Privacy notice
Last updated July 9, 2026
What we collect, and why
- Email address — your account. Sign-in is a magic link (no password), and campsite alerts are delivered to it.
- Display name (optional) — greetings and invites ("Evan invited you").
- Phone number (optional) — only if you turn on SMS alerts, which need a separate, explicit opt-in.
- Your scans — the parks, campgrounds, dates, and filters you ask us to watch. This is the product.
- Alert history — which alerts we sent you, so we don't send duplicates.
- Technical logs (IP address, browser info) — kept briefly for operations and security.
We collect nothing else, and we never sell or share your information for marketing. campscan stores no payment card data — there is nothing to pay for today, and if paid plans ever exist, cards will be handled by a payment processor and never touch our servers.
Consent and unsubscribing (CASL)
Creating an account by completing a verified sign-in is your consent to receive sign-in emails and the campsite alerts for scans you create; we record when that consent was given. Every alert includes a one-click link to stop that scan's alerts and a link to stop all campscan email. SMS alerts are only ever sent after their own opt-in. Sign-in links keep working after a full opt-out so you can come back.
How long we keep things
| Data | Kept for |
|---|---|
| Account (email, name, phone, scans) | Life of the account; hard-deleted 30 days after you request deletion |
| Alert and availability history | 12 months, rolling |
| Sign-in links and codes | Expire in 5 minutes; purged shortly after |
| Technical logs | About 30 days |
Who else touches your data
Delivery runs through three providers, all US-based, so this data leaves Canada for exactly that purpose: Resend (sends our email — sees your email address and message content), Twilio (sends SMS — sees your phone number and message content), and Cloudflare (routes traffic to us — sees request metadata like IP addresses).
How it's protected
The database lives on encrypted storage, the application accesses it with a least-privilege role, connections to the site are TLS, and backups are encrypted and restore-tested.
Your rights
You can see and change your information in Settings, and delete your account there too — deletion is confirmed by email code, then everything (account, scans, alert history) is permanently removed after a 30-day grace period. Signing in during the grace period cancels the deletion. For access, correction, or anything else privacy-related, email [email protected].
If something goes wrong
If a breach creates a real risk of significant harm to you, we will notify you and report it to the Office of the Privacy Commissioner of Canada, as PIPEDA requires.