Maple Arts Privacy Policy

Effective Date: April 29, 2026 Last Updated: June 24, 2026

1. Who We Are

The Maple Arts app is operated by the Canadian Arabic Orchestra, a Canadian non-profit organisation presenting live Arabic music events across Canada. Maple Arts is a registered trademark of the Canadian Arabic Orchestra.

2. What Data We Collect and Why

2.1 Data Stored on Servers (Firebase Firestore)

Device ID: A randomly generated identifier (UUID) created the first time you open the app. It identifies your device for push notifications and city preferences. You can view it in Settings → Data & Privacy. Retained until you request deletion (uninstalling the app alone does not delete the server record).

Expo Push Token: Generated by Expo's notification service to deliver push notifications. Retained until you disable notifications or request deletion.

Device Model and OS: iOS/Android designation, device model (for example, "iPhone SE (2nd generation)"), and OS name and version. Used to format notifications correctly. We do not store your device's personal name. Retained until you request deletion (see Section 8).

City Preferences: The Canadian cities you select in Settings (for example, Toronto, Montreal), or a wildcard for all cities. Used to filter notifications to your interests. Retained until you change your preferences or request deletion.

2.2 Data Stored Locally Only

Device ID: A copy of your UUID stored via React Native's AsyncStorage so your preferences persist across app restarts.

Last-Read Timestamp: The date and time you last opened the Notifications tab, used to show the unread badge when new notifications arrive.

2.3 Data Processed in Memory Only

Opened Notification IDs: Tracked during your current session to clear the unread badge. Reset when the app closes.

2.4 Anonymous Usage Statistics & Crash Reports

Listening and usage statistics (Google Analytics for Firebase): The app records anonymous in-app activity — for example, which songs and albums are played, skipped, or completed, which events are viewed, when the Book Tickets button is opened, when notifications are opened, and basic app-setup choices such as the cities you pick during first-time setup — together with general session information (app opens, session length, country, device type). This activity is tied only to the random Device ID described above, never to a name, email address, or any personal identity (the app has no accounts). We use it solely to understand which music and events our audience enjoys and to improve the app. You can turn this off at any time in Settings → Data & Privacy → "Share listening stats"; the app remains fully functional with it off.

Crash reports (Firebase Crashlytics): If the app crashes — or hits an unexpected error it recovers from — a technical report (device model, OS version, app version, and a diagnostic trace of the app's state, including which screens were active) is sent so we can find and fix the problem. These reports contain no personal information.

Aggregate city statistics (Cloudflare): When the app streams music, our delivery network records anonymous, city-level totals (for example, "1,200 plays from Toronto this week"). These are aggregate counts only — they are never linked to your Device ID or to any individual, and no IP addresses are stored.

2.5 Data We Do Not Collect

We do not collect: your name, email address, or phone number; your precise location or GPS data; your contacts or address book; photos, camera, or microphone data; payment or financial information; your browsing history; or advertising identifiers (IDFA/GAID). We do not track you across other apps or websites.

We do not log or store your IP address. When the app streams or downloads music, our content-delivery provider (Cloudflare) receives your device's IP address transiently in order to deliver the audio and artwork, as is technically required for any internet request; it is not used to identify or track you (only the anonymous city-level totals described in Section 2.4 are kept).

3. How We Use Your Data

We use your data only to:

  • Send push notifications: Using your push token and city preferences to send concert and event announcements (only with your permission).
  • Provide app functionality: Loading your saved preferences via your device ID, and showing the unread badge via the last-read timestamp.
  • Understand our audience and improve the app: Using the anonymous listening/usage statistics and crash reports described in Section 2.4 (with an off switch in Settings).

We do not use your data for advertising, profiling, third-party marketing, or any commercial purpose beyond the functions described above.

4. Push Notifications

When you first open the app, your device will ask whether you want to allow notifications from Maple Arts. This permission is optional. Enabling it lets us send concert and event alerts using your push token. You can disable notifications at any time in your device Settings, which stops all alerts. A disabled token remains in our database but is no longer used; you can request complete deletion under Section 8.

5. City Preferences

The Settings screen lets you choose which Canadian cities you want concert notifications for. Your selection is saved to our database alongside your device ID so we can filter which notifications you receive. Changes take effect immediately.

6. Music Library & Offline Downloads

The app streams the orchestra's albums from our media library. Audio and cover art are delivered through Cloudflare (see Section 7). Streaming requires no account and collects no personal information about you.

You may optionally download albums for offline listening. Downloaded files are stored privately within the app on your device, are not shared with us or any third party, and can be deleted at any time in Settings → Downloads (or by uninstalling the app).

To understand which music our audience enjoys, the app records anonymous listening statistics (plays, skips, completions, downloads) tied only to your random Device ID — never to your identity. You can turn this off at any time in Settings → Data & Privacy → "Share listening stats" (see Section 2.4).

7. Third-Party Services

Google Firebase (Firestore): Stores your device ID, push token, device model/OS, and city preferences. Hosted in the United States (Google "nam5" multi-region). Data is encrypted at rest and in transit. Google Privacy Policy

Google Analytics for Firebase & Firebase Crashlytics: Process the anonymous usage statistics and crash reports described in Section 2.4. Advertising features, Google Signals, and ads personalization are disabled; data is retained for a limited period and is never used for advertising. Google Privacy Policy

Expo Notifications: Routes notifications to devices and processes your push token for delivery via APNs (iOS) or FCM (Android). Expo Privacy Policy

Apple Push Notification Service (iOS): Delivers notifications via Apple's APNs infrastructure. Apple Privacy Policy

Firebase Cloud Messaging (Android): Delivers notifications via Google's FCM infrastructure. Google Privacy Policy

Cloudflare (Media Delivery): Album audio and cover art are stored on Cloudflare R2 and served through a Cloudflare Worker. Cloudflare receives your device's IP address transiently to deliver this media; it does not receive your device ID, push token, or any account information. Our Worker keeps only anonymous, city-level play totals (Section 2.4) — never IP addresses or device identifiers. Cloudflare Privacy Policy

External Ticketing (Weezevent / Revolugo): Tapping "Book Tickets" opens the event's ticketing page in your device's secure in-app browser. Ticketing is handled by Weezevent (and its partner Revolugo for ticket and wallet-pass delivery), which collect the information needed to process your purchase (such as name, email, and payment details) under their own privacy policies. The Maple Arts app does not receive or store any ticket-purchase or payment information. Weezevent Privacy Policy

8. Your Data — How to View and Delete

8.1 Viewing Your Device ID

Open Settings → Data & Privacy to view and copy your Device ID.

8.2 Requesting Deletion

  1. Open the app and go to Settings → Data & Privacy.
  2. Copy your Device ID.
  3. Email artists@maplearts.co with the subject "Data Deletion Request".
  4. Paste your Device ID in the message.

We complete deletion within 30 days and send an email confirmation.

8.3 Data Retention

Locally stored data (such as the last-read timestamp) is removed when you uninstall the app. Data stored on our server (Firebase) is retained until you submit a deletion request; uninstalling the app alone does not delete it.

9. Data Security

  • HTTPS encryption for all communication between the app and our servers.
  • Firebase Firestore data is encrypted at rest by Google.
  • Security rules restrict write access; only our admin tools can modify events and notifications.
  • We never sell, rent, or share your data for marketing, advertising, or profiling.

10. Apple App Store Privacy Labels

Data Not Linked to You: Device ID (push notifications, city preferences, and anonymous analytics); Product Interaction and Audio Listening Data (anonymous usage statistics — purpose: Analytics); Crash Data and Performance Data (purpose: App Functionality).

Data Not Collected: Name, email, phone number, location, contacts, browsing history, purchases, health, financial information, sensitive information, advertising identifiers.

No Tracking: We do not track you across apps or websites, and the app never asks for tracking permission.

11. Your Rights Under GDPR (European Users)

If you are in the EU/EEA, you have the right to:

  • Access the data we hold about your device;
  • Rectification of inaccurate data;
  • Erasure of your data (see Section 8.2);
  • Restriction of processing;
  • Data Portability in a structured, machine-readable format;
  • Object to processing at any time.

Legal basis: Consent (granted when you enable notifications; withdrawable by disabling notifications or requesting deletion). We respond within 30 days. Contact: artists@maplearts.co

12. Your Rights Under Canadian Privacy Law (PIPEDA & Quebec Law 25)

As a Canadian organisation, we respect the privacy rights provided under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, the Act respecting the protection of personal information in the private sector ("Law 25"). You have the right to:

  • Access the personal information we hold about your device;
  • Correct inaccurate information;
  • Withdraw consent and request deletion at any time (see Section 8);
  • Lodge a complaint with the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

Person responsible for the protection of personal information (Law 25): Wafa al Zaghal — reachable at artists@maplearts.co or by phone at +1 (647) 964-2706.

We collect only a random device identifier, notification preferences, and anonymous usage statistics; we do not sell or share personal information, and do not use automated decision-making or profiling. The anonymous usage statistics are collected to operate and improve the app and are switched on by default; you can turn them off at any time in Settings → Data & Privacy (see Section 2.4).

13. Your Rights Under CCPA and CPRA (California Users)

  • Right to Know what personal information we collect, use, or share;
  • Right to Delete your data (see Section 8.2);
  • Right to Opt Out of Sale — we do not sell personal information;
  • Right to Non-Discrimination for exercising your privacy rights.

Contact: artists@maplearts.co

14. Children's Privacy

The app requires no account creation and collects no personal identifiers (name, email, birth date, location) — only a random device identifier for push notifications. We do not knowingly collect information from users under 13 (16 in the EU). If you believe such information was inadvertently collected, contact artists@maplearts.co for prompt deletion.

15. International Data Transfers

Our Firebase database is hosted in the United States (Google's "nam5" multi-region). If you are located outside the United States, your data is transferred to and processed there. These transfers are governed by Google's data-processing agreements, which comply with international transfer requirements including the EU Standard Contractual Clauses.

16. Changes to This Privacy Policy

We update this policy when new features affect data collection or when laws require changes. The "Last Updated" date changes with each revision. Significant changes affecting how we use your data will trigger an in-app notification before they take effect.

17. Contact Us

Canadian Arabic Orchestra (Maple Arts app) Email: artists@maplearts.co Website: https://maplearts.co Country: Canada Privacy Officer (Law 25): Wafa al Zaghal — artists@maplearts.co · +1 (647) 964-2706

© 2026 Canadian Arabic Orchestra · Charity Registration Number 80330 9582 RR0001