Samara — privacy notice

Version 1 · 2026-10-19

Samara is run by G.H. El-Mohtar Professional Corporation in Ontario, Canada. Questions, access, correction or deletion requests: the administrator who gave you access.

What is stored

• Your account: e-mail address, a salted hash of your password (never the password), your role, sign-in times, and when you agreed to this notice (time, IP address, browser).
• A session cookie that keeps you signed in (up to 30 days).
• Server logs: sign-in events show your e-mail and IP address (security), kept for the limited time the host keeps logs.
• If you subscribe to alerts: your e-mail address; when, from which IP address and browser you consented, and the wording you saw; when you confirmed; how many alerts were sent.

Why: to give you access and keep it secure, and to send the alerts you asked for. It is not sold and not used for advertising or analytics.

Who else handles it: the server is run by Fly.io (data held in its Toronto region); Cloudflare runs the sign-in bot check; pages load fonts and chart libraries from Google Fonts and public CDNs, which can see your IP address; alert e-mails go out through an e-mail delivery provider, which receives the subscriber's address and the message.

How long: accounts until the administrator removes them; alert subscribers until they unsubscribe (the record of consent is then kept to show what was agreed, and erased on request).

Your choices: withdraw consent at any time (alerts: the unsubscribe link in every e-mail), and ask to see, correct or delete your information. You may also complain to the Office of the Privacy Commissioner of Canada.

Personal information is handled in line with PIPEDA, Canada’s federal private-sector privacy law, and e-mail alerts in line with CASL.