Privacy Policy

1. Local Storage Protocol

WORKWARS is designed as a client-side documentation interface. Audio, video, and image files captured via the application are stored exclusively on your local device by default. WORKWARS does not automatically upload, host, or transmit your private evidence files to our servers without your explicit action.

When you choose to upload evidence as part of an incident log, files are encrypted before transmission and stored with a tamper-evident hash that serves as a chain-of-custody seal. Your raw files are never stored unencrypted on our servers.

2. Data We Collect

We collect the minimum data necessary to operate the platform:

• Account data: Email address and display name provided via Google Sign-In (OAuth). We do not store your Google password.
• Incident logs: Text descriptions, timestamps, severity ratings, and category tags that you enter. These are stored in your private account and are not visible to any third party without your consent.
• Alias data: The employer alias you create (e.g., "Company A") and its association with a verified Master Company ID. Your real employer name is never exposed without your consent.
• Payment data: Processed entirely by Stripe. WORKWARS never sees or stores your credit card number, bank details, or payment credentials.
• Usage analytics: Anonymized page view data to improve platform performance. No personally identifiable information is included in analytics.

3. Anonymity & The Alias System

Worker anonymity is the foundation of this platform. When you log an incident, you link it to a private alias rather than your employer's real name. This alias is associated with a verified Master Company ID in our backend — but your identity is never linked to that company record in any externally visible way.

Your incident logs are visible only to you. No employer, HR department, staffing agency, or third party can view your individual logs without your explicit consent.

4. Legal Escalation & Advocate Handshake

If you choose to escalate your case to the Legal Marketplace, the following process occurs:

• All personally identifiable information is stripped server-side before any data is shared with advocates. This process runs on our secure Cloud Functions — never in your browser.
• Advocates on the Marketplace see only an anonymous summary: sector, log count range, claim type, severity tier, and region (province/state level only).
• Your contact information and full dossier are never transferred to a lawyer unless you explicitly approve the connection AND the lawyer spends a verified Bid Credit in an atomic transaction.
• Escalated cases are released to the Marketplace with a randomized delay (6–72 hours) to prevent timing-based de-anonymization.

5. Canadian Privacy Rights (PIPEDA & Quebec Law 25)

For users in Canada, your privacy rights are governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, by Law 25 (Act respecting the protection of personal information in the private sector), which came into full effect in September 2023.

Under these laws, you have the right to:

• Know what personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information (right to erasure)
• Withdraw consent for data processing at any time
• File a complaint with the Office of the Privacy Commissioner of Canada (OPC) or the Commission d'accès à l'information (CAI) for Quebec residents

Quebec Law 25 requires us to notify the CAI and affected individuals within 72 hours of discovering a confidentiality incident (data breach) that presents a risk of serious injury. We maintain breach detection and notification procedures to meet this obligation.

To exercise any of these rights, contact us at the address in Section 13.

6. European & International Users (GDPR)

For users in the European Economic Area (EEA) and United Kingdom, the General Data Protection Regulation (GDPR) applies. Our lawful basis for processing your data is legitimate interest (platform operation and security) and consent (for optional features such as escalation).

You have the right to access, rectify, erase, restrict, and port your data, as well as the right to object to processing. To exercise these rights, contact us at the address in Section 13.

7. App Check & reCAPTCHA

WORKWARS uses Google Firebase App Check with reCAPTCHA v3 to protect our platform from automated abuse. reCAPTCHA v3 runs invisibly in the background and generates a risk score based on your browser interactions — it does not present a CAPTCHA challenge.

Google's reCAPTCHA service collects hardware and software information, including but not limited to: device and application data, results of integrity checks, and network information. This data is sent to Google and used to provide, improve, and develop reCAPTCHA and general security purposes.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

8. Third-Party Advertising & Cookies (Google AdSense)

To support our worker defense resource library, we display advertisements via Google AdSense on public-facing pages. Authenticated portal pages (Worker App, Advocate Portal, Compliance Portal, Agency Portal) do not display advertisements.

• Google uses cookies to serve ads based on prior visits to this or other websites.
• You may opt out of personalized advertising at Google Ads Settings.
• You may opt out of third-party vendor cookies at AboutAds.info.

9. Data Retention

We retain your data for as long as your account is active. If you request account deletion:

• Your incident logs, alias data, and profile information will be deleted within 30 days of your request.
• Audit logs required for legal compliance may be retained for up to 7 years in anonymized form.
• Payment records are retained by Stripe per their own retention policies (typically 7 years for tax compliance).

10. Your Rights

Regardless of your jurisdiction, you have the following rights on the WORKWARS platform:

• Right to access: Request a copy of all data we hold about you.
• Right to erasure: Request deletion of your account and all associated data. Use the "Request Data Erasure" option in your Worker App settings, or contact us directly.
• Right to portability: Request your incident logs in a machine-readable format.
• Right to withdraw consent: Withdraw consent for escalation or data sharing at any time before a lawyer handshake is completed.
• Right to complain: File a complaint with your local data protection authority.

11. Security Measures

WORKWARS implements industry-standard security measures including:

• Firebase App Check enforcement on all database operations
• Server-side encryption for all uploaded evidence files
• Atomic transactions for all sensitive data operations (bid credit handshake, escalation)
• Immutable audit logging for all sensitive platform actions
• Role-based access control with server-verified authentication tokens
• No credentials stored in client-side code

12. Educational Disclaimer

WORKWARS is an educational documentation platform and resource library, not a law firm. The content published on this platform — including articles, checklists, and incident reporting tools — does not constitute formal legal advice. Users should consult with a verified employment lawyer in their local jurisdiction for counsel regarding their specific workplace situation.

Connecting with a lawyer through the WORKWARS Advocate Marketplace does not automatically create an attorney-client relationship. That relationship is established directly between you and the lawyer you choose to engage.

13. Contact & Data Requests

For privacy inquiries, data access requests, erasure requests, or to report a concern: