What we collect, and where it goes.

This page explains how the Blue Canary website, app and monitoring service handle information. If you use the app, skip to The Blue Canary app.

Who we are

Blue Canary Ltd. is responsible for the personal information described on this page. Our address is 14505 Bannister Rd SE, 3rd Floor, Calgary AB T2X 3J3, Canada. Email sales@getbluecanary.com with privacy questions. For product help, see Support.

The website

This section covers the marketing site and its early-access form.

What we collect

The early-access form on the home page asks for five things. There is no other form on this site, and no hidden field on that one.

• Name. Required.
• Email address. Required. This is the address we reply to.
• Business. Required.
• Number of sites. Required. It is a range rather than an exact number.
• What you're running. Optional. Free text, up to 300 characters.

You can email us instead of using the form. In that case we collect what you choose to write.

We also record six anonymous analytics events: cta_click, see_one_night, form_start, form_submit, mailto_fallback and login_outbound. They record actions on the site, not anything you type into the form.

Why

We use what you submit to contact you about early access. That is the only purpose. We do not use it for advertising and we do not add you to a newsletter. We do not sell, rent or trade it. Submitting the form is your consent to be contacted, and under PIPEDA you can withdraw that consent at any time.

Where it lives

When you submit the form, three companies receive or store the information:

• Amazon Web Services. Stores submissions. United States (Oregon).
• Notion. Our contact list for following up. United States.
• Google Workspace. Receives an email notification for each submission at sales@getbluecanary.com, and is where the fallback draft described below is sent. United States.

Nothing else receives what you submit. If the form cannot reach our endpoint and you send the fallback email instead, only the Google Workspace mailbox receives it.

How it reaches us

The form sends what you type to our endpoint, which passes it to the three companies above. If that request fails, the page opens an email draft to sales@getbluecanary.com with your details already in it. Nothing leaves your computer until you send the message. If you close the draft without sending it, we do not receive it. One anonymous analytics event records which route was used.

US storage

All three companies are based in the United States, so the records they hold are subject to US law, including lawful access requests by US authorities. PIPEDA permits a Canadian company to keep business contact details with American providers. We state it here so that you know before you fill in the form.

Analytics

We use Plausible Analytics to count visits. It is the only third-party script on this site. It sets no cookies, so there is no consent banner. It does not track you across sites or devices, and nothing it collects is shared with ad networks. Plausible is an Estonian company and hosts the data in the EU. It records page views and the six events listed above. If you block it, the page works the same way.

Server logs

Our CDN writes an access log for every request to this site. Each entry includes your IP address, the page you asked for, and your browser's user-agent string. The site's files and those logs are stored on AWS in the United States (Oregon). The logs cover everyone who loads a page, not only people who use the form. We use them for security and for debugging, and we do not join them to anything you submit.

The Blue Canary app

Blue Canary is a temperature monitoring service. A business installs our sensors and gateways, and its staff use the app on a phone or in a browser to see readings and get alerts. The business is our customer. Your employer or the organisation that invited you decides who has an account and which sites they can see. This section covers what the app and service collect about people and equipment.

What we collect about you

• Name and email address. Required to have an account. Your email address is how you sign in, and where we send password resets and, if your organisation turns it on, email alerts.
• Phone number. Optional. Only if you or your organisation set up alerts by text message or phone call. We verify it with a code before we use it.
• Alert preferences. Which alerts you receive, and how.
• A push notification token. If you allow notifications, your phone gives the app a token that identifies that installation to Apple or Google. We keep it so we can send alerts to that phone. The token changes if you reinstall the app.
• Your organisation and role. Which business you belong to and what you are allowed to do in it.

What we collect about the equipment

The service also stores information about sensors, gateways and monitored sites:

• Sites. A name, and optionally a street address and time zone, entered by your organisation for each place it monitors.
• Readings. Temperature, humidity, battery level, signal strength and the time of each reading, from each sensor, and the hardware address of the sensor and the gateway that relayed it.
• Alerts. When a reading crossed a threshold, who was notified, by which route, and whether the message was delivered.
• Discovered sensors. When a gateway hears a Bluetooth sensor that is not yet registered, we keep that sensor's hardware address for 24 hours so someone can add it from the app. It is then deleted automatically.

What the app asks your phone for

• Bluetooth. To find a new gateway or sensor and set it up. Used only on the setup screens.
• Location. Android will not let an app scan for Bluetooth devices, or read the name of the Wi-Fi network it is on, without location permission, and gateway setup needs both. That is the only reason we ask. The app does not record your location and does not send it to us.
• Local network and Wi-Fi. To talk to a gateway directly while it is being set up, before it has joined your network.
• Notifications. To show alerts.

On your phone, the app keeps sign-in tokens in secure storage and notification sound choices in its own settings. During gateway setup, it can also save the Wi-Fi network name, password and network hardware address in secure storage so an authorised operator does not have to enter them again.

Signing out removes the sign-in tokens but leaves the saved Wi-Fi details on the device. Your phone's operating system controls how long secure-storage items remain, including after the app is removed or reinstalled.

Diagnostics

When the app crashes or hits an error, it sends a report to Sentry so we can diagnose it. A report includes the error, what the app was doing at the time, the phone model, operating system and app version, and an internal account and organisation identifier. It may also include technical details the app was handling when the error occurred.

The app is configured not to attach default personally identifying information. We also mask values shaped like email addresses or phone numbers before a report leaves the device. The app does not take screenshots, record your session or send its logs. It contains no advertising software.

Why

We use this information to run and improve the service: to store readings, notice when something goes wrong, tell the right people, and let your organisation manage its sites and staff. We do not use it for advertising, sell, rent or trade it, or create profiles for advertising.

Where it lives

• Amazon Web Services. Accounts, sites, readings, alerts and push tokens are stored in the United States (Oregon). Email alerts are sent through Amazon's email service. Push notifications are handed to Apple or Google through Amazon's notification service.
• Twilio. Sends text messages and makes phone calls, for alerts and for verifying a phone number. Twilio receives the number and the message. United States.
• Apple and Google. Deliver push notifications to iPhones and Android phones. They receive the token and the alert text. Depending on the alert, that text can include a site, sensor or gateway name, a reading or threshold, and whether the alert fired or was resolved.
• Sentry. Receives the diagnostic reports described above. United States.

All of these companies are in the United States. The note under US storage also applies to them.

How long we keep it

• Readings are deleted automatically 90 days after they were taken.
• Alerts, and the record of who was notified, are deleted automatically 90 days after the alert is resolved.
• Discovered sensors are deleted automatically after 24 hours.
• Your account is kept for as long as your organisation keeps you in it, and then until you or your organisation ask us to delete it.

Delete your account

An administrator in your organisation can remove you from it in the app. This takes away your access and stops alerts to you, but it does not delete your Blue Canary account.

To request account deletion, log in to the app or go to app.getbluecanary.com. Account deletion can be accessed from your profile page and completes within 30 days. If you are unable to access the app or website, email sales@getbluecanary.com from the address you sign in with. We will initiate the account deletion and respond within 30 days.

Readings and alerts belong to your organisation, not to an individual account. They stay with the organisation until their own retention period ends. Information in backups, security records or records we must keep by law may remain for the applicable retention period. If that applies, we will tell you.

Retention and deletion

For the app and service, see How long we keep it and Delete your account.

We have not set a fixed retention period for the early-access form. We keep your details until you ask us to delete them or we no longer need them to talk to you about early access. Email sales@getbluecanary.com and we will delete them from the three companies listed above.

If the law or a genuine security or record-keeping need requires us to keep something, we will keep it and tell you what it is. If you become a customer, your details move into the product, and the app section of this page applies to them from then on.

Your rights

Under PIPEDA you can:

• Ask what personal information we hold about you, and ask for a copy of it.
• Ask us to correct it.
• Withdraw your consent to being contacted, at any time.
• Challenge whether we are following our privacy obligations.

You can also ask us to delete personal information we no longer need or retain with your consent. Email sales@getbluecanary.com and say what you want. PIPEDA generally gives us 30 days to respond to an access request. If you are not satisfied with how we handled your request, you can complain to the Office of the Privacy Commissioner of Canada.

Children

Blue Canary is a business product for people who run commercial kitchens. It is not directed at children, and we do not knowingly collect information from them.

Changes

If what we collect or where it goes changes, we will update this page and change the date below.

Effective 24 August 2026 · Blue Canary Ltd. · sales@getbluecanary.com