Le projet et votre contact
Montréal en culture is an independent cultural project. This policy describes the montreal-en-culture.pages.dev site and the features of its local version. Some features may be available only locally during testing.
Person responsible for the protection of personal information — Montréal en culture. For questions about your data, or to request access, correction or deletion of information we hold: culturemtl@outlook.com.
Preferences, cookies and browser storage
Browsing does not require a Montréal en culture account. Favourite venues, performance calendar-addition states, saved preferences and some display settings are kept in the browser's local storage. The assistant also stores up to ten recent requests in this browser so you can find them again.
This data persists until deleted and is not transferred automatically to another browser or device. You can remove favourites, clear preferences or delete history in the interface. To clear all local data, use your browser settings to delete site data. This does not delete events already copied to an external calendar.
Syncing with Google Calendar
Sign-in is optional and happens at your request. You choose your account on Google's page and authorize access. Montréal en culture does not receive your password.
The site requests two permissions: to view your calendar list to find the dedicated calendar, and to create secondary calendars and manage events in calendars created by the application. The code does not browse appointments in your other calendars.
Syncing creates or finds the Montréal en culture calendar. It sends Google the selected performance details: title, known dates and times, venue, description and activity links. Technical identifiers recognize events already transferred and prevent duplicates.
Use an activity's Add button to choose performances and the destination calendar. Turning on Google Calendar adds or updates the performance; turning it off removes the performance managed by the site. Favourite venues are independent of these choices. This is not a subscription: programme changes are not automatically reflected in your calendar. The site does not modify your other appointments. Added indicators are stored in this browser and do not automatically detect changes made directly in Google or Outlook.
Calendar exchanges happen directly between your browser and Google. The temporary access token and its expiry are kept in the browser's session storage to maintain sign-in after a refresh. It is not kept in permanent local storage. Expired or denied authorization requires signing in again. Our service does not keep a server copy of your Google calendars.
Information obtained through Google APIs is used only for this feature. It is not sold, used for advertising, sent to the AI assistant or used to train AI models. Its use and transfer comply with the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke access in the connexions tierces de votre compte Google. Revoking access does not delete events already created: you can delete the dedicated calendar in Google Calendar, or remove performances using their calendar button on the site before revoking access.
Syncing with Outlook
Microsoft sign-in is also optional. The Calendars.ReadWrite permission technically allows reading and modifying your calendars. Our code limits operations to the dedicated calendar and events identified as created by our sync. It checks your calendar list to find that calendar.
Selected performance details and sync identifiers are sent directly to Microsoft from your browser. The Microsoft library keeps sign-in in browser session storage to restore it after a refresh and attempts to renew authorization without interaction when possible. You may need to sign in again if Microsoft requires it. Technical transaction identifiers may remain in the browser to prevent duplicates if an operation is interrupted.
The rules for adding, updating and removing events are the same as for Google. You can revoke authorization in your Microsoft account settings and delete the dedicated calendar in Outlook. Revoking authorization or clearing local data does not delete events already transferred.
Suggest an activity
To submit an activity, we request your name and email. Your organization and phone number are optional. These details are used for follow-up and are not published. Activity information and its image are stored in a private Cloudflare database for review; nothing is published automatically.
Cloudflare Turnstile checks requests to limit bots. A one-time confirmation code is emailed through our Outlook account via Microsoft. Cloudflare processes the connection's IP address; our application retains a protected fingerprint of that address and email to enforce submission limits. The code expires after ten minutes; old verifications are cleaned up during later requests. Submissions are also reported to our administrative Outlook inbox. Image files are resized and recompressed before transmission. If you provide an image URL instead, it is stored with the submission; displaying the preview contacts the site hosting the image.
Submissions and their contact details remain in the private database and administrative emails until manually deleted. The current version does not automatically purge submissions. Access is restricted to project administration and the services needed to process them.
To request deletion of your contact details or a submission, write to culturemtl@outlook.com, including its reference number.
Cultural assistant and dictation
When you use the assistant, if available, your text is sent to our interpretation service, which uses Cloudflare Workers AI to produce search criteria. Dictation requires microphone permission; the recording is sent to the transcription service to convert it into text. Using a model called Whisper does not mean our code sends audio to the OpenAI API.
Data from your Google and Microsoft accounts is not sent to this assistant. Avoid including confidential information in requests. The public service retains only daily counters and a daily fingerprint of the network address to limit calls. These counters are replaced on the first accepted call of the next day; requests and audio recordings are not stored by our application on the server. Visible history is stored locally; clearing it does not request deletion of providers' possible technical logs.
Location, map and external services
Your location is requested only when you activate geolocation and allow browser access. It is used to position the map and search nearby. If you save preferences containing a location, it may be saved with your choices in the browser. To calculate directions on our map, your starting location and destination are sent to Valhalla, hosted by FOSSGIS.
The Google icon opens Google Maps in public transit mode, in a new tab or the app depending on your device. The link sends Google the destination coordinates without sending your starting location from our site. You can choose the starting point in Google Maps; that service applies its own privacy policies.
Address search uses Photon (Komoot), based on OpenStreetMap data. On the map, text is sent when you run a search. In the form, the address, city and postal code are sent after a short typing pause if the venue has no coordinates. The submitter's contact information is not needed for this search.
The public site is hosted by Cloudflare. Cloudflare Web Analytics is enabled on the published version to measure traffic and performance, including pages viewed, visit source and browser characteristics. Basemaps, activity and venue images, map fonts and other external resources load from their providers, including OpenFreeMap and OpenStreetMap, or CARTO depending on the version. These requests expose technical information such as the IP address and requested resources; map tiles correspond to the visible area.
Providers may process technical data and logs to operate and secure their services under their own policies. Their infrastructure may be outside Québec or Canada. See the policies of Cloudflare, Google, Microsoft, OpenStreetMap , OpenFreeMap et CARTO.
Retention, deletion and security
Local choices remain in your browser until deleted. Transferred events remain with the calendar provider until removed through syncing or by you. Emails you send us are used to handle your request; you may contact us to request deletion, subject to applicable obligations.
We do not sell your preferences or data obtained from calendars. The functionality described does not create a public profile or personalized advertising from that data. Public service connections use HTTPS. No measure guarantees absolute security: do not share your access credentials and use providers' revocation tools when needed.
Providers' log-retention periods depend on their policies and settings; this page does not promise immediate deletion. Contact us about information we control. Data held only in your browser must be deleted from that device.
Changes to this policy
This page will be updated when the features or processing described change. The date at the top indicates its latest revision. Any new use requiring your consent will be presented before activation.