Privacy Policy

Storm Developments
Storm Buckets - S3-Compatible Object Storage

Effective Date: 06/06/2026
Last Updated: 07/11/2026

1. Who We Are

Storm Developments is a Canadian cloud infrastructure company based in Ontario, Canada. We operate Storm Buckets, an S3-compatible object storage service hosted on Canadian infrastructure.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use Storm Buckets, and what rights you have over that information.

Privacy Officer and Contact:
Mathew Storm
Storm Developments
Ontario, Canada
contact@stormdevelopments.ca

2. Our Commitment

Storm Developments operates under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and its ten fair information principles, which form the foundation of this policy.

We collect only what we need. We keep it only as long as necessary. We do not sell it. We do not share it except as described in this policy.

3. What Personal Information We Collect

We collect only the personal information necessary to provide and operate Storm Buckets.

Account information:

Your email address
Your chosen username
Your password (stored as a one-way hash, which we cannot reverse)
Account creation date

Usage and technical information:

IP address at the time of login and API requests
Browser user agent and referring page, captured when an account signup or login is attempted. We use these to distinguish real signups from automated abuse. Kept for up to 90 days.
Bucket names and storage usage metrics (object count, total size)
Access key names and permissions (secret key values are shown once at creation and are not displayed again; see Section 9)
A record of every change to your storage capacity. Each entry stores a reason category (for example, founding alpha, a feedback bounty, a paid plan change, or a manual adjustment), the amount of capacity added or removed, and the date. This history is the source of truth for how much storage your account has, and you can view it on your profile. It holds no free-text content. We keep it for as long as your account exists, and delete it in full when you close your account.
Timestamps of account activity

Support communications:

Any information you provide when contacting us by email
Product feedback you submit through the dashboard's feedback form (a category and your written message, tied to your account so we can act on it). Feedback is deleted 90 days after we mark it handled, and immediately if you close your account. Any image you flag as containing personal information is destroyed as soon as we resolve the thread; every attached image is destroyed within 90 days of upload regardless.
In-app notifications we send you about your own account, such as when we resolve a piece of your feedback. Each one stores the message we showed you, when it was sent, and whether you have read or saved it, tied to your account. We record no IP, device, or location data with a notification. A notification is deleted 90 days after it is sent unless you save it, immediately when you clear it yourself, and immediately if you close your account.

What we do not collect:

The content of files you store in Storm Buckets. We do not read, index, or analyze your stored data, with one narrow exception: our Import and Backup features. If you use them to copy data from an external S3-compatible bucket, our infrastructure reads that data to copy it into your Storm bucket, and if you request a restore test afterward, it reads a small sample of the copied files to verify the transfer worked. This only happens for a transfer or test you start yourself, or a backup schedule you configured, and we do not index, analyze, or retain that content beyond completing the operation.
Payment information directly. Storm Buckets is free during the alpha period; when paid plans launch, payments are processed by Stripe and are not stored on our servers (see Section 8).
Tracking cookies or third-party analytics data
Location data beyond IP address

4. Why We Collect It

We collect and use your personal information for the following purposes only:

To provide the service: creating and managing your account, authenticating access, serving your stored data
To operate and maintain infrastructure: monitoring storage usage, enforcing quotas, diagnosing and fixing technical problems
To communicate with you: sending service notices, responding to support requests, notifying you of changes to these terms or the service
To enforce our Terms of Service: investigating violations of our Acceptable Use Policy
To comply with legal obligations: responding to lawful requests from Canadian government authorities

We will not use your personal information for any purpose not listed here without first obtaining your consent.

5. How We Collect It

We collect personal information:

Directly from you when you register an account or contact us
Automatically when you use the service (IP addresses, usage metrics, access logs)

We do not purchase personal information from third parties or collect it from external sources.

By creating an account, you consent to the collection, use, and storage of your personal information as described in this policy.

You may withdraw consent at any time by closing your account. Withdrawal of consent means we will delete your personal information in accordance with Section 10 of this policy, and you will no longer be able to use Storm Buckets.

To provide you with the service, some data collection is necessary and cannot be opted out of while you remain a user.

7. Where Your Data Is Stored

All personal information and stored data is hosted on servers physically located in Canada, operated by Storm Developments.

We do not transfer your stored files to servers outside Canada.

Our compute servers run on dedicated hardware leased from Canadian Web Hosting in British Columbia. Your stored files reside on storage hardware leased from ServaRica in Montreal, Quebec. Both providers operate entirely within Canada. Storm Developments controls the operating system and all software running on this hardware. The providers supply physical hosting and network connectivity, and do not have logical access to your account data or stored files.

Some limited operational processing involves third-party service providers, listed in Section 8. Where any such provider operates outside Canada, we identify it there. We remain accountable for the protection of your personal information under applicable Canadian law.

Visitors to customer-hosted websites: Storm Buckets can serve a customer's bucket as a public website. When it does, our infrastructure logs the IP addresses of visitors to that website for traffic metering and abuse protection. These logs follow the same retention as all access logs: deleted within 90 days (Section 10). We do not use them for any other purpose. The customer who operates the website is responsible for their own site's privacy notice to its visitors.

We do not sell your personal information. We do not share it with advertisers, data brokers, or marketing platforms.

We may share your personal information only in the following limited circumstances:

Legal requirements: if required by a valid Canadian court order, warrant, or other lawful legal process, we may be required to disclose account information. Where permitted by law, we will notify you before complying.
Safety: if we have a good-faith belief that disclosure is necessary to prevent imminent harm to a person, we may share relevant information with appropriate authorities.
Business transfer: if Storm Developments is acquired or its assets are transferred, your information may be transferred as part of that transaction. We will notify you before this occurs and you will have the opportunity to close your account.
Payment processing: we use Stripe to process payments on paid plans. Your payment information is collected and processed directly by Stripe and is not stored on our servers. Stripe is a US-based service, and its privacy policy applies to payment data. See stripe.com/privacy.
Email delivery: we use Resend to deliver the emails we send you (service notices and, if you subscribed, our newsletter). Your email address and the message content pass through Resend to reach you. Resend is a US-based service, and its privacy policy applies to email delivery. See resend.com.

We will not share your information beyond what is described above.

9. How We Protect Your Information

We take reasonable technical and organizational measures to protect your personal information, including:

Passwords are stored as one-way hashes and cannot be reversed
All connections to Storm Buckets use TLS encryption in transit
Secret keys are shown once at creation and are not displayed again. To authenticate your requests, a secret key is held on our servers and is used only for that purpose, never to access the content of your stored files.
The administrative dashboard Storm staff use to operate the service cannot create access keys, attach keys to your buckets, or display your keys. Those operations are blocked in our control plane, and any administrative action taken on an account is recorded in an internal audit log.
Storm does not access the content of your files to operate the service, with two exceptions. First, features you run yourself that require it: our Import and Backup features read data from an external bucket to copy it into your Storm bucket, and an optional restore test reads a small sample of the copied files to verify the transfer. These only happen for an operation you start or a backup schedule you configured, and we do not index, analyze, or retain that content beyond completing it. Second, we may access, restrict, preserve, or remove content where required by law or to address illegal or abusive use, as described in our Terms of Service. Any such administrative action is recorded in our internal audit log.
Access to production systems is restricted to authorized personnel
Infrastructure management uses mutual TLS and HMAC-signed commands via Storm Pulse

No system is completely secure. If we become aware of a breach of security safeguards that creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as required by PIPEDA, and keep a record of the breach.

10. How Long We Keep Your Information

We retain your personal information for as long as your account is active.

When you close your account:

Your stored files and buckets are deleted from our storage infrastructure within 30 days
Your account record (email, username, usage history) is deleted within 30 days
Access logs may be retained for up to 90 days for security and fraud investigation, after which they are deleted
Where an activity or audit record is kept longer than 90 days (for example, your account activity history or our internal audit trail), the IP address is removed from that record after 90 days. IP addresses are not retained beyond 90 days even when the surrounding record is kept.
Your capacity grant history is deleted together with your account record. It is not kept on a separate timer; it exists only for as long as your account does.
If you use our Import feature, we keep a record of each import plan (which buckets, when, how long each step took, whether it succeeded) so you can check its status and history. This record is deleted together with your account record, on the same timeline, not on a separate timer. We do not keep the external access credentials you enter to start an import; they are used once, in memory, to run the import you requested, and are discarded when it finishes or times out, regardless of outcome.
If you set up our Backup feature, we store the access credential for your external source so scheduled runs can use it. It is encrypted at rest, used only to run the schedule you configured, and never written to logs. Disconnecting the source or deleting the backup setup destroys the credential immediately; closing your account destroys it with the rest of your data. We keep a record of each backup run (which buckets, when, whether it succeeded); run records are deleted after 90 days, and the whole history is deleted with your account.

We delete your data on these timelines except where we are required by law to preserve it, such as a preservation demand, a court order, or our mandatory reporting obligations for illegal content. In those cases we keep only the data the law requires, only for as long as it requires, and then delete it.

We do not retain backups of deleted data beyond these periods.

11. Your Rights Under PIPEDA

You have the following rights regarding your personal information:

Access: you have the right to request a copy of the personal information we hold about you. We will respond within 30 days of receiving a written request. We may charge a minimal administrative fee as permitted under PIPEDA. You can also download your account's activity history (the access-log and audit entries shown in your dashboard) yourself, at any time, as a structured file from the dashboard. The copy you download is yours to safeguard once it leaves our systems.
Correction: if any personal information we hold about you is inaccurate or incomplete, you have the right to request that we correct it.
Deletion: you may request deletion of your personal information by closing your account or by contacting us directly. See Section 10 for deletion timelines.
Withdrawal of consent: you may withdraw consent for any non-essential processing at any time. See Section 6.
Complaint: if you believe your privacy rights have been violated, you may file a complaint with the Office of the Privacy Commissioner of Canada:

Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Quebec K1A 1H3
priv.gc.ca
1-800-282-1376

To exercise any of these rights, contact us at contact@stormdevelopments.ca. We may ask you to verify your identity before processing your request.

12. Cookies

Storm Buckets uses a session cookie to keep you logged in to the web dashboard. This cookie is:

Strictly necessary for the service to function
Not used for tracking or advertising
Deleted when you log out or your session expires

We do not use third-party cookies, analytics cookies, or advertising cookies.

13. Children's Privacy

Storm Buckets is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from minors. If you believe we have collected information from a minor, contact us immediately at contact@stormdevelopments.ca and we will delete it.

14. Working Toward Quebec's Law 25

This policy reflects our obligations under PIPEDA, which governs us today. We are working toward alignment with Quebec's Law 25 (the Act respecting the protection of personal information in the private sector). We do not yet claim Law 25 compliance.

Steps we are working toward:

A French-language version of this policy and of the service
Written data processing agreements with the service providers that process personal information on our behalf
A privacy impact assessment before any transfer of personal information outside Quebec
A confidentiality-incident register, and notification to the Commission d'accès à l'information where an incident presents a risk of serious injury
Support for data portability

We already designate a named Privacy Officer (Section 1) and limit how long we keep personal information (Section 10).

Until these are in place, this policy and our PIPEDA obligations govern.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top and notify you by email at least 14 days before changes take effect, except where changes are required immediately by law.

Your continued use of Storm Buckets after changes take effect constitutes acceptance of the updated policy.

16. Contact and Complaints

If you have any questions about this Privacy Policy or how we handle your personal information, contact our Privacy Officer:

Mathew Storm
Storm Developments
Ontario, Canada
contact@stormdevelopments.ca

We will respond to all privacy inquiries within 30 days.