True North Drawson Inc. ("True North Drawson", "we", "us", or "our") operates truenorthdrawson.com, a free social casino platform designed purely for entertainment. No real money is wagered on our platform, no real money can be won, and none of our games offer prizes with monetary value. Even so, we treat the personal information you entrust to us with the same seriousness that a regulated financial institution would. This Privacy Policy explains, in plain language, what information we collect, why we collect it, how we protect it, how long we keep it, and the rights you hold over it under Canadian law, in particular the Personal Information Protection and Electronic Documents Act ("PIPEDA").
This policy applies to every visitor and registered member of truenorthdrawson.com, whether you browse the site casually, create an account, participate in our free-play games, or subscribe to an optional cosmetic membership. By using the platform you acknowledge that you have read and understood this policy. If any part of it is unclear, we genuinely want to hear from you — our contact details appear in Section 13, and we respond to privacy questions with the same priority we give to security incidents.
We review this document at least once per year and whenever our data practices change in a meaningful way. When we make a material change, we will post the updated version on this page, revise the effective date shown above, and — where the change affects registered members — notify you by email before the change takes effect. Continued use of the platform after the effective date of a revised policy constitutes acceptance of the revision, but for any new purpose of collection that PIPEDA treats as requiring fresh consent, we will ask for that consent explicitly rather than assuming it.
Our guiding principle is data minimisation. Because True North Drawson is an entertainment platform rather than a gambling operator, we are not required to perform the extensive identity verification that real-money sites must carry out, and we deliberately choose not to collect anything close to that level of detail. We collect only the information we need to operate the platform, keep it secure, comply with the law, and make the experience genuinely enjoyable.
We collect information through three channels, each described in detail in the sections that follow:
We do not purchase data about you from data brokers, we do not enrich your profile with information scraped from social networks, and we do not combine your account with advertising identifiers. Under PIPEDA's accountability principle, we remain responsible for personal information in our possession or custody, including information transferred to third parties for processing, and we have designated a Privacy Officer who oversees compliance with this policy across the organisation.
Consent matters to us. Where PIPEDA permits implied consent — for example, for the collection of technical data that is plainly necessary to deliver a web page you requested — we rely on it transparently and describe the practice here. Where the law or common sense calls for express consent — for example, before sending you a marketing newsletter — we obtain it through a clear, unticked, affirmative action, and we make withdrawing that consent as easy as giving it.
When you create a True North Drawson account, we ask for the smallest set of details that still lets us run a functional, secure service. The registration form collects the following:
After registration you may, entirely at your discretion, add optional details to your profile: an avatar selected from our built-in gallery, a short biography, your province or territory, and your preferred game categories. These fields exist purely to personalise your experience. Leaving them blank has no effect on your access to any game or feature, and you can edit or erase them whenever you like. We deliberately do not offer photo uploads for avatars, which spares us from processing biometric-adjacent imagery altogether.
When you contact our support team by email or through the on-site chat, we receive whatever you choose to include in your message, together with your account identifier if you are signed in. Please share only what is needed to resolve your question. Support correspondence is retained according to the schedule in Section 9 and is accessible only to trained support staff bound by confidentiality obligations.
If you choose to purchase an optional cosmetic membership, the payment itself is handled entirely by our external payment processor, as explained in Section 11. We receive and store only the information we need for accounting: the date, the plan you selected, the transaction reference, and the payment status. Full card numbers, CVV codes, and banking credentials never touch our servers in any form.
Like virtually every online service, our servers and applications automatically record certain technical information when you use the platform. This data helps us keep the site fast, stable, and secure, and helps us understand which games and features people actually enjoy. The categories we collect are:
Usage data is pseudonymised wherever possible: analytical processing is carried out against internal identifiers rather than usernames or email addresses, and raw records are aggregated or deleted according to the retention schedule in Section 9. We do not use usage data to build advertising profiles, and we do not share it with ad networks — there are no ad networks on this platform.
True North Drawson uses a small, carefully limited set of cookies and equivalent browser storage technologies. We divide them into two groups: strictly necessary cookies, which the platform cannot function without, and optional cookies, which are set only after you consent through our cookie banner.
You can review the full list of cookies we set, their lifespans, and their exact purposes — and change your consent at any time — on our dedicated Cookie Policy page. You can also delete or block cookies through your browser settings; if you block strictly necessary cookies, parts of the platform such as sign-in will stop working, which is a technical limitation rather than a choice on our part. We honour your consent selections consistently across the site and re-request consent if we introduce a new category of cookie.
In short: we set only a handful of cookies, none of them belong to advertising networks, and everything optional waits for your explicit "accept". The Cookie Policy page is the single place to see and change every choice.
We want to know whether the platform works well — not who you are. Our analytics practice is built around that distinction. We use a privacy-respecting, first-party analytics configuration that measures the platform in aggregate rather than tracking individuals across the web.
Concretely, our analytics setup has the following properties:
We occasionally run A/B experiments — for example, testing whether a redesigned lobby helps new players find games faster. Participation is determined by a random technical identifier, results are analysed only in aggregate, and no experiment ever varies the fairness or behaviour of game outcomes, which remain governed by the same certified random processes for every player.
We divide the messages we send into two strictly separated streams, because Canadian law — and basic respect — treats them very differently.
These are messages the service cannot responsibly operate without: email verification when you register, password reset links you request, security alerts when we detect a sign-in from an unfamiliar device, receipts for optional membership payments, responses to your support enquiries, and legally required notices such as material changes to this policy. Because these messages are part of delivering the service you asked for, they are sent to all registered members and cannot be opted out of while your account remains open. We keep them infrequent, factual, and free of promotional content.
Our newsletter covers new game releases, seasonal events, and community highlights. It is strictly opt-in: you receive it only if you ticked the unticked newsletter box at registration or subscribed later from your account settings. In compliance with Canada's Anti-Spam Legislation (CASL) and PIPEDA's consent principle:
We do not send SMS marketing, we do not make marketing phone calls, and we do not permit third parties to send communications to our member list under any arrangement.
PIPEDA's safeguards principle requires security protections appropriate to the sensitivity of the information held. Although we intentionally hold little sensitive data, we secure what we do hold to a high standard, using layered technical, administrative, and physical measures.
We maintain a written incident response plan that is rehearsed, not merely filed away. If we discover a breach of security safeguards involving your personal information, we will assess whether it creates a real risk of significant harm as defined by PIPEDA. Where it does, we will report the breach to the Office of the Privacy Commissioner of Canada, notify affected individuals as soon as feasible with clear guidance on protective steps, notify any other organisation that can reduce the harm, and record the breach in the register we are required to maintain. We follow this process regardless of whether the incident originated inside our systems or at a service provider.
No security programme can promise absolute immunity — anyone who claims otherwise is not being honest with you. What we promise is diligence: proportionate defences, honest and prompt notification if something goes wrong, and continuous improvement of our safeguards as threats evolve.
Under PIPEDA you hold meaningful, enforceable rights over your personal information, and we have built account tools and internal processes to honour them. You do not need a lawyer or a formal template to exercise any of these rights — an email to the address in Section 13 is enough.
To protect your information from impostors, we verify identity before acting on access, correction, deletion, or portability requests — usually by confirming control of the email address on the account. We apply the same verification standard to authorised agents acting on your behalf.
Quick reference: access, correction, deletion, and portability requests go to support@truenorthdrawson.com with the subject line "Privacy Request". We acknowledge within two business days and resolve within the thirty-day statutory window, almost always sooner.
PIPEDA's limiting retention principle requires that personal information be kept only as long as necessary for the purposes for which it was collected. We apply that principle through a documented retention schedule with automated enforcement — deletion happens because a system runs, not because someone remembers.
Where litigation, a regulatory investigation, or a lawful demand requires us to preserve specific records beyond these periods, we place a targeted legal hold on only the records concerned and resume normal deletion when the hold ends. Backups are encrypted and cycle out on a fixed schedule, so data deleted from live systems disappears from backups within that cycle rather than lingering indefinitely.
True North Drawson is a Canadian company serving a Canadian audience, and we have made a deliberate architectural choice to match: our production servers, databases, and primary backups are located in data centres within Canada. For the overwhelming majority of processing, your personal information never leaves the country.
A small number of specialised service providers — identified by category in Section 11 — may process limited data on infrastructure located outside Canada, most commonly in the United States or the European Union. Where that happens, we apply the safeguards PIPEDA expects of an accountable organisation:
You should be aware that personal information stored or processed in a foreign jurisdiction is subject to the laws of that jurisdiction, and in limited circumstances its courts, law enforcement, or national security authorities may be able to compel disclosure. This is true of every online service that uses any international provider, and we mitigate it by keeping core data in Canada and minimising what crosses the border. If you would like to know which categories of your information, if any, are processed abroad, our Privacy Officer will tell you on request.
We do not sell personal information. We have never sold personal information. We will never sell, rent, lease, or trade personal information to anyone, for any consideration, monetary or otherwise. That commitment is unconditional and survives any change in management, strategy, or fashion in the advertising industry.
What we do — like every online service — is rely on a small number of carefully selected service providers who process limited data strictly on our behalf and under contract. The categories are:
Every provider is bound by a written agreement covering confidentiality, security safeguards, breach notification to us without undue delay, deletion or return of data at the end of the engagement, and a prohibition on engaging sub-processors without equivalent obligations. We review this roster periodically and remove providers whose practices no longer meet our standard.
Beyond service providers, we disclose personal information only where the law compels or clearly permits it: in response to a valid Canadian court order, warrant, or statutory demand; to detect, suppress, or prevent fraud against the platform; to protect the safety of an individual where urgency demands it; or, in the event of a merger or sale of the business, to a successor bound to honour this policy, with notice to you before any new practice takes effect. We scrutinise every legal demand for validity and scope, and we disclose the narrowest set of records that satisfies a valid demand.
True North Drawson is an adults-only platform. Although no real money is involved, our games simulate casino-style entertainment, and we hold the firm view that such content is not appropriate for minors. Access is therefore restricted to individuals who are at least 18 years of age, or the age of majority in their province or territory of residence if it is higher — 19 in British Columbia, New Brunswick, Newfoundland and Labrador, Northwest Territories, Nova Scotia, Nunavut, and Yukon.
We put that policy into practice as follows:
The Office of the Privacy Commissioner of Canada has consistently taken the position that the personal information of minors is particularly sensitive and that meaningful consent from young people is difficult to establish. We agree, and our answer is not to attempt clever consent mechanisms for young users, but simply not to serve them at all.
Questions, concerns, access requests, correction requests, deletion requests, complaints, and compliments about this Privacy Policy or our data practices all go to the same place, and a human being — not an unattended mailbox — reads them:
We acknowledge privacy correspondence within two business days and provide a substantive response within thirty days, the maximum period PIPEDA allows. If a request is unusually complex and we need to extend that period in the narrow circumstances the Act permits, we will tell you before the original deadline expires, explain why, and give you the new date.
If, after working with our Privacy Officer, you believe your concern has not been resolved, you may contact the Office of the Privacy Commissioner of Canada, which oversees compliance with PIPEDA and provides a free, independent complaint process. Nothing in this policy limits any right you hold under the laws of Canada or of your province or territory, and where provincial private-sector privacy legislation declared substantially similar to PIPEDA applies to you, we honour whichever standard gives you the stronger protection.
Thank you for taking the time to read this policy. Privacy documents are usually written to be skimmed; we wrote this one to be understood, because informed players are exactly the kind of community we want at True North Drawson.
