Legal Requests and Disclosures

1. In short

• We comply with valid court orders, warrants, production orders and subpoenas, and with legal duties to report, to the extent the law applies to us.
• Without a court order we disclose only in narrow emergencies described below, and only the minimum needed.
• We can only produce what we hold. Section 5 lists it for answers.tnaado.ca; section 6 covers material you generate.
• We do not promise that we will never disclose information, and we do not promise to tell you about a request when a court forbids it.
• To send us a legal request, email contact@tnaado.ca with "Legal request" in the subject line. See section 10.

2. Who and what this covers

2.1 Who we are

This document is published by TNAADO Inc., a corporation organized under the laws of Ontario, Canada, 1050 King Street West, Toronto, Ontario, Canada M6K 0C7, for TNAADO Answers at answers.tnaado.ca. It was last updated on 26 October 2026.

2.2 What it covers

It covers information we hold about visitors to answers.tnaado.ca, server data we control, and anything you generate with the site if we hold a copy. It does not describe what Cloudflare, Vercel, Google or other providers do with data they hold themselves; their policies govern that. The Privacy Policy says what the site collects, and Cookies and tracking lists the identifiers it sets.

2.3 The Dispatch and other TNAADO sites

The Dispatch newsroom and TNAADO's other products have their own policies. This document does not cover them.

3. When the law requires us to disclose

3.1 Orders and demands

We comply with valid legal process: a court order, search warrant, production order or subpoena from a court or authority with jurisdiction over us, and a lawful demand or order to preserve data. In Canada these include Criminal Code production orders (s. 487.014) and preservation demands and orders (s. 487.012). In the United States they include warrants, court orders and subpoenas under the Stored Communications Act (18 U.S.C. 2703). Requests may also arrive through mutual legal assistance treaties. Canada's PIPEDA (s. 7(3)) lists disclosure to comply with a subpoena, warrant or court order among the situations where an organization may disclose personal information without consent.

3.2 Which country's law can reach the data

TNAADO is an Ontario company, so Canadian process can reach data we hold. Our hosting and delivery providers (Vercel, Cloudflare, Google) are United States companies and the site's origin is hosted by Vercel in the United States (we saw US East) with Cloudflare caching it at locations worldwide, so United States process can reach data they hold. Under the CLOUD Act (18 U.S.C. 2713) a United States provider must produce data in its possession, custody or control wherever it is stored. We cannot promise that data about you stays in Canada.

3.3 Duties to report

Some laws require a report without any request. In Canada, the Act respecting the mandatory reporting of Internet child sexual abuse and exploitation material requires a person who provides an Internet service to the public to report, to notify police and to preserve related data when it has reasonable grounds to believe its service is being used to commit such an offence. In the United States, 18 U.S.C. 2258A requires providers to report apparent child sexual exploitation to the National Center for Missing and Exploited Children once they have actual knowledge. We say "to the extent the law applies to us" because no lawyer has told us whether this site is a provider under either statute. Neither statute requires us to search for such material, and we do not. If we learn of it, we will report it. The retention periods in those laws are changing, so we do not state them here.

4. What we expect from an authority

In general we expect a warrant or court order for anything that reveals what you did or created, and valid legal process, such as a subpoena or production order, for basic subscriber-type information such as an account name or the IP address of a visit. This tracks how the United States Stored Communications Act separates content from non-content records. We do not treat an informal police request, email or letter, on its own, as enough to hand over personal information, except in the emergencies in section 5.

5. Disclosure without a court order

We may disclose limited information without a court order only where we reasonably believe, in good faith, that:

• there is an imminent risk of death or serious physical harm to a person, and disclosure could help prevent it;
• child sexual abuse or exploitation material is involved, and the law requires or permits a report; or
• disclosing the minimum necessary is needed to detect or stop fraud or abuse aimed at our own systems, or to protect our legal rights, and the party receiving it has a real need.

This threshold is narrower than the law would allow, and we may apply the law's wider limits if we are legally required to. We do not volunteer information about a person's lawful activity to authorities.

6. What we can actually produce

6.1 Held by TNAADO

• Email you send us and our replies, held in our email system.
• Nothing else about individual visitors. The site has no accounts, no comments, no forms, no uploads and no analytics database or visitor database of our own.

6.2 Held by others

Request logs at Vercel and Cloudflare (IP address, address requested, user agent, time). Google holds what Google Analytics, Google AdSense and Google Fonts receive, under Google's own policy. Vercel hosts the site and Cloudflare sits in front of it as a proxy and cache, so both see visitors' requests, including IP addresses. Those providers may receive legal process directly, without it passing through us, and their policies govern what they do. Cloudflare, for example, publishes that it generally requires a court-issued warrant or other court order for most non-subscriber information and valid legal process such as a subpoena for basic subscriber data, and Google's policy lets it share information with a good-faith belief that disclosure is reasonably necessary to respond to legal process or an enforceable governmental request. Deleting something on our side does not delete it from their systems.

6.3 Retention

We do not state a retention period for any record above that we have not verified. Where this document says we have not verified how long something is kept, treat it as kept until we say otherwise.

7. Material you generate with this site

The guides, calculators, checklists and the letter generator run in your browser. What you type is processed on your device and is not sent to us, so we do not receive it and cannot produce it. A letter you copy or print is on your device or printer, not with us.

8. What we do when we receive a request

1. We check that the request is genuine and comes from an authority with jurisdiction over us. 2. We read what it requires, and ask the authority to narrow it if it is too broad, vague or unrelated to what we hold. 3. We tell the person affected before disclosing, where the law allows and where we can reach them. 4. If we believe an order is unlawful, overbroad or would reveal protected information, we ask the court or authority to vary or cancel it within the time the law allows. A Canadian production order, for example, gives the recipient a short window to give notice of an application to revoke or vary it, and the recipient need not produce until that application is decided. 5. We disclose only what is required. 6. We keep a record of each request, what we gave and when.

9. When we cannot tell you

A court can order us not to disclose that we received a request, or what it asked for (in Canada, Criminal Code s. 487.0191). If that happens we may be unable to notify you, and we will challenge such an order where there is a proper basis to. We therefore do not say that we always notify the people affected. We do not currently publish a transparency report. If we begin to, we will link it here.

10. What we do not promise

• We do not promise that we will never disclose information to authorities.
• We do not promise that data held by Cloudflare, Vercel, Google or other providers cannot be obtained from them.
• We do not promise that deleting something removes it from backups, caches, provider logs or a copy preserved under a legal order.
• We do not promise that this document describes every law that could apply. It explains how we handle requests; it is not legal advice about your situation.

11. How to send a legal request

Authorities and lawyers: email contact@tnaado.ca with "Legal request" in the subject line, and give the legal basis, the issuing authority, the specific data requested, the deadline and a way for us to verify you independently, for example a call-back to an official number. You may also write to: Privacy Officer, TNAADO Inc., 1050 King Street West, Toronto, Ontario, Canada M6K 0C7. We do not accept legal process by social media or chat. Service of formal process does not depend on this address, but it is the quickest way to reach us.

Individuals asking about their own information should use the rights section of the Privacy Policy. You may complain to the Office of the Privacy Commissioner of Canada or to your state or provincial regulator.