Privacy and your information

This page covers three sites: thedeckprofessor.com, godecks.ca and edmontondeckbuilder.com. Kehew Construction Ltd, of Edmonton, Alberta, runs all three and is responsible for the personal information they collect.

Every page and every tool works without an account.

Who answers your questions

Privacy officer, Kehew Construction Ltd: office@kehew.ca. Ask about anything on this page, including what Google and Microsoft handle for us.

When you open any page

• Like every web server, the server that runs these sites records each request: the time, the page, your IP address and the name of your browser. Our web host, MochaHost, keeps these records for the period its servers are set to.
• Apart from the security records described below, we keep nothing else about you unless you sign in, comment or send an enquiry.

If you sign in

Signing in is optional, with Google or with Microsoft.

• From Google: your name, your email address, whether Google has checked that address, the account number Google gives this site, the address of your profile picture, and your Google Workspace domain if your account has one.
• From Microsoft: your name, your email address, your Microsoft user name, the ID of your organisation, and the account number Microsoft gives this site.
• Each sign-in: the time, the site, Google or Microsoft and the way you signed in, your account number, name and email address, your IP address, the name of your browser, and whether you are an admin.
• Each sign-out: the time, the site and your account number.
• A sign-in that fails: the time, the site, Google or Microsoft, the reason, your IP address and the name of your browser. It is kept with the security records below.
• Your last sign-out time, filed under a hash of your account number, so that signing out ends your sign-in in every browser.

Your profile

When you sign in, the site makes you a profile on that site. Find it under My profile in the account menu.

• From your sign-in: your name, email address and account number, and whether you used Google or Microsoft.
• Details you choose to add: a display name, phone, street address or area, how you would like to be reached, and notes.
• Property profiles you make: each one's name, its address if you give it (for someone else's home, only with their permission), its tags and notes, and when you ticked that it is your property or its owner agreed.
• Designs you save to your profile from a designer: the design, its name, property and tags, and when you saved it. From godecks.ca, the house and contact details typed into the design go with it only if you tick that box.
• When you first and last visited.
• Only you and the site owner see it, and someone who acts for Kehew Construction Ltd if he allows it.

Activity statistics

While you are signed in, unless you turn it off, the site records what you do there under your name, so the site owner can see what each member uses and improve the sites.

• Each page you open, with its address and title. Each time you save, open, change or delete a design or a property profile, change your details, apply a part card to a design, or send an enquiry. Each record holds the time, the page and a short label, never what you type.
• The account menu tells you the first time you sign in, and nothing is recorded before that.
• Turn it off or on again in the account menu or on My profile. Turning it off stops the record and deletes what was recorded. Your sign-ins and the time of your last visit are still kept, as above.
• While you are signed in, each page you open also adds one to that page's count for the day. The count holds nothing about you, and it counts your visits whether statistics are on or off.
• Only the site owner sees it, and someone who acts for Kehew Construction Ltd if he allows it.

If you comment

Only the site owner, and the people he makes admins or commenters, can comment.

• Your comment, the page and the part of the page it is about, the time, your window size and browser, and your name, email address, account number and role.
• The owner of that site, and anyone he allows to see members' information, can read every comment on it with its author's name and email address. Other admins see each comment with its author's name only, and commenters see comments without names.
• Copies are kept in our own working files, to improve the sites: the site owner's own comments in full, everyone else's with the author's name only and a hash of their account number, which is not secret: anyone who has the number could match it.

If you send an enquiry

These are the enquiry forms on the contact and design pages of edmontondeckbuilder.com.

• What you type: name, email address, phone, town or neighbourhood, timing, budget and message.
• Sent with it automatically: the page, the page you came from, your IP address, browser, language, time zone, screen and window size, and the deck design saved in your browser if you made one.

Kept only in your browser

• Designs, lists, practice decks, settings and the look you choose are saved in your own browser, on your device. A design reaches us only when you save it to your profile, or when you send an enquiry on edmontondeckbuilder.com: the deck design saved in that browser then goes with it automatically. When you open a design saved in your profile, the design in your browser is saved there first, without its house and contact details, so it is never lost.
• If you sign in, your browser also keeps a note that you are signed in, and your sign-in choices.
• An admin's comment that is not saved yet waits in the browser until it is.
• Clearing this site's data in your browser removes all of it. Signing out does not.

Cookies

• One sign-in cookie, only if you sign in, signed so it cannot be altered. It lasts 30 days after your last visit, never more than 90 days after you signed in, or until you sign out. It holds:
  • Your name, email address and account number, and whether you used Google or Microsoft.
  • From Google: your picture address, whether Google has checked your email address, and your Google Workspace domain if you have one.
  • From Microsoft: your user name and the ID of your organisation.
  • A random number for this sign-in, the time you signed in, the time it was last renewed, and the time it ends.
• Short cookies while a sign-in is under way, each lasting at most 10 minutes.
• No advertising cookies, and no tracking by other companies. While you are signed in, the sign-in cookie is also how the activity statistics and page counts above know you are signed in. Google and Microsoft set their own cookies on their own sign-in pages and buttons.

Where it is kept and for how long

• Where: on each site's own web server, rented from MochaHost. Sign-in records, profiles, saved designs, statistics, roles and comments are in private files outside the public web folder.
• Enquiries are kept outside the public web folder when the host allows it. If it does not, they are kept in a folder inside it, with a setting that tells the web server to refuse every request for that folder.
• Web server records of each request: kept by MochaHost for the period its servers are set to.
• Sign-in records: kept until the site's sign-in file reaches about 1 megabyte. That file is then set aside, and the one set aside before it is deleted, so the oldest records go as new ones arrive.
• Sign-out times: 90 days.
• Your profile, property profiles and saved designs: until you delete them or your account, or 3 years after your last visit. Copies in our web host's backups go when those backups are replaced.
• Activity statistics: 180 days, or until you turn them off. Daily totals with no names in them, and page counts, are kept.
• Roles the site owner gives: while they last. The record of each change (who made it, when, and from what to what) is kept; if you delete your account, your name in it is replaced.
• IP addresses kept to stop floods of requests: each only as a hash that could be turned back into the address, for 10 minutes for sign-in, profiles, comments and the admin pages, and 1 hour for enquiries. A signed-in member's page views are limited by a hash of the account number instead, kept 10 minutes; it is not secret, so anyone who has the account number could match it.
• Sign-out times and these hashes are removed the next time the site updates that file, so they can last longer while the site is quiet.
• Comments and enquiries: until they are deleted. There is no automatic deletion date.
• Ask, and we delete your comments, enquiries and sign-in records sooner. Signed in, you can delete your account and its data yourself, on My data; enquiries and copies of comments in our working files are deleted when you ask. Security records are kept for 90 days, then deleted; they are not deleted on request, because they protect the sites: deleting them would let someone erase the record of their own attack.

Companies in the United States that handle it for us

• MochaHost, run by World Host Group US Inc., a company in Delaware, United States. It rents us the servers these sites run on, so it holds everything kept on them, profiles and statistics included. Its backups may be kept in another country.
• Google, if you sign in with Google. It sees your IP address and browser, and tells this site what is listed above under From Google.
• Microsoft, if you sign in with Microsoft. It sees the same, and tells this site what is listed above under From Microsoft. Microsoft also runs the office@kehew.ca mailbox.
• Google Fonts. Most pages load their typefaces from Google, so Google sees your IP address and browser when a page opens.
• Google Drive, where our working files are kept, including copies of comments.
• Information handled in the United States can be reached by courts and authorities there, under United States law.
• This section is our written policy on these companies: who they are, which countries, and why. Ask the Privacy officer for a copy, or with any question about them.

What it is used for

• Sign-in: recognising you when you come back, and switching on comment mode for admins.
• Your profile, property profiles and saved designs: keeping your work for you between visits.
• How to reach you: if you choose email or phone, the site owner may contact you that way about your deck. Choose Do not contact me and he will not.
• Activity statistics and page counts: seeing which pages and tools are used, and what each member does, to improve the sites.
• Roles: who may comment and open the admin pages.
• Comments: improving the sites.
• Enquiries: answering you about your deck.
• IP addresses and browser details: keeping the sites secure, stopping abuse and fixing problems.
• Nothing is sold or used for advertising. It is shared only with the companies above or when the law requires it; the security records below may also be given to MochaHost or the police to investigate an attack.

Security records

Each site keeps its own record of requests that look like an attack on it or that it refuses, whether or not you sign in. Only the site owner can see these records.

• What counts: addresses that only attack tools ask for, text in an address that tries to break into a site, browsers that name themselves as attack tools, requests for files the server refuses or that our web host's firewall blocks, missing pages (each one is counted under your IP address for that day), sign-ins that fail, requests the sign-in, comment, member, admin and enquiry services refuse, enquiry forms filled in by robots, and an admin signing in from an IP address that admin has not used before.
• What each record holds: the time, the site, the kind of request, your IP address, the name of your browser, the page address asked for, and why it was refused or what it looks like. After a question mark in an address, only the names of the form fields are kept, never what was typed into them. Never your cookies, your passwords or anything else you send.
• When an admin signs in from a new IP address, the record also holds that admin's name and account number, and whether Google or Microsoft was used. A scrambled form of the IP address is kept to recognise it next time, until 90 days after that admin last used it.
• To notice someone trying address after address, each site counts the requests from each IP address over 10 minutes, under a scrambled form of the address, with up to three of the page addresses asked for. These counts start again every 10 minutes and are cleared once a day.
• Each site also counts, for each day, the requests of each kind from each IP address, including those it does not record one by one, so the owner sees who tried what even during a flood of requests. At the end of the day these counts join that day's records, so even a single missing page is kept under your IP address for 90 days.
• Kept for 90 days, then deleted, together with the summary of each day that the owner's security page keeps so it opens quickly. Deleting happens the next time the site's own code runs, so on a quiet site any of these can last a little longer.
• When something looks like an attack, and once a day while there is anything to report, the site emails a short notice to the owner's mailbox, which Microsoft runs, where they stay until he deletes them. It holds counts, kinds of request, times and page addresses, with IP addresses shortened, never a full IP address, a browser name (apart from the name of an attack tool a request gives itself) or a person's name.
• Why: keeping the sites secure, and investigating an attack.
• They may be given to our web host, MochaHost, or to the police, to investigate an attack.
• These records are kept by IP address, not by account. To ask what is kept about your IP address, write to us as below, with the IP address and the dates.

See, correct or delete your information

• Signed in, open My data from the account menu: it shows what that site keeps under your account, downloads it as one file, and deletes your account and that data if you ask it to. Enquiries, security records and copies of comments in our working files are not on it: ask for them by email, as below. Change your details on My profile.
• Email office@kehew.ca with the subject My information. Say which site, and write from the email address you used there if you can. We may ask you to confirm it is you.
• We answer within 30 days.
• Sign out at any time from the account button at the top of the page. Signing out ends your sign-in on that site in every browser.

If there is a breach

If a breach puts you at real risk of significant harm, we tell you and the Information and Privacy Commissioner of Alberta.

Updated: October 3, 2026.