Google: analytics as described above, and account details if you choose Google sign-in.
Anthropic (its API) reads the photos, PDFs and venue web pages of specials that people send, and writes out the listings it finds: the file or the page's text and the venue's name, nothing about you. Under Anthropic's commercial terms it doesn't use what we send to train its models, and deletes it within 30 days, longer only when its safety checks flag it or the law requires it.
OpenAI (its API) reads venues' own public web pages when we check their specials and details: the page's text and the venue's name, nothing about anyone who uses OnSpecial. Under OpenAI's API data terms it doesn't use what we send to train its models, keeps it in its abuse-monitoring logs for up to 30 days, and longer only if the law requires it, it's reasonably needed to protect its services or others from harm, or its safety checks flag it. We ask it not to store the read itself.

Everything you post is public, including to search engines. We may disclose information if the law requires it. Our server and database are in Canada. Cloudflare, Resend, Google, Anthropic and OpenAI are based in the United States and may process data there or elsewhere outside Canada. OpenStreetMap, which serves the maps on venue pages, is based in the United Kingdom and may do the same.

How long we keep it

Your account and profile: until you delete your account.
What you post: until you or a moderator removes it. When you delete your account, your Best Of comments and suggested edits are deleted, and the rest stays up without your name (see below).
Sessions, with the IP address and browser stored on them: until you sign out, or 7 days after last use, then deleted within a day.
Error reports and performance measurements: in our server's logs, only as long as we need them to find and fix problems.
Anonymous usage events: 90 days. Before they're deleted, each venue's events are added up into monthly totals (views, how visits started, directions, calls and website taps, beside the month's saves, goings and confirms): numbers only, with no tab id or single event in them, kept so a venue can see its past months.
The launch list: until the launch announcement is sent, then deleted, or sooner when you ask.
Votes for the next city: kept while we choose the next cities; an email left with a vote, until that city's announcement is sent, then deleted, or sooner when you ask.
Abuse-protection counters: deleted once idle for a day, so none lasts more than two days after your last request.
An owner correction's email or phone: 30 days after a moderator answers it, or with your account; the correction stays without it.
Photos of specials: the file is deleted as soon as you post its specials or start over, and otherwise after 7 days; the record that one was sent (and who sent it, until you delete your account) stays, without the file.
Backups: an encrypted copy of the database is made every night. Daily copies are kept for 14 days, weekly ones for 60 days and monthly ones for 400 days. Something deleted from OnSpecial stays in the older copies until they expire. We use them only to recover from a failure.

Your choices and rights

Export: download a copy of your data from Settings.
Correct: change your display name and preferences in Settings, or ask us to fix anything else.
Delete: delete your account from Settings. Your account, profile, sessions, notifications, preferences, votes, signals and points, your Best Of comments, your suggested edits and the reports you filed, your venue claims, your follows of hosts, and a host that is you (with everyone's follows of it), are deleted. Listings, prices, venues, tips, Best Of questions and nominations you added, and hosts you only named, stay up without your name, because other people rely on them: a host you named keeps its public name, kind and any bio. Notifications already sent to other people (a host's followers, a venue's team) keep the name they carried, as other people's copies of anything do.
Notifications: turn off any type, one at a time, in Settings. New dates from a host you follow stop when you unfollow them.
Without an account: to see, correct or delete anything we hold about you, such as your address on the launch list, email us.
Questions or complaints: contact us below. You can also complain to the Office of the Privacy Commissioner of Canada.

Age

OnSpecial is for adults, since many listings are drink specials. You must be of legal drinking age where you live (19 in Saskatchewan) to make an account. We don't knowingly collect personal information from anyone younger.

Security

Passwords are hashed, connections and backups are encrypted, and access to data is limited to the people who run the service. No system is perfectly secure; if a breach affects you, we'll tell you as the law requires.

Changes

We'll post changes here and update the date above. For significant changes, we'll also tell account holders in the app.

Contact

Questions and requests: info@onspecial.ca.