Privacy Policy

Kangarooo (“Kangarooo”, “we”, “us”) runs the Kangarooo website and app, a marketplace where people post local moving, delivery and junk removal jobs and independent haulers bid on them.

We are responsible for the personal information described here. Our privacy contact handles questions, requests and complaints. You can reach them at support@kangarooo.ca.

We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

Your account. Email address, password (stored only as a secure hash) or the Google or Facebook account you sign in with, your role (customer or hauler), first name, optional business name and profile photo.

Jobs you post. Pickup, drop-off and stop addresses, building details (floor, stairs, elevator, parking), what needs moving, dates and time windows, and photos.

Haulers. First name and optional business name, phone number, vehicle types and photos, crew size, home postal code, service radius, and an optional NSC or CVOR number. We also collect bids (price, arrival time, crew, estimates and fee notes), plus ratings, completed jobs and on-time record.

ID checks. Haulers who choose to get verified ($1 by Interac e-Transfer, or included once with the hauler plan) check their identity through our provider, Didit, using a government ID, a selfie and a face match. Didit handles the ID images and face scan. We receive and keep only the result, the name on the ID and the date of the check. We never receive or store the ID image or the selfie.

Messages. Chat messages and images exchanged between a customer and a hauler, plus reports and blocks.

Payments. For unlock fees, ID check fees and the hauler plan: amount, date, method, status and refunds. All payments are by Interac e-Transfer; we never take or store card numbers. We keep the email address your bank sends from, the payment code, the Interac reference number and the sender name shown on the deposit notice.

Device and usage. Sign-in cookies, push notification subscriptions if you turn on alerts, IP address, browser type and security logs (sign-ins, failed sign-ins, password changes, payments and admin actions).

We don't ask for information we don't need. Job descriptions are made of taps, not free text, partly so people don't have to share more than the job needs.

• To run the service: create your account, show jobs to haulers nearby, deliver bids and messages, and open chat after an unlock.
• To keep people safe: verify haulers, show badges and ratings, detect fraud, scams and attempts to move conversations off the platform, and handle reports.
• To process unlock fees and refunds, and keep the records tax law requires.
• To send you service messages by email and push notification: new bids, chat messages, bookings, reminders and receipts. These are part of the service and you can turn push alerts off in Settings.
• To fix bugs, secure the service and understand, in aggregate, how it is used. We do not read your messages for this.
• To meet legal obligations and respond to lawful requests.

By creating an account you consent to us collecting and using your information as this policy describes. We ask for express consent for the ID check, because a face scan is sensitive biometric information. Haulers tick a consent box before Didit starts the check.

We will only send marketing emails if you have opted in, and every one will have an unsubscribe link, as Canada's anti-spam law (CASL) requires.

You can withdraw consent at any time by changing your Settings or deleting your account. Some features, such as bidding without an ID check, won't be available without it.

Before a customer unlocks chat, haulers see only the neighbourhood, city and first three characters of the postal code for each stop, plus the job details and photos. Customers see a hauler's shown name (first name and last initial from their ID), badges, vehicle, ratings and bid.

After a customer unlocks chat, the hauler they pick to chat with sees the full addresses, and the customer sees that hauler's phone number. This only happens with one hauler at a time.

Share links. If a customer shares a job link, anyone with the link can see the public job details and photos. They never see addresses or contact details.

Our team can see account and payment records to run the service. Staff open a chat only to handle a report or a dispute.

We do not sell your personal information, and we don't share it with advertisers.

We may disclose information if the law requires it, to protect someone's safety, to investigate fraud, or as part of a merger or sale of our business. In a merger or sale, the buyer must keep honouring this policy.

Your data is stored in Canada with Supabase (Canada Central region). We use these providers to run the service. Some of them process data outside Canada, mostly in the United States, where it may be subject to local law:

• Supabase: database, sign-in, file storage and live chat (Canada).
• Cloudflare: hosting and network delivery, plus automated checks of uploaded photos for unsafe content.
• Didit: hauler identity checks.
• Mapbox: address search and distances.
• Resend: sending email.
• Google: matching Interac deposit notices in our business inbox, and Google sign-in if you choose it.
• Meta (Facebook): Facebook sign-in if you choose it.
• Your browser's push service (such as Apple, Google or Mozilla): delivering push alerts if you turn them on.

Each provider may use the data only to provide its service to us, under contracts that require it to be protected.

When you upload a photo, we resize it and remove hidden metadata, including GPS location, before storing it. Photos are kept in private storage and shown through short-lived links. An automated check screens photos for unsafe or off-topic content, and people can report anything it misses.

We use cookies only to keep you signed in, protect against forged requests and remember the role you picked while signing up. We don't use advertising or cross-site tracking cookies. The app also stores a few settings, such as your theme, on your device so it can work like an installed app and load quickly.

• Account and profile: while your account is open.
• Hauler ID check result and name: while the account is open. ID images are held only by Didit, under its own retention rules.
• Jobs, addresses, photos, bids and messages: up to 2 years after the job closes, so we can handle disputes and fraud. After that we delete or anonymise them.
• Payment records: 7 years, as Canadian tax law requires.
• Security and audit logs: 1 year.
• Backups: up to 7 days.

When you delete your account, we remove your profile and contact details within 30 days. Payment records stay for tax purposes, and your past messages show as “Deleted user”.

• Access: download a copy of your data any time from Settings, or ask us for it.
• Correction: edit your profile in Settings, or ask us to fix anything you can't change there. A hauler's shown name comes from their ID and can only be changed with a new check.
• Deletion: delete your account from Settings.
• Withdraw consent as described above.
• Complain: email support@kangarooo.ca first. If you're not satisfied, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca, or your provincial privacy commissioner.

We answer requests within 30 days and may need to confirm your identity first.

We protect your information with encryption in transit and at rest, access rules enforced by the server, private file storage, optional two-step sign-in, and logging of sensitive actions. No system is perfectly secure, so use a strong password and keep your devices locked.

If a breach creates a real risk of significant harm, we will notify you and the Privacy Commissioner of Canada as soon as feasible, as PIPEDA requires.

Kangarooo is for people 18 and older. We don't knowingly collect information from anyone younger. If you think a minor has an account, email us and we will remove it.

If we make a material change, we will tell you by email or in the app before it takes effect. The date at the top shows when this policy last changed.