Privacy Policy — Chesed Club

Effective date: August 27, 2026
Last updated: August 27, 2026

1. Who we are

Chesed Club (“the app”) is a free family app operated by MADA Community Center (“MADA”, “we”, “us”, “our”), a registered Canadian charity based in Montréal, Québec. MADA decides why and how personal information collected through the app is used and is therefore responsible for it under applicable privacy law.

This policy explains what personal information we collect through the app, why we collect it, who we share it with, how long we keep it, and the rights and choices you have. By creating a family account you agree to this policy on your own behalf and on behalf of the children you add to your family.

2. Scope

This policy applies to the Chesed Club mobile app and to this website's Chesed Club pages. It does not apply to other MADA programs or websites, which may have their own privacy notices. Where this policy is available in more than one language, the English version governs in case of conflict.

3. Who this app is for

Chesed Club is designed for families with children. A parent or legal guardian creates the family account and adds each child. Children do not have an email address or password: they sign in by scanning a QR code that the parent generates in the app. Every child account is created and controlled by a parent.

4. Information we collect

Parent account

• Name, email address, gender, and date of birth
• Optional home address. When you type an address, suggestions are provided by a map/address-suggestion service; only the text you type is sent to it.
• A password, or, if you choose Sign in with Google, the basic profile information (name and email address) shared with us when you sign in. We never see your Google password.

Child profile (entered by the parent)

• First name
• Date of birth
• Optional avatar or photo, chosen from the device's photo library

Activity in the app

• Coin wallet balance and transaction history (top-ups, requests, transfers between family members, donations)
• Stories read, reading streaks, and badges earned
• Messages you send to MADA staff through the in-app support chat
• In-app notification preferences

Device information

• A push-notification device token, so that a push-notification delivery service can deliver the notifications you have turned on. This token does not identify you by name.
• Basic technical information that any server receives when an app connects to it (such as the device's network address and app version), used only to operate and secure the service.

Payments

• When a parent tops up coins with a card, the card details are entered directly with our payment processor. MADA never sees or stores card numbers. We keep a record of each payment (amount, date, and a payment reference) for accounting, tax, and receipting purposes.

Camera

• The app uses the camera only to scan the family QR code when a child signs in. No images are stored.

Support correspondence

• If you email us, we keep the correspondence so that we can respond and keep a record of the request.

5. Children's information

Chesed Club is intended to be used by children together with their parents. We take the following commitments regarding children's information:

• Only a parent or legal guardian can create a child account, and the parent controls it at all times.
• We collect the minimum information needed for a child to use the app: the information listed under “Child profile” and the child's activity in the app (reading, badges, coins).
• We do not collect an email address, phone number, or precise location from children.
• We do not market to children and do not send children promotional messages.
• We do not use behavioural advertising or build advertising profiles of children or parents.
• We do not sell, rent, or trade children's information to anyone.
• A parent can review and update a child's profile at any time and can delete a child's account from the app (Edit child → Remove).

If you believe a child account was created without the consent of a parent or legal guardian, contact us at app@madacenter.com and we will remove it.

6. Consent and legal basis

We collect, use, and disclose personal information with your consent, in accordance with Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA). You give your consent when you create an account, enter information in the app, or use a feature that needs that information (for example, turning on notifications or making a payment). A parent or legal guardian gives consent on behalf of each child they add.

In limited cases we may use or disclose information without consent where the law permits or requires it, for example to comply with a legal obligation, to investigate a breach of an agreement or of the law, or to protect a person's safety.

You may withdraw your consent at any time (see section 14). Because most of the information we collect is necessary to run the app, withdrawing consent will usually mean deleting the account.

7. How we use information

• To create and operate your family account and each child's login
• To run the coin wallet: process top-ups, requests, transfers, and donations
• To track reading progress, streaks, and badges
• To send notifications you have enabled (for example, a coin request from a child)
• To answer support requests and communicate with you about your account
• To issue donation receipts where applicable and meet our accounting, tax, and legal obligations as a charity
• To keep the app secure, prevent fraud and misuse, and enforce our Terms of Service
• To produce aggregated, anonymised statistics (for example, how many stories were read in a month) that cannot identify any person

We do not use personal information for any purpose that is incompatible with the purposes above without first obtaining your consent.

8. What we do not do

• We do not show advertising in the app.
• We do not use analytics tools, advertising identifiers, cookies, or third-party trackers in the app.
• This website does not use analytics or tracking cookies.
• We do not sell, rent, or trade personal information, and we do not share it for marketing purposes.
• We never use children's information for marketing or profiling.

9. Sharing of information

We share personal information only in the following situations:

• Service providers. We use a small number of third-party service providers to store and process data solely to operate the app: a database and authentication provider, a payment processor, a push-notification delivery service, a map/address-suggestion service, and the providers that run our servers. These providers act on our instructions under contract, may use your information only to provide their services to us, and are required to protect it.
• Sign-in provider. If you choose Sign in with Google, that provider confirms your identity to us. Its handling of your information is governed by its own privacy policy.
• Legal requirements. When required by law, regulation, court order, or a lawful request from a public authority.
• Protection of rights and safety. When we believe in good faith that disclosure is necessary to protect the rights, property, or safety of MADA, our users, a child, or the public, or to detect and prevent fraud or security issues.
• Business transfer. If MADA merges with, transfers the app to, or is succeeded by another organisation, personal information may be transferred as part of that transaction, subject to this policy and to applicable law. We will notify you before your information becomes subject to a different privacy policy.

We do not sell or rent personal information to anyone.

10. Payments, donations, and receipts

Card details are entered directly with our payment processor and are never seen or stored by MADA. The payment processor handles card data under its own privacy policy and security standards. We receive and keep only a payment record (amount, date, and payment reference) so that we can credit coins to your family, handle refund requests, keep our accounts, and meet our tax obligations.

Coins in Chesed Club represent money a parent has contributed to MADA. When coins are donated to a MADA project, that amount supports MADA's charitable work. We keep a record of contributions and donations per family so that, where applicable, we can issue donation receipts in accordance with Canada Revenue Agency rules and report as required by law. Issuing a receipt requires the donor's name and address.

11. Where information is stored and cross-border transfers

Your information is stored on servers located in Canada and the United States. Some of our service providers are located, or process data, outside Québec and outside Canada. When personal information is stored or processed outside Québec or Canada, it is subject to the laws of those jurisdictions, and courts, law-enforcement, or national-security authorities there may be able to access it. Before transferring personal information outside Québec we assess the privacy protections that will apply, and we require our providers by contract to protect the information to a standard comparable to this policy.

12. Retention

• Account and activity data is kept for as long as your family account exists. When you delete an account, or ask us to, we delete it as described on our Account Deletion page.
• Payment and donation records are kept for up to 7 years after the end of the year they relate to, as required by the Canada Revenue Agency for charitable donation receipts and accounting.
• Legal records are kept for as long as needed to comply with a legal obligation or to establish, exercise, or defend a legal claim.
• Anonymised statistics that cannot identify any person may be kept indefinitely.

When information is no longer needed for these purposes, we delete it or anonymise it.

13. Security

We use industry-standard safeguards to protect personal information, including encryption in transit and at rest, access controls that limit who at MADA and at our providers can see your data, and hashed passwords that are never visible to MADA. Only MADA staff who need access to run the app or respond to support requests have it.

No system is 100% secure. If a confidentiality incident involving your personal information occurs and presents a risk of serious injury or harm, we will notify you and the relevant privacy authorities as required by applicable law, and we will keep a record of the incident as the law requires.

You also play a role: keep your password and your family's QR code private, and contact us right away if you believe your account has been accessed without permission.

14. Your rights

Under Québec's private-sector privacy law (Law 25) and PIPEDA, you have the right to:

• Access the personal information we hold about you and your children
• Correct information that is inaccurate, incomplete, or out of date
• Delete your information (subject to the retention requirements in section 12)
• Withdraw your consent to the collection, use, or disclosure of your information, which may mean you can no longer use the app
• Receive a copy of the computerised personal information you provided to us in a structured, commonly used format (data portability), where applicable
• Be informed about how your information is used and to whom it is disclosed, as set out in this policy
• File a complaint with the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada if you are not satisfied with our response

How to exercise your rights

• In the app: update your profile at any time, remove a child (Edit child → Remove), or delete your account (Edit profile → Delete account).
• By email: write to app@madacenter.com. We may ask you to verify your identity before acting on a request. We respond within 30 days of receiving a request, and there is no charge except where the law allows a reasonable fee for copies.

15. Push notifications

The app can send push notifications, for example when a child requests coins. You can turn notifications on or off in the app's settings or in your device's notification settings at any time. Turning them off does not affect the rest of the app.

16. Third-party links and services

The app or this website may contain links to third-party websites or services (for example, the app stores or a charity project's web page). We are not responsible for the privacy practices of third parties, and this policy does not apply to them. We encourage you to read their privacy policies.

17. Deleting your account

You can delete your own account in the app (Edit profile → Delete account) and remove a child (Edit child → Remove). Deleting a parent account removes the household's data; the primary parent must transfer the family to another parent or delete the whole family. Full details are on our Account Deletion page.

18. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows the latest version. If we make material changes, we will notify you in the app or by email before the changes take effect. Continuing to use the app after that date means you accept the updated policy.

19. Contact and person in charge of the protection of personal information

The person in charge of the protection of personal information can be reached at app@madacenter.com.

MADA Community Center
Montréal, Québec, Canada
app@madacenter.com

See also our Terms of Service and Account Deletion page.