Privacy Policy

Information we collect

• Account details: your email address, first and last name, a securely hashed version of your password and, if you choose to add it, your province.
• Membership and payments: your membership status and dates, and the customer and subscription IDs Stripe gives us. Your card details go straight to Stripe — we never see or store your card number.
• Study activity: practice exam answers and scores, lesson progress, study streaks, study plans and the fire departments you target.
• Jobs board activity: the jobs you save, the application statuses and notes you record, and your job alert choices.
• Messages: what you send us through the contact form or when you report a question.
• Email records: your email preferences and a log of the emails we send you (address, subject, date and delivery status).
• Technical information: when you're signed in, the time, IP address and browser (user agent) of each session, plus analytics about how pages and features are used (see Umami under Service providers).

How we use your information

• To create and run your account and give you the features your membership includes
• To process payments and manage your membership
• To track your progress and personalize practice, readiness scores and study plans
• To send account emails: welcome, receipts, membership notices, password resets and the job alerts you set up
• To send marketing emails, unless you've opted out (see Email below)
• To answer your messages and reports, keep the service secure, prevent abuse and fix problems
• To understand how FireStart is used so we can improve it

We don't sell or rent your personal information, and we don't share it with advertisers.

Service providers

These companies run parts of the service for us. Each one receives only what it needs for its part:

• Hetzner Online (Falkenstein, Germany) — Hosts our application server and database, including the server-side copy of our backups. All the account, study and jobs-board information described above is stored there.
• Stripe — Processes payments. Stripe receives your email address and our internal ID for your account, and collects your card and billing details directly on its secure checkout page.
• Resend (United States) — Delivers our emails. Resend receives your email address, the name we greet you by and the content of each email we send you.
• Proton Mail (Switzerland) — Hosts our own mailbox. It receives the emails you send us, messages from our contact form, and the notices we get when someone signs up or pays (name and email address).
• DigitalOcean Spaces (Toronto, Canada) — Stores site media (question images, audio clips and department logos) and our off-site database backups, which are encrypted before they're uploaded.
• Cloudflare Turnstile — Checks that new sign-ups come from a person rather than a bot. When you use the sign-up form, Cloudflare receives your IP address and technical information about your browser and device.
• Umami (website analytics, self-hosted) — Measures how our pages and features are used. Umami runs on our own server (Hetzner, Germany), so this information isn't shared with an analytics company, and it doesn't use cookies. It records the pages you visit (without anything after a "?" in the address), the site that referred you, your browser, operating system, device type, screen size, language and approximate location (derived from your IP address, which isn't stored), and actions such as signing up, starting checkout, or starting and finishing a practice exam or lesson. When you're signed in, these visits are linked to your account ID so we can see how members use features. Administrator pages aren't measured.
• Google Fonts — Supplies the typeface our pages use. Your browser downloads the font files from Google's servers, which receive your IP address and browser information.

Where your information is stored and processed

FireStart is a Canadian service, but our application server and database are in Germany, and some of our providers process information in other countries, including the United States and Switzerland. Information stored or processed outside Canada is subject to the laws of the country where it is held, and that country's courts, law-enforcement and national-security authorities may be able to obtain access to it.

Email: account messages and marketing

Account emails — your welcome email, payment receipts, membership notices, password resets and any job alerts you set up — are part of the service, so they're sent whatever your marketing preference. You can turn off job alerts on your Job Alerts page.

We may also send marketing emails, such as product news, study tips and offers. Every marketing email identifies FireStart, includes our mailing address and has an unsubscribe link.

You can withdraw your consent to marketing emails at any time: use the unsubscribe link in any marketing email or your email app's unsubscribe button, or turn off marketing emails in Account Settings. Your choice takes effect immediately.

Cookies and browser storage

FireStart itself sets one cookie: a sign-in cookie that keeps you logged in for up to 30 days. It's essential to the service and isn't used for tracking. We also keep small preferences, such as your language, in your browser's storage. We don't use advertising or analytics cookies.

How long we keep information

• Account, study and jobs-board information is kept for as long as your account exists.
• If you ask us to delete your account, we delete your account and the information linked to it. Messages you've sent us and our log of emails sent to you are kept for our records unless you ask us to delete those too.
• Deleted information can remain in our backups for up to 30 days (14 days on our server, 30 days in our encrypted off-site backups) before it's overwritten.
• Payment records are also held by Stripe, which keeps them as its own legal obligations require.

Security

Every page is served over HTTPS, passwords are stored only as bcrypt hashes, our off-site backups are encrypted, and access to personal information is limited to the people who run FireStart. No system is perfectly secure; if a breach involving your information creates a real risk of significant harm, we'll notify you and the Office of the Privacy Commissioner of Canada as the law requires.

Your rights and choices

You can change some of your information yourself in Account Settings: your password, your province and your marketing email preference.

You can also ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete your account. Email admin@firestart.ca from the address on your account and we'll respond within 30 days.

If you're not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Changes to this policy

When we change this policy, we update the date at the top of this page. If a change materially affects how we use your information, we'll also tell members by email.

Privacy contact

FireStart (firestart.ca) is responsible for the personal information described in this policy. For privacy questions or requests, email our privacy contact at admin@firestart.ca.