Privacy Notice

When you submit a report or a question, we collect any name you choose to provide; any email address you choose to provide; the text of your message or description; the district or general location associated with your submission, whether you provide it directly or we derive it from the address you supply; any photo you choose to attach; and the choices you make on the form, such as whether to copy the City Clerk or all members of council.

We do not require your name or email address to submit a report or question. If you choose not to provide an email address, you can still track your submission and see any responses on the device you used to submit it: a tracking link is shown on screen when you submit, and your browser is linked to your own submissions through the functional session cookie described below. What you give up without an email address is delivery and recovery — we cannot email you your tracking link or notify you of updates, and if you clear your browser data or lose the on-screen link, we have no way to reconnect you with your submission. The submission itself is forwarded to the appropriate parties either way.

Voice input. The forms offer an optional microphone button that lets you dictate your message instead of typing it. If you use it, the transcription is performed by your own browser's built-in speech-recognition feature. In many browsers — including Chrome and Edge — that feature sends your audio to the browser vendor's servers (for example, Google's) for processing, under that vendor's privacy practices, which we do not control. Kingston City Works never receives, stores, or has access to your audio; only the resulting text appears in the form, where you can review and edit it before submitting. If you prefer not to have your voice processed this way, simply type instead — voice input is entirely optional.

Automatically, when you use the site, we also collect your IP address (used to prevent abuse such as spam and flooding the system with repeated submissions), a timestamp of when you submitted, and your browser type and version (user agent), used for diagnostics and error handling.

We use Cloudflare Turnstile to confirm you are not an automated bot. Turnstile may set a cookie on your browser and process some technical information about your device. Cloudflare's privacy practices govern that processing; we do not control them.

We do not collect or process any other information beyond what is described above. We do not use analytics or advertising trackers. The complete list of third-party services we rely on appears under "Cookies, tracking, and third-party services" below.

We collect this information for three purposes only: to forward your message to the appropriate parties at the City of Kingston and the appropriate councillors; to let you track responses to your submission, via a personal access link emailed to you; and to prevent abuse of the service, by limiting submissions from any one IP address within a short period.

Information you submit may be shared with the City of Kingston, by email — specifically contactus@cityofkingston.ca, and, depending on the choices you make at submission, also mayor&council@cityofkingston.ca and clerk@cityofkingston.ca. It may also be shared with the councillor for your district, where your submission's location identifies a specific district; with the four sponsoring councillors who operate Kingston City Works — day-to-day handling is performed by the project lead, and all four hold administrative access to view submissions through the project's admin dashboard in their operator and oversight roles (if a councillor ceases to be an operator of Kingston City Works, their administrative access is revoked); with Resend, the third-party service we use to deliver email, which sees email addresses, sender identifiers, subject lines, and message content for the limited purpose of delivery; and with Cloudflare, which processes some technical information for bot protection.

We do not sell, rent, lease, or otherwise transfer your information to any third party for advertising, political campaigning, fundraising, or commercial purposes of any kind. The four councillors do not use Kingston City Works data for campaign purposes. (The councillors may refer publicly to the existence of Kingston City Works as part of their civic work; doing so never involves residents' submissions, contact information, or any other data held by the service.)

We may disclose information when we are required by law to do so, or where we believe in good faith that disclosure is necessary to comply with legal process, to protect the rights or safety of any person, or to investigate misuse of the service.

Once a message is delivered to the City of Kingston's email systems, it is in the City's possession, subject to the City's own policies, retention schedules, and legal obligations. The City of Kingston is a public body subject to Ontario's Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). Information sent to the City may be retained, used, and disclosed in accordance with that Act and the City's own practices, which Kingston City Works does not control.

Kingston City Works has no ability to recall, unsend, edit, or delete a message once it has been delivered to the City. When you delete your submission through Kingston City Works, the copy that exists on our servers is removed (see below), but any copy that has already reached the City's systems is not.

We keep your submissions only as long as we reasonably need them.

A submission you submit and then delete yourself is soft-deleted immediately. Soft deletion means we scrub the personal-data fields (name, email, message content, photo) and delete the photo file from our servers. We retain a minimal anonymized record (timestamp, district, original status) for accountability and for district-level statistics.

A submission whose status has been set to closed by an administrator is automatically soft-deleted six months after the closure date.

A submission that is orphaned or forgotten — meaning no activity, status change, or response — is automatically soft-deleted two years after submission.

IP addresses are not stored in our database and are not written to our application logs. They are held in temporary memory for the rate-limiting system and discarded shortly after. Like virtually all web servers, our server also keeps standard, short-lived technical logs that may record IP addresses for security and diagnostic purposes; these are routinely rotated and deleted, and are not used for any other purpose.

Email audit metadata (the fact that an email was sent, when, and to which recipient categories) may be retained beyond the soft-delete date for accountability purposes, but the message content itself is not.

These retention rules apply to data we hold. They do not apply to data the City of Kingston or any other third party may hold as a result of having received your submission.

You have the right to see the data we hold about you, by visiting the personal access link emailed to you at submission. You have the right to delete your submission yourself, at any time, by visiting that same link and using the "Delete my data" function — this triggers the soft-deletion described above. You have the right to correct or update your data, by contacting us through the channels listed below. You have the right to make a complaint about how we handle your data, by contacting us through the channels listed below.

To make a privacy request, contact Councillor Jeff McLaren at jeff@jeffmclaren.ca or through the City of Kingston's general inquiries channel at contactus@cityofkingston.ca. We will respond to all privacy requests in a reasonable time and in accordance with our obligations under PIPEDA.

If you are not satisfied with our response to a privacy concern, you have the right to escalate to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

We take reasonable measures to safeguard the information we hold: all connections to Kingston City Works are encrypted using HTTPS; personal access to your submission is controlled by a unique magic-link token sent only to the email address you provide, and we do not store passwords; administrative access to the dashboard is restricted to the four sponsoring councillors; attempts to access or delete submissions are rate-limited to defend against automated guessing; actions taken by administrators on submissions are recorded in an internal audit log; and the infrastructure on which Kingston City Works runs is a private server administered by Jeff McLaren in his capacity as project lead.

No system is perfectly secure. We make reasonable, best-effort security choices, but we cannot guarantee that information transmitted to or stored by us will be completely safe from unauthorized access. If we become aware of a security incident that materially affects your information, we will notify affected users in a manner consistent with our legal obligations.

Kingston City Works does not use cookies for tracking, advertising, or analytics. The site sets two cookies of its own, both functional: a session cookie that links your browser to the submissions you have made, so that your "My Reports" and "My Questions" pages work across visits — it contains a random identifier, nothing about you personally, and lasts up to two years because it is the only thread connecting you to your own submissions (there are no accounts or passwords); and a short-lived technical cookie (about one hour) used by our security system to protect pages against script injection. In addition, Cloudflare Turnstile may set a cookie when confirming you are not an automated bot.

We use the following third-party services, each of which has its own privacy practices that govern how it handles data it receives in the course of providing service to us: Resend (transactional email delivery); Cloudflare (bot protection, content delivery, security); OpenStreetMap (map imagery — if you use the "Pin on the map" feature, your browser fetches map tiles directly from OpenStreetMap's servers, which see your IP address and the map area you view); and, if you choose to use voice input, your own browser's speech-recognition service as described under "What we collect."

We have chosen these providers based on a reasonable assessment of their privacy practices, but we do not control them, and your interactions with them are governed by their own terms and policies.

Kingston City Works is not directed at children under the age of 13. We do not knowingly collect information from children under 13. If you are a parent or guardian and believe a child under 13 has submitted information to Kingston City Works, please contact us, and we will remove it.

Kingston City Works is provided as a public-good civic-technology project on an as-is basis. The four sponsoring councillors operate it as a service to the community in their personal civic capacity. To the maximum extent permitted by law, we make no warranties about the availability of the service, the timeliness with which messages are delivered to the City, or the action taken on submissions by the City or by any other party. The operators of Kingston City Works are not liable for any decision, action, or inaction taken by the City of Kingston or any third party in response to a submission made through this service.

This notice does not create any contractual right or expectation of service. We reserve the right to refuse, delay, or remove any submission that violates this notice, our terms, or applicable law.

We may update this notice from time to time as the service evolves or as legal requirements change. When we do, we will update the "Last updated" date at the top of this document. For material changes, we will make a reasonable effort to bring the change to your attention through the site or, where applicable, through the email address you provided at submission. Continued use of Kingston City Works after a change constitutes acceptance of the updated notice as it applies to submissions made after the change.

Kingston City Works is operated from Ontario, Canada. This notice is governed by the laws of the Province of Ontario and the federal laws of Canada applicable in Ontario, including PIPEDA. Disputes arising in connection with this notice or with the service are subject to the exclusive jurisdiction of the courts of Ontario.

For privacy questions, deletion requests, or any other inquiry relating to your data, contact Councillor Jeff McLaren, Project Lead, Kingston City Works, at jeff@jeffmclaren.ca. You may also reach us through the City of Kingston's general inquiries at contactus@cityofkingston.ca.