Privacy Policy

Who runs this site

trevorheshka.com and the apps hosted under it are run by Trevor Heshka (Hesh Co.), Nanaimo, British Columbia, Canada. Questions, access or correction requests and removal requests go to trevor@trevorheshka.com.

Some apps have their own, more detailed notices, which apply alongside this one: Nanaimo Bylaw Tracker, BC Court List Archive and AnnotatorIQ.

What is collected

• Browsing the public pages. No account is needed. I don't run advertising trackers or analytics on the main site. TODO Trevor: confirm no analytics anywhere else (archived third-party copies had their old Google Analytics tag removed on Oct 22, 2026).
• Server logs. Like most websites, the web host records technical logs of each request: the page requested, date and time, IP address, browser type and referring page. They are used for security, troubleshooting and keeping the site running. TODO Trevor: confirm the host's log retention period (cPanel access logs).
• Sign-in (Google via Firebase). Some apps (for example the Nanaimo Bylaw Tracker account, HCloud, HeshGit, HubIQ and ApexCAD) use Google sign-in through Firebase Authentication. When you sign in, Google and Firebase handle the authentication. The app receives your Firebase user ID and the basic profile Google shares for sign-in (name, email address, profile picture). I never receive your Google password. Data you save in those apps (watchlists, preferences, files, records) is kept under your account.
• HeshBot chat. When you use the HeshBot assistant, your message and the recent conversation (up to the last 12 messages) are sent from my server to Google's Gemini API to generate the reply. My server doesn't keep a copy of your chat. To stop abuse, it keeps a small rate-limit record per visitor: a one-way SHA-256 hash of your IP address, recent request times and a daily count. These records are deleted about 48 hours after your last use. Don't type sensitive personal information into the chat.
• Email alerts and subscriptions. If you turn on email alerts (for example in the Nanaimo Bylaw Tracker), your alert preferences are stored with your account, and the emails are sent through Brevo, a transactional email provider. Brevo handles your email address and delivery details. To avoid duplicate emails, the app stores a one-way hash of your address, the IDs of alerts already sent, and timestamps. You can turn alerts off at any time from your account page.
• Cookies and browser storage. The main site doesn't set advertising or tracking cookies. Apps you sign in to store session data in your browser (Firebase keeps its sign-in state in browser storage, and some apps use a session cookie), and some pages save settings such as filters or watchlists locally on your device. TODO Trevor: confirm the HubIQ and HouseScore session cookies and list them here if you want the detail.
• Contact. If you email me, I receive whatever you include in your message.

Third parties

These services handle data when you use the parts of the site that rely on them. Each one also receives your IP address when your browser or my server connects to it.

• Google Gemini API: generates HeshBot replies.
• Google Firebase (Authentication, and Cloud Firestore where an app stores your data): sign-in and app data.
• Brevo: sends alert emails.
• Content and font CDNs: Google Fonts, jsDelivr, cdnjs, unpkg and similar services deliver fonts and scripts to your browser.
• Embedded widgets and public data APIs used by some project pages: TradingView market widgets, Open-Meteo weather, rss2json and the radio-browser directory.
• Hosting: the site runs on a shared LiteSpeed/cPanel web host in TODO Trevor: hosting company and country. The site isn't served through Cloudflare. TODO Trevor: confirm (checked from response headers only).

Some of these providers process data outside Canada, including in the United States.

How long it is kept

• HeshBot rate-limit records: about 48 hours.
• Account data and app content: until you delete it or ask me to delete your account. TODO Trevor: confirm per-app deletion process.
• Email-alert delivery records: TODO Trevor: retention period. Brevo keeps its own delivery logs under its own policy.
• Server logs: per the host's retention (TODO above).

Your rights

This site is run from British Columbia, Canada. I handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, BC's Personal Information Protection Act (PIPA). You can ask what personal information I hold about you, ask me to correct it, withdraw consent (for example by turning off alerts or deleting your account), or ask me to remove it. Email trevor@trevorheshka.com. I aim to reply within 30 days. If you are not satisfied with my reply, you can contact the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.

Public-record projects. Some projects index public records (for example BC court lists and City of Nanaimo council records). If you appear in one of them and want your information reviewed or removed, email me with the page address. TODO Trevor: decide and describe the removal process for court-list data.

Changes

When this policy changes, I'll update the date at the top of this page.