Privacy Policy
We wrote this policy to be read, not filed away. It tells you exactly what we collect, why we collect it, how we use it, who can see it, and what choices you have. If you have questions after reading this, email us at privacy@oystr.ca.
What's in this document
- 1. Who we are
- 2. What information we collect — and why
- 3. How we use your information
- 4. How we share your information
- 5. How long we keep your information
- 6. Your choices and rights
- 7. Cookies and similar technologies
- 8. Children’s privacy
- 9. International data transfers
- 10. How we protect your information
- 11. Changes to this policy
- 12. How to contact us
1. Who we are
OYSTR (oystr.ca) is a social empowerment platform that helps people publish, pursue, and celebrate meaningful life goals — called Moonshots. The platform connects three kinds of users: Dreamers (individuals chasing bucket-list goals), NFP Partners (verified non-profit organizations), and CSR Partners (companies participating in community impact).
OYSTR is operated by:
Closure Solutions Ltd.
23 Corporate Park Drive, St. Catharines, Ontario L2T 3W2, Canada
privacy@oystr.ca
When this policy says "OYSTR," "we," "us," or "our," it means Closure Solutions Ltd. and the OYSTR platform. When it says "you," it means anyone who uses OYSTR — as a Dreamer, NFP Partner, CSR Partner, or visitor.
We operate under Canadian federal privacy law (PIPEDA, and the Consumer Privacy Protection Act when it comes into force). Where we serve users in the European Union or United Kingdom, the GDPR and UK GDPR also apply. We treat every user's data with the same care, regardless of where they are located.
2. What information we collect — and why
2.1 Information you give us directly
When you create an account
- Display name (required)
- Email address (required)
- Password, stored in hashed form — we never store it in plain text
- Profile photo (optional)
- Short bio and tagline (optional)
- Account type: Dreamer, NFP Partner, or CSR Partner
If you sign up with Google, Apple, or Facebook, we receive only the information those services share with us: usually your name, email address, and profile photo. We do not receive your password for those accounts.
When you create or interact with a Moonshot
- Moonshot title, description, and any images you upload
- Your chosen end date for the Moonshot
- Progress updates (Logs) you write and images you attach to them
- Actions you take: starring, joining a Crew, orbiting, echoing, or fuelling a Moonshot
- Messages and comments you post inside a Capsule
- Fuel contributions you make or receive (type, amount if monetary, and any message attached)
When you verify your account or set up payments
- For Dreamers and NFP Partners who want to receive cash Fuel: identity verification information and payment account details, processed by our third-party payment provider
- For NFP Partners: your organization’s legal name, registration number, and contact information
- For CSR Partners: your company name, billing details, and authorized account holders
When you contact us
- Your name and email address
- The content of your message or support request
- Any attachments you choose to send
2.2 Information we collect automatically
When you use OYSTR, our systems automatically collect certain technical information. This helps us keep the platform running, fast, and secure.
Device and connection information
- Device type, model, and operating system
- Browser type and version
- IP address (used to estimate your general region for content and for fraud detection)
- Mobile advertising identifier, if you grant access on your device
Usage and activity information
- Pages and screens you view, and the time you spend on them
- Moonshots you view, even if you do not interact with them
- Search terms you enter on the platform
- Which features you use and how often
- Timestamps of your actions (when you posted, starred, crewed, etc.)
- Referral source: how you arrived at OYSTR (a link, a search, a shared post)
Crash and error reports
- If the app crashes or an error occurs, we automatically collect a technical report to help us fix it. These reports do not include the content of your messages or Moonshots.
2.3 Information from third parties
OAuth login providers (Google, Apple, Facebook) — If you use a third-party login, we receive the basic profile information those providers share with us. You can review what they share in their own privacy settings.
Payment processors — When a financial transaction occurs on OYSTR, our payment processor sends us a confirmation of the transaction — the amount, the date, and the result. We do not receive your card number or banking details.
Fraud and abuse detection services — We use third-party tools to detect spam accounts, payment fraud, and abusive behavior. These tools may analyze device signals and behavioral patterns to flag suspicious activity.
3. How we use your information
Here is every reason we use the information we collect, written plainly.
3.1 To run the platform
- Create and manage your account
- Display your Moonshots, Logs, and profile to other users
- Process Fuel contributions and payments
- Send you notifications about activity on your Moonshots and Capsules
- Power the Dream Charts leaderboards and Explore feed
- Enforce our Community Guidelines and moderation decisions
3.2 To improve OYSTR
- Understand which features are used and which are not
- Diagnose and fix bugs and performance issues
- Test new features with a subset of users before full rollout
- Conduct internal research on how people pursue goals
3.3 To keep you informed
- Send you notifications you have opted into: new Crew members, Fuel received, countdown reminders, Moonshot milestones
- Send platform announcements and policy updates (these cannot be turned off, but they are infrequent)
- Respond to your support requests
You control most notification types from Settings → Notification Preferences. You can turn off almost everything except essential account communications.
3.4 To keep the platform safe
- Detect and prevent fraud, spam, and abuse
- Enforce account verification requirements
- Investigate reports of content or behavior that violates our guidelines
- Comply with legal obligations, including court orders and regulatory requests
3.5 To support our business
- Understand the overall health of the platform (total active users, Moonshots published, Fuel distributed)
- Generate anonymized, aggregated reports for internal planning
4. How we share your information
We do not sell your personal information. We share it only in the limited circumstances described below.
4.1 With other users on the platform
When you use OYSTR, some of your information is visible to others by design — that is how a social platform works.
| What is visible | Visible to whom |
|---|---|
| Your display name, photo, and bio | All users and visitors |
| Your published Moonshots and Logs | All users and visitors |
| Actions you take (starred, crewed, echoed) | Visible on your profile and in the relevant Moonshot’s stats |
| Messages inside a Capsule | Members of that Capsule only |
| Private messages (inbox) | Only you and the recipient |
| Fuel you send (non-cash) | Visible in the Moonshot’s Fuel list |
| Cash Fuel amount | Visible only to you and the recipient |
4.2 With service providers
We work with carefully selected companies that help us operate the platform. They process data on our behalf and are contractually required to protect it and use it only for the services they provide to us.
- Cloud hosting and storage (servers that run the platform and store your data)
- Payment processing (handling Fuel transactions securely)
- Email delivery (sending you notifications and account emails)
- Push notification services (delivering alerts to your device)
- Crash reporting and performance monitoring
- Fraud and abuse detection
We do not allow our service providers to use your data for their own marketing or to share it further.
4.3 With NFP and CSR Partners — limited and intentional
When you Fuel a Moonshot linked to an NFP Partner or CSR Partner, or when you join a Crew connected to one of their initiatives, those partners can see:
- That you participated (your display name and action type)
- Aggregate engagement numbers (total Crew size, total Fuel received)
Partners do not receive your email address, payment information, or any private messages. Their access is limited to what is necessary to understand the impact of their initiative.
4.4 For legal reasons
We may share your information when we genuinely believe it is necessary to:
- Comply with a law, regulation, or valid legal process (such as a court order or government request)
- Protect the safety of any person
- Detect, investigate, or prevent fraud or illegal activity
- Protect the rights and property of OYSTR
Where legally permitted, we will notify you before disclosing your information in response to a legal request.
4.5 Business transfers
If OYSTR is acquired, merged, or involved in a restructuring, your information may be transferred as part of that transaction. If this happens, we will notify you in advance and your rights under this policy will continue to apply.
5. How long we keep your information
We keep your information for as long as your account is active or as long as we need it to provide you with the service. Here is what that looks like in practice:
| Information type | How long we keep it |
|---|---|
| Account information | Until you delete your account, plus 30 days for deactivation reversal |
| Moonshots and Logs | Until you delete them or delete your account |
| Capsule messages | Until the Capsule is archived (90 days after Moonshot ends), then deleted |
| Payment transaction records | 7 years (required by Canadian financial regulations) |
| Moderation records (warnings, removals) | 2 years from the date of the action |
| Support communications | 2 years from resolution |
| Usage and analytics data | Aggregated and anonymized after 13 months; individual records deleted |
| Crash and error logs | 90 days |
When you delete your account, we begin a purge of your personal data within 30 days. Some information may be retained longer if required by law (financial records) or for legitimate safety purposes (records of serious moderation actions).
6. Your choices and rights
You have real control over your information on OYSTR. Here is what you can do.
6.1 Access and download your data
You can request a copy of all the information OYSTR holds about you. Go to Settings → Privacy & Data → Download My Data. We will prepare your export and send you a download link within 30 days.
6.2 Correct your information
You can update your display name, photo, bio, and contact email directly in Settings → Edit Profile at any time. If you believe we hold inaccurate information you cannot correct yourself, email us at privacy@oystr.ca.
6.3 Delete your account and data
You can delete your account at any time from Settings → Privacy & Data → Delete Account. When you do:
- Your profile, Moonshots, Logs, and Capsule messages are removed from public view immediately
- Your data is permanently deleted from our systems within 30 days
- Financial transaction records are retained for 7 years as required by law
- Content others have echoed or shared may remain visible on their profiles
6.4 Notification preferences
You can turn on or off almost every type of notification from Settings → Notification Preferences. The only notifications you cannot disable are essential account communications (password resets, billing receipts, and important policy changes).
6.5 Right to object or restrict processing
You can ask us to stop using your information for certain purposes, or to restrict processing while a dispute is resolved. Email privacy@oystr.ca. We will acknowledge your request within 5 business days.
6.6 Data portability
You have the right to receive your data in a structured, commonly used, machine-readable format. Your data export (Section 6.1) fulfills this right.
6.7 EU and UK users — additional rights
If you are in the European Union or United Kingdom, you also have the right to:
- Lodge a complaint with your national data protection authority
- Object to processing based on legitimate interests
- Not be subject to a decision made solely by automated means if it significantly affects you
To exercise any of these rights, contact us at privacy@oystr.ca. We will respond within 30 days.
7. Cookies and similar technologies
OYSTR uses cookies and similar technologies on our website and in our app. Here is what they do and what choices you have.
7.1 What are cookies?
Cookies are small text files stored on your device when you visit a website. Mobile apps use similar technologies (local storage, device identifiers) for the same purposes. Cookies help us remember who you are, keep you logged in, and understand how you use the platform.
7.2 The cookies we use
| Type | What it does | Can you turn it off? |
|---|---|---|
| Essential | Keeps you logged in. Remembers your session and security tokens. Without these, the platform cannot function. | No — required for the platform to work |
| Functional | Remembers your preferences: notification settings, display language, theme. | Yes, via Settings → Privacy & Data |
| Analytics | Tells us which features are used and how. Helps us improve the platform. Data is aggregated and not linked to your name. | Yes, via Settings → Privacy & Data or cookie banner |
| Security | Detects unusual login activity and protects your account from unauthorized access. | No — these protect your account |
OYSTR does not use advertising cookies or tracking cookies for third-party marketing purposes.
8. Children’s privacy
During registration, we ask users to confirm they meet the minimum age requirement. If we learn that a user is under 16, we will deactivate their account and delete their data promptly.
If you believe a child under 16 has created an account on OYSTR, please email us at privacy@oystr.ca and we will take action immediately.
In jurisdictions where a higher age threshold applies (for example, 18 in some territories), we comply with the applicable local law.
9. International data transfers
OYSTR is a Canadian company and our primary servers are located in Canada. When you use OYSTR, your information is processed and stored in Canada.
Some of our service providers operate in other countries, including the United States. When your data is transferred outside Canada, we ensure appropriate safeguards are in place:
- Contractual protections that require service providers to protect your data to a standard equivalent to Canadian and, where applicable, EU law
- We use service providers in countries recognized as providing adequate data protection where possible
- For transfers from the EU or UK, we rely on Standard Contractual Clauses approved by the European Commission
By using OYSTR, you understand that your information may be transferred to and processed in countries other than the country in which you reside.
10. How we protect your information
We take security seriously. Here is what we do to protect your data:
- All data in transit is encrypted using TLS (the same technology banks use)
- All data at rest is encrypted on our servers
- Passwords are hashed using a strong one-way algorithm — even we cannot see your password
- Access to user data within our team is strictly limited by role and logged
- We use automated monitoring to detect unusual activity on accounts and on the platform
- Our payment provider is PCI-DSS certified — financial data never touches our own servers
- We conduct regular security reviews of our platform and infrastructure
No system is completely immune to security incidents. If a breach occurs that poses a real risk to your rights, we will notify you and the relevant privacy authorities as required by law, and we will do so without unnecessary delay.
If you believe your account has been compromised, please change your password immediately and contact us at privacy@oystr.ca.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we do:
- We will update the "Last updated" date at the top of this document
- For minor changes, we will post a notice on the platform
- For significant changes — changes that materially affect how we use your data or your rights — we will notify you directly by email and give you at least 30 days before the new policy takes effect
- If you continue to use OYSTR after the new policy takes effect, you are agreeing to the updated terms
We encourage you to review this policy periodically. Previous versions are available upon request.
12. How to contact us
We are a real team and we read our privacy emails. If you have a question, request, or concern about how OYSTR handles your information, please reach out.
| Privacy email | privacy@oystr.ca |
| Mailing address | Closure Solutions Ltd., 23 Corporate Park Drive, St. Catharines, Ontario L2T 3W2, Canada |
| Response time | We aim to respond to all privacy requests within 5 business days, and to fulfill them within 30 days. |
| Canadian privacy authority | Office of the Privacy Commissioner of Canada · www.priv.gc.ca · 1-800-282-1376 |