Privacy Policy

Family Court Toolbox ("we," "us," "our," or the "Company") is committed to protecting your privacy and ensuring you have a positive experience on our platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our website and services at www.familycourttoolbox.com (the "Platform").

We are operated from Ontario, Canada, and are bound by the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal privacy law, as well as applicable Ontario provincial privacy legislation. We also comply with Canada's Anti-Spam Legislation (CASL) — we only send transactional emails (password resets, security alerts, notification digests) that are necessary for the operation of your account and the services you have requested. We do not send unsolicited commercial electronic messages. We take our obligations seriously and have designed our platform with privacy as a foundational principle.

This Privacy Policy applies to:

• Website usage: When you visit www.familycourttoolbox.com, whether or not you create an account
• Platform services: When you use any tools, calculators, form generators, or case management features
• Account holders: When you create and maintain a user account with any user type (self-represented party, family law professional, shelter administrator, shelter staff, or teen user)
• Data sharing: When you share case information with other users, lawyers, or professionals

This policy does not apply to:

• Third-party links: External websites or services linked from our platform (e.g., Hague Convention resources)
• Offline interactions: If you communicate with us by email or phone outside the platform, those communications may have different privacy practices

We recommend reading this policy in full to understand all our privacy practices. If you do not agree with any aspect of this policy, please do not use the Platform.

When you create a user account on Family Court Toolbox, we collect and store the following information:

Why We Collect This Data

• To create and manage your account securely
• To authenticate you on each login
• To send you important account notifications and communications
• To provide language options matching your preference
• To prevent unauthorized access and detect suspicious activity
• To comply with legal obligations (data export under PIPEDA, account closure documentation)

Data Retention

Account registration data is retained for as long as your account is active. When you delete your account, all associated data is permanently deleted within 30 days. Login history is retained for 90 days for security purposes, then deleted. 2FA settings and recovery codes are deleted when 2FA is disabled or when your account is deleted.

The core function of Family Court Toolbox is managing sensitive family law information. We handle this data with the highest level of care and security.

Why We Collect This Data

• To populate court forms with your case information
• To calculate support obligations accurately
• To generate parenting schedules and visualizations
• To enable secure document storage and sharing
• To maintain a chronological record of your case
• To facilitate sharing with lawyers and other parties when you authorize it

Data Confidentiality

All case and family data is treated as highly confidential. This information is encrypted at rest and in transit. You have complete control over who can see your case data through our sharing settings.

Family Court Toolbox handles sensitive financial information needed for support calculations and property division. We do not process payments or store credit card information—we are not a payment processor.

Why We Collect This Data

• To calculate accurate child support and spousal support obligations
• To facilitate cost-sharing analysis between parties
• To estimate legal aid eligibility
• To facilitate property and asset disclosure
• To populate financial schedules on court forms

Financial Data Security

All financial information is encrypted at rest and encrypted during transmission. Service providers process financial information needed to deliver the features you use. We do not sell financial information or share it for advertising. We do not use your financial information for any purposes other than the functions you explicitly authorize within the platform.

Family Court Toolbox includes secure communication tools to help parties and professionals collaborate on case resolution.

Why We Collect This Data

• To enable secure messaging between parties and collaborators
• To detect and prevent hostile or abusive communication
• To coordinate scheduled sessions and video meetings
• To send you timely notifications about case events
• To provide language support for notifications

Communication Privacy

All in-app messages are encrypted in transit and at rest. Messages are stored securely on Canadian servers. Message content is accessible only to the intended recipients. You can delete messages from your account at any time. If a message is deleted by one party, the other party's copy remains (we do not offer "recall" functionality that removes messages from all participants).

Moderation & Safety

Our AI-powered moderation system analyzes message content in real-time to detect language that is hostile, abusive, or threatening. This is a safety feature, not surveillance. You will receive feedback if your message is flagged. For shelter users, moderation alerts may be reviewed by shelter staff to assess safety concerns. You have the right to dispute any moderation determination.

Family Court Toolbox includes features to help schedule exchanges and manage custody transitions.

Why We Collect This Data

• To help you create fair and practical parenting schedules
• To suggest optimal exchange locations based on geographic reality
• To visualize parenting-time arrangements clearly
• To calculate overnight percentages and parenting time allocations
• To coordinate schedules with court dates and important events

Location Data Privacy

Location data (addresses and distance information) is never shared with third parties. You control which location information you enter. Location data is used only for schedule optimization within your account. We do not track your real-time GPS location.

When you share case information with lawyers, parenting coordinators, or other professionals, additional data may be collected and used.

Professional Credentials & Verification

When a lawyer creates an account, we collect and verify:

• Law Society of Ontario (LSO) license number
• Verification status (whether your LSO license is valid and in good standing)
• Law firm name and professional contact information
• Area of practice specialization

This verification is displayed to your clients to ensure they are communicating with a verified legal professional.

Why We Collect This Data

• To facilitate secure case sharing with your lawyer or coordinator
• To verify professional credentials and build trust
• To track court filings and professional milestones
• To help you find qualified professionals when needed
• To maintain records of who has accessed your case

Family Court Toolbox is designed to support vulnerable individuals, including survivors of domestic violence. We have implemented special privacy and safety features for shelter and community organization users.

Shelter Data Protection

Data created through shelter accounts is protected with additional safeguards:

• Shelter staff access logs: Records of which staff members accessed each client case are maintained and can be audited by shelter administrators
• Rotation of cases: Cases are not permanently assigned to one staff member, allowing flexibility and rotation when staff changes occur
• Client transition: When a client is ready, their case can be transferred to a personal account in their name, and the shelter's access can be revoked
• Segregated data: Shelter organizational data and client data are kept in separate, secure repositories

Why We Collect This Data

• To provide services to vulnerable individuals seeking help
• To enable shelter staff to provide informed and safety-conscious support
• To maintain audit trails for compliance and accountability
• To create individualized safety plans
• To facilitate case management within community organizations

Family Court Toolbox includes features designed specifically for teens (ages 13-17) involved in custody matters, with special privacy protections under Canadian law and PIPEDA's provisions on children's data.

Teen Privacy & Consent

Teen data is treated with special protection:

• Parental consent: Parents must consent to teen participation before a teen can access the platform
• Child assent: Teens must assent to participate; they cannot be forced
• Confidentiality: Teen preferences are shared only with the court and legal representatives unless the teen explicitly authorizes sharing
• Anonymity option: Teens can submit preferences anonymously, which are delivered to the court without identifying the teen
• Data deletion: When the teen turns 18 or when a custody matter concludes, teen preference data can be deleted upon request

Why We Collect This Data

• To give teens a voice in custody decisions affecting their lives
• To provide courts with reliable information about teen preferences
• To comply with Ontario family law (which considers the teen's preferences)
• To ensure teen safety and autonomy in preference collection

When you use Family Court Toolbox, we automatically collect certain technical data to operate the platform securely and reliably.

Why We Collect This Data

• To prevent abuse and detect malicious activity (rate limiting, attack detection)
• To diagnose platform issues and improve performance
• To maintain accurate audit trails for compliance (PIPEDA, Ontario privacy law)
• To troubleshoot problems you report
• To optimize the platform for your device and browser

Technical Data Retention

Technical data is retained as follows:

• IP addresses and HTTP logs: 90 days (for security analysis)
• Error logs: 30 days (for debugging)
• Audit logs: 7 years (for legal compliance)
• Performance metrics: 90 days (for optimization)

Family Court Toolbox is designed to minimize dependence on third-party services. We do not share your personal data with advertisers, marketing firms, or data brokers.

What We Do NOT Do

• We do NOT use third-party advertising networks
• We do NOT sell your personal data
• We do NOT share your data with data brokers
• We do NOT sell your contact information
• We do NOT use tracking pixels or cookies from advertisers
• We do NOT integrate Facebook Pixel, Google Analytics (with personal data), or similar tracking

Google Account Integration (Gmail & Google Calendar)

If you choose to connect your Google account, Family Court Toolbox requests access to your Gmail and Google Calendar so that it can: display your email and calendar inside the app; match messages and events to the correct client matter; let you reply to or compose email from your own mailbox; and create, update, or organize calendar events that you initiate. This access is entirely optional, is requested only when you explicitly connect your account, and can be revoked at any time by disconnecting the integration or by visiting your Google Account permissions.

Family Court Toolbox's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we use Google user data solely to provide and improve the features you have enabled; we do not transfer or sell this data, and do not use it for advertising or to train generalized artificial-intelligence or machine-learning models; and we do not allow humans to read your Gmail or Calendar data except with your explicit consent (for example, to support a request from you), where required by law, for security purposes such as investigating abuse, or where the data has been aggregated and anonymized. Connected Google data is stored encrypted, is accessed only to deliver the features you turned on, and is deleted when you disconnect the integration or close your account.

Limited Third-Party Integrations

Service providers may process personal information needed to operate the Platform:

• Email service: If we send you account notifications, we may use an email service provider (which receives only your email address and the notification content)
• Cloud hosting: FCT uses Vercel and Supabase for application, database and account services. See the storage section below for the distinction between application region and provider processing locations.
• External links: When we link to external resources (e.g., Hague Convention information, court websites), those external sites have their own privacy policies

Hague Convention & External Resources

We may link to external resources and legal databases operated by government agencies, international organizations, or non-profits (e.g., Hague Convention materials, court filing guides). These external sites are not operated by Family Court Toolbox and have their own privacy practices. We are not responsible for their privacy policies.

Data Processing Agreements

Any third-party service provider that handles your personal data on our behalf is bound by a written Data Processing Agreement (DPA) that requires:

• Confidentiality of your data
• Security measures equivalent to our own
• Restriction to processing only as directed by us
• Prohibition on sharing data with other third parties
• Deletion of data when services end

We retain your data only as long as necessary to provide the service or as required by law. You have the right to request deletion at any time.

Data Retention Schedule

Account Deletion & Data Purging

When you delete your account:

1. Your account is immediately disabled and you cannot log in
2. Your personal data is marked for deletion (soft delete)
3. After 30 days, your personal data is permanently deleted (hard delete) from live systems
4. Audit logs containing references to your account are retained for 7 years (required for legal compliance)
5. Backup systems may retain encrypted copies for up to 90 days, then are purged

You can request immediate deletion, which will accelerate the timeline. Deleted data cannot be recovered after the hard delete phase.

Data Export & Portability

You can request to export all your personal data in a machine-readable format (JSON or CSV) at any time. This is your right under PIPEDA. Exported data includes:

• Account information
• All case data you created or have access to
• Messages and communications
• Documents stored in Family Vault
• Login history
• All data associated with your account

Exports are available within 30 days of request (or sooner). You can then import this data into another system or archive it for your records.

We implement comprehensive technical and organizational security measures to protect your data from unauthorized access, loss, or misuse.

Encryption & Cryptography

• In transit: All data transmitted between your device and our servers is encrypted using TLS/SSL (HTTPS). We enforce HTTPS on all connections and reject unencrypted HTTP requests.
• At rest: Sensitive data (case information, financial data, messages) is encrypted at rest using AES-256 encryption
• Passwords: User passwords are hashed using bcrypt with a strong salt. Passwords are never stored in plain text and cannot be recovered or reset by administrators.
• Authentication tokens: Session tokens are cryptographically signed and stored securely

Server Security & Infrastructure

• Geographic location: Application functions are configured to run in Montréal. Processing locations vary by provider; a Canadian application region does not mean every service or copy of information remains in Canada.
• Hosting provider: FCT uses Vercel for the web application and Supabase for database and account services.
• Database security: Databases are secured with firewalls, access controls, and encryption
• Backup systems: Regular encrypted backups are maintained in secure, geographically redundant locations
• Intrusion detection: Automated systems monitor for unauthorized access attempts and suspicious activity

Access Controls

• Principle of least privilege: Employees access only the data necessary for their role
• Multi-factor authentication: Staff with administrative access use strong authentication
• Access logs: All administrative access is logged and audited
• Data isolation: Case data is isolated by account, preventing unauthorized cross-account access

Incident Response & Security Monitoring

• Real-time monitoring for security threats and anomalies
• Automated alerts for suspicious activity
• Incident response procedures for data breaches
• Regular security audits and penetration testing
• Vulnerability scanning and patching

User-Level Security

• Two-factor authentication (2FA): Users can enable 2FA on their account for additional security
• Session timeouts: Sessions automatically expire after a period of inactivity
• Device fingerprinting: We detect and alert you if your account is accessed from unusual locations or devices
• Password complexity requirements: We require strong, unique passwords

The Personal Information Protection and Electronic Documents Act (PIPEDA) grants Canadian residents specific rights regarding their personal information. Family Court Toolbox respects all rights guaranteed under PIPEDA and Ontario privacy law.

Right to Access Your Data

You have the right to access all your personal information held by Family Court Toolbox.

• You can view your data at any time in your account settings
• You can request a complete data export in machine-readable format (JSON or CSV)
• Request a formal data access request by contacting us
• We must respond to formal requests within 30 days
• Data exports are provided at no cost

Right to Correct Your Data

You have the right to correct inaccurate, incomplete, or out-of-date information.

• You can update your account information at any time
• You can edit case data and case information
• You can request corrections to audit records or historical data
• If you believe data is inaccurate, we will correct it upon request

Right to Delete Your Data

You have the right to delete your account and all associated personal information.

• You can delete your account at any time from account settings
• You can request immediate deletion of specific data (e.g., a case, a document)
• Upon account deletion, your data is marked for deletion immediately and permanently deleted within 30 days
• Audit logs are retained for 7 years as required by law, but are de-identified

Right to Withdraw Consent

You can withdraw your consent to the collection and use of your data at any time.

• Withdrawing consent means you wish to close your account and have your data deleted
• Upon withdrawal, we will cease collecting new data and delete existing data
• Withdrawal does not affect data already used for compliance or legal obligations

Right to Object to Data Use

You can object to how your data is being used.

• You can disable notifications, moderation alerts, or other features
• You can restrict access to your data (e.g., revoke a lawyer's access)
• You can request that we stop processing your data for specific purposes

Right to Lodge a Complaint

If you believe your privacy rights have been violated, you can lodge a complaint.

• Contact us at support@familycourttoolbox.com with details of your complaint
• We will investigate and respond within 30 days
• You can escalate to the Office of the Privacy Commissioner of Canada (OPC)
• Contact the OPC at: 1-800-282-1376 or www.priv.gc.ca

How to Exercise Your Rights

You can exercise any of these rights by:

1. Self-service: Use your account dashboard to view, edit, export, or delete your data
2. Email request: Email support@familycourttoolbox.com with your request and "PIPEDA Request" in the subject line
3. Formal request: Send a written request to the address in Section 18 (Contact)

We will respond to all requests within 30 days. If we cannot comply with a request, we will explain the reasons and provide information about your options.

We take data security seriously. In the unlikely event of a privacy breach, we have procedures in place to respond swiftly and transparently.

What Constitutes a Breach

A privacy breach is the unauthorized access, disclosure, or loss of personal information. Examples include:

• Unauthorized access to someone else's account or data
• Loss of data due to hardware failure or disaster
• Theft of data or devices containing data
• Accidental disclosure of data to unintended recipients

Our Breach Response Procedure

1. Detection: Security monitoring systems detect the breach and alert our team
2. Containment: We immediately take action to stop the breach and prevent further data loss
3. Investigation: We investigate the cause, scope, and impact of the breach
4. Notification: We notify affected individuals without unreasonable delay (see below)
5. Remediation: We implement corrective measures to prevent future breaches

Breach Notification

If a breach occurs that poses a real risk of significant harm to affected individuals, we will notify them:

• Timing: Where notification is required under PIPEDA, it will be given as soon as feasible after we determine that the breach has occurred
• Method: We will notify you by email to the address associated with your account, or by other means if we cannot reach you by email
• Content: The notification will include:
  • What data was involved
  • What happened (how the breach occurred)
  • What we are doing to address it
  • What you can do to protect yourself
  • Our contact information

Regulatory Notification

We will also notify relevant regulatory authorities if required by law:

• Office of the Privacy Commissioner of Canada (OPC)
• Ontario privacy authorities
• Law enforcement (if criminal activity is involved)

Your Rights After a Breach

• You have the right to detailed information about what happened
• You have the right to request corrective action or compensation
• You have the right to file a complaint with the OPC or Ontario authorities
• You have the right to take legal action if you are harmed by the breach

Family Court Toolbox involves data about children and, in some cases, direct interaction with teens. We have special procedures to protect children's privacy and comply with Canadian law on children's personal information.

Children's Information in Case Data

When parents use the platform to manage custody matters, case data includes information about children (names, dates of birth, special needs, school information, schedule information). This information is treated as highly sensitive:

• Children's data is encrypted at rest and in transit
• Access to children's information is restricted to account holders and authorized users
• Children's information is never shared with third parties without explicit consent
• Parents/guardians have full control over how children's data is used
• Children's information is deleted when the account is deleted or when requested

Teen Users (Ages 13-17)

Teens can interact with Family Court Toolbox through the Teen Portal to express custody preferences. Special protections apply:

Privacy Risks for Children

We acknowledge that family law proceedings can pose privacy risks for children:

• Court documents may be accessed by the public in some jurisdictions
• Documents may be disclosed to other parties (the other parent)
• Children's names may appear in public court records

We encourage users to:

• Be cautious about what children's information they share in court documents
• Consult with a lawyer about privacy considerations in their specific jurisdiction
• Use anonymity features when available (e.g., teen preferences can be submitted anonymously)

Parental Controls

Parents and guardians can:

• Control what children's information is stored in their case
• Decide whether to authorize teen participation
• Review and delete children's information at any time
• Restrict who can access children's information

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our privacy practices, please contact us:

Response Times

• General inquiries: We respond within 5 business days
• Privacy requests: We respond within 30 days (as required by PIPEDA)
• Urgent matters: Security incidents are addressed immediately

Complaints to Regulatory Authorities

If you are not satisfied with how we have addressed your privacy concerns, you can lodge a complaint with:

Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Post the updated policy on our website
• Update the "Effective Date" at the top of this document
• Notify existing users by email if the changes significantly impact their privacy

Your continued use of Family Court Toolbox after changes to this policy constitutes your acceptance of the updated terms. We encourage you to review this policy periodically to stay informed about how we protect your privacy.