OneFeather Privacy Policy
Effective: November 1, 2026
Last Modified: November 1, 2026
1. Introduction
OneFeather Mobile Technologies Ltd. (“OneFeather”, “we”, “us”, or “our”) provides digital services designed to support Indigenous individuals and Nations in accessing financial products, governance tools, and identity-related services.
This Privacy Policy describes how OneFeather collects, uses, shares, and protects personal information in connection with our websites, applications, and related online and offline services (collectively, the “Services”). The Policy applies to any interaction you have with OneFeather through the Services, including creating an account, using our applications, participating in programs, or otherwise engaging with us.
We may update this Privacy Policy from time to time to reflect changes in our Services, legal requirements, or business practices. The most current version of this Privacy Policy will be made available through the Services, and the effective date will be updated accordingly. Where required by law, we will provide notice of material changes. By continuing to use the Services after an update, you acknowledge that you have reviewed the most recent version of this Privacy Policy.
OneFeather handles personal information in accordance with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial legislation, where applicable.
2. Overview of OneFeather Services
OneFeather operates multiple digital services designed to support Indigenous individuals and Nations through different types of activities, including financial services, governance and community participation, and identity-related processes.
Because these services serve different purposes and user groups, OneFeather’s data practices vary depending on the service context. The type of personal information collected, how it is used, and with whom it may be shared depends on the specific service a user chooses to access. This Privacy Policy is structured to reflect those differences and to explain how personal information is handled within each service context.
At a high level, OneFeather’s services include:
-
Financial and payment services, such as prepaid card programs, account and wallet functionality, rewards programs, and related regulatory compliance activities;
-
Member account and participation services, which allow individuals to create and manage OneFeather user accounts that serve as access points to OneFeather services, and to participate in activities such as digital voting and community engagement when linked to a Nation;
-
Nation governance and administration services, which support Indigenous Nations in managing elections, membership, documents, and community interactions; and
-
Status card application services, which support the submission and processing of Indigenous Status card renewals and replacements.
The sections that follow describe how personal information is handled within each of these service categories.
3. General Data Practices Applicable to All Services
This section describes data practices that apply across all OneFeather services, regardless of the specific service context.
3.1 Information Collected Automatically
When you use OneFeather services, certain information may be collected automatically to support functionality, security, and performance. This may include technical and usage information such as device type, operating system, application version, timestamps, log files, error or crash reports, and similar diagnostic information. IP addresses or network-related information may also be collected to support security, fraud prevention, and system integrity. Where collected, such information is used for operational and security purposes and not to profile individual users for advertising.
3.2 Cookies and Similar Technologies
OneFeather’s websites may use cookies and similar technologies to support site functionality, security, analytics, and user experience. Cookies are small text files placed on a user’s device that allow websites to recognize a browser or device and remember certain information.
We may use cookies or similar technologies to understand how users interact with our website, improve performance, analyze usage patterns, and support security and fraud prevention. For example, we may use analytics tools to collect information about website traffic and engagement in an aggregated manner.
Users can manage or disable cookies through their browser settings. Additional information about cookies used on our website may be provided through notices displayed on the site.
3.3 Support and Communications
When you contact OneFeather for support or assistance, such as by email, in-app messaging, or other communication channels, OneFeather may collect and retain the information you provide, including contact details and the content of your communications. This information is used to respond to inquiries, provide support, troubleshoot issues, and improve service quality.
3.4 Security, Fraud Prevention, and Integrity
Across all services, OneFeather uses personal information and technical data to protect users, prevent fraud or misuse, enforce security controls, and maintain the integrity of its platforms. This includes monitoring for suspicious activity, investigating potential violations, and supporting audits or compliance reviews where required.
4. Legal Disclosures and Compliance Obligations
OneFeather may disclose personal information where required or permitted by law in order to comply with legal, regulatory, or compliance obligations.
This may include disclosures made to regulators, law enforcement agencies, courts, or other authorized bodies where such disclosure is necessary to comply with applicable laws, regulations, court orders, subpoenas, warrants, or lawful requests. In the context of financial and payment services, this may also include disclosures required to meet anti-money laundering, counter-terrorist financing, fraud prevention, or reporting obligations.
OneFeather may also disclose personal information where necessary to protect the rights, safety, or security of OneFeather, its users, Indigenous Nations using its services, or the public, or to investigate and prevent fraud, misuse, or violations of applicable agreements.
Where appropriate and permitted by law, OneFeather will limit such disclosures to the information reasonably necessary for the identified purpose.
5. Financial and Payment Services
This section applies to OneFeather’s financial and payment-related services, including prepaid card programs, account functionality, rewards programs, regulatory compliance activities, and any optional government payment or annuity programs that users may choose to participate in.
5.1 Purpose of the Service
OneFeather provides financial services to enable users to access prepaid card products, make and receive payments, and participate in optional programs such as rewards. These services are subject to financial services, anti-money laundering, and identity verification obligations.
5.2 Information We Collect
In connection with financial and payment services, OneFeather collects personal information that users choose to provide when registering for an account, enrolling in card-related programs, or interacting with financial features. This may include contact details, enrollment information, and account-related preferences.
OneFeather collects personal information necessary to verify identity, administer accounts, issue payment cards, process transactions, and comply with regulatory requirements. This may include identity and contact information, government-issued identification details, date of birth, address information, and account credentials. To meet anti-money laundering and regulatory obligations, OneFeather may also collect information such as occupation or employment-related information and the intended use of the account.
In connection with card-linked rewards or loyalty programs, OneFeather collects and generates program enrollment information, which may include enrollment status, participation consents, rewards balances, redemption activity, and program-related preferences.
OneFeather also collects transaction and program activity information generated through the use of financial services, including payment activity associated with eligible card usage, balances, rewards accrual, redemptions, and related operational or reporting records.
5.3 Identity Verification Process
OneFeather performs identity verification using Canada Post Identity+ in order to meet legal, regulatory, and fraud-prevention requirements.
Identity verification may be completed through one of two methods:
Online Verification. Users submit images of government-issued identification and, where required, a selfie through the OneFeather mobile application. Canada Post Identity+ performs document validation, image quality checks, biometric matching, and compliance checks. Verification results and extracted identity attributes are returned to OneFeather.
In-Person Verification (Fallback). Where online verification cannot be completed, users may complete identity verification in person at a Canada Post retail location. In this case, Canada Post provides the required privacy notice at the point of service and confirms the user’s identity without transferring identification images to OneFeather.
Canada Post Identity+ acts as an identity verification service provider and processes personal information solely for the purpose of completing identity verification on OneFeather’s behalf.
5.4 Information Sharing
To deliver financial and payment services, OneFeather shares limited personal information with trusted service providers and partners for specific purposes and in accordance with applicable law.
Canada Post Identity+ acts as an identity verification service provider and processor on OneFeather’s behalf. Personal information processed through Canada Post Identity+ remains under the control of OneFeather and is used by Canada Post solely to provide identity verification services in accordance with contractual and legal requirements.
Payment Network and Issuing Bank Partners may receive transaction-related and account information as required to enable payment processing, card issuance and administration, regulatory compliance, and participation in card-related programs.
Government Program Partners. Where users choose to participate in optional government payment or annuity programs, such as Treaty Annuity Payment (TAP) initiatives, OneFeather may share limited personal information with relevant government entities, including Indigenous Services Canada, for the purpose of verifying eligibility, confirming entitlement, and administering payments. Information shared for these purposes may include identifiers such as name, date of birth, registry or status number, or other information required by the applicable program.
OneFeather does not sell personal information.
6. Member Account and Participation Services
This section applies to OneFeather’s Member Account and Participation services, which allow individuals to create and manage OneFeather accounts and access participation-based services such as digital voting and community engagement.
6.1 Purpose of the Service
OneFeather enables individuals to create a OneFeather account that serves as an access point to OneFeather services. Users can manage their account, participate in digital voting or community events offered by their Nation, and access other OneFeather services, such as financial products or status card applications, where applicable.
6.2 Information We Collect
OneFeather collects account and profile information such as name and contact details. OneFeather may also generate participation-related information, such as records confirming eligibility to vote, voting participation metadata, and system activity associated with secure access and authentication.
Where users participate in digital voting or community events, OneFeather may collect technical and security-related information, such as device or connection information, to protect the integrity of voting processes and prevent misuse. This information is used for security purposes and is not used to determine how an individual voted.
6.3 How We Use This Information
Information collected is used to create and manage user accounts, authenticate users, enable participation in voting or community activities, support access to OneFeather services, and maintain the security and integrity of the platform.
6.4 Information Sharing and User Consent
Where users choose to access financial services or status card services, certain account information may be used to facilitate access to those services, subject to the privacy practices applicable to each service.
Information may also be shared with Nation governance services to support voting, membership verification, and community administration. Such sharing is limited to the information necessary for the relevant purpose.
7. Nation Governance and Administration Services
This section applies to OneFeather’s Nation Governance and Administration services, which support Indigenous Nations in administering governance activities and engaging with their members through a secure digital platform.
7.1 Purpose of the Service
OneFeather Nation Services enables Indigenous Nations to manage governance-related activities such as elections and voting, registry and membership administration, secure document sharing, and community engagement. These services are designed to support Nation-led governance while preserving the confidentiality and integrity of member participation.
7.2 Information We Collect
OneFeather processes information necessary to support governance functions. When a member chooses to link their OneFeather account to a Nation or participate in Nation governance services, certain account information —such as names or contact details required for verification, communications, or participation eligibility— may be made available to that Nation as part of the member’s use of the service. This sharing is limited to the information required for the relevant purpose.
In some cases, Nation administrators may upload membership lists to the platform for the purpose of administering governance activities. This information may include member identifiers such as name, date of birth, registry or status number, to verify eligibility and administer participation.
Nation administrators may also upload or manage Nation-defined administrative data about their members for governance and administrative purposes.
When elections or voting activities are conducted, OneFeather may collect technical and security-related information, such as system logs or IP addresses, to protect election integrity, prevent fraud, and support auditing. This information is used solely for security and integrity purposes and is not used to identify how an individual voted.
7.3 Voting Integrity and Confidentiality
OneFeather’s voting services are designed to preserve ballot secrecy. Voting results are processed in a manner that separates voter identity from ballot choices. Nation administrators may access aggregated results, statistics, or participation reports, but do not have access to information showing how specific individuals voted.
7.4 Information Sharing
Information processed through OneFeather Nations Services is accessible only to authorized Nation administrators and OneFeather personnel as required to operate and support the service. Access is limited by role, purpose, and applicable permissions. OneFeather does not sell or commercialize information processed or collected.
8. Status Card Application Services
This section applies to OneFeather’s Status Card Application services, which support applications, renewals, and replacements for Indigenous Status cards in coordination with Indigenous Services Canada.
8.1 Purpose of the Service
The Status Card Application service enables eligible individuals to apply for, renew, or replace Indigenous Status cards through a digital process. This service is designed to facilitate the secure submission of required information and documentation to Indigenous Services Canada for review and processing.
8.2 Information We Collect
Because of the nature of the Status Card Application process, this service involves the collection of more sensitive personal information than other OneFeather services. Depending on the type of application, the information collected may include applicant information such as full legal name, name at birth or alternate names, gender, date of birth, registry number, contact information, and other details required to process an application.
Where applicable, information about guarantors may be collected, including full name, date of birth, registry number, contact information, signature, and the length of time the guarantor has known the applicant. For dependent applications, information about dependents and parents or guardians may be collected, including names, dates of birth, registry numbers, and guardianship documentation where required.
This service also requires the collection of documents and images, such as identification photographs, name-linking documents, and selfies, in order to verify identity and support application processing.
8.3 How We Use This Information
Personal information collected through the Status Card Application service is used solely to process status card applications, renewals, and replacements and to securely transmit required information to Indigenous Services Canada. This information is not used for marketing, analytics, or unrelated OneFeather services.
8.4 Information Sharing
Information collected through the Status Card Application service is shared with Indigenous Services Canada for the purpose of reviewing and processing applications. This sharing occurs with the applicant’s authorization and is necessary to submit and administer the application on the applicant’s behalf.
Information collected through the Status Card Application service is not shared with Nation administrators or used in OneFeather’s voting, membership, or financial services unless a user separately and explicitly chooses to reuse information in another service.
9. Communications and Marketing
OneFeather communicates with users to provide account-related information, deliver services, and, where permitted by law and with appropriate consent, share updates or promotional information.
9.1 Account and Service Communications
OneFeather sends transactional and service-related communications that are necessary to deliver and operate its services. These communications are not optional and may include messages such as password resets, email or account confirmations, security notifications, election access credentials, voting confirmations, or election results. These communications are sent to ensure the proper functioning, security, and integrity of OneFeather services.
9.2 Commercial Electronic Messages (CASL)
Where permitted by law and with user consent, OneFeather may send commercial electronic messages, such as feature updates, product announcements, newsletters, promotional communications, or Nation-related communications. Users may manage their preferences for receiving such messages through their account settings, including opting in or out of email communications for marketing or informational purposes.
In connection with Status Card Application services, users may optionally receive SMS messages in addition to email communications for application status or processing updates. SMS notifications are specific to this service and are not used for other OneFeather services. Users may manage their consent to receive SMS notifications through their account settings or by responding “STOP” to an SMS message, where applicable.
9.3 Consent and Unsubscribe Mechanisms
Users may withdraw consent to receive commercial electronic messages at any time by using unsubscribe mechanisms included in the message or by adjusting their communication preferences within their account profile. Withdrawing consent for marketing communications does not affect the delivery of essential transactional or service-related messages.
10. How We Protect Personal Information
10.1 Safeguards
OneFeather implements administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, or loss.
These safeguards include layered security measures such as access controls based on role and need-to-know principles, authentication and credential management, secure data transmission and storage practices, employee training, system monitoring, and incident response procedures. Access to personal information is limited to personnel and service providers who require it to perform their duties.
OneFeather’s security program is designed to align with recognized industry standards and includes regular assessments and testing to evaluate the effectiveness of safeguards.
10.2 Service Provider Security
Where OneFeather engages third-party service providers to process personal information on its behalf, those providers are required by contract to implement appropriate security measures and to process information only in accordance with OneFeather’s instructions and applicable law.
Where appropriate, OneFeather assesses service providers’ security practices, which may include review of certifications, audit reports, or other security assurances.
10.3 Security Incidents and Breach Notification
If OneFeather experiences a breach of security safeguards involving personal information under its control, OneFeather will assess the risk of harm and take reasonable steps to reduce potential impacts. Where required by applicable law, OneFeather will notify affected individuals and relevant regulators of the breach. OneFeather also maintains records of breaches in accordance with legal requirements.
11. Retention of Personal Information
OneFeather retains personal information only for as long as necessary to fulfill the purposes for which it was collected, including to provide services, comply with legal, regulatory, accounting, and audit requirements, resolve disputes, and enforce agreements.
Retention periods may vary depending on the type of information and the service context in which it was collected. For example, personal information related to financial and payment services may be retained for periods required under financial services, anti-money laundering, and audit obligations. Verified identity records, wallet account information, and transaction records must be retained for up to five (5) years after account closure in accordance with applicable anti-money laundering and FINTRAC requirements.
Personal information related to governance, voting, or community participation may be retained to support election integrity, accountability, and record-keeping requirements.
Personal information collected for Status Card Application services is retained in accordance with applicable legal and government program requirements and is stored separately from other OneFeather services.
Where OneFeather engages service providers to process or retain personal information on its behalf, those providers retain information only as required to operate and administer the applicable services and in accordance with contractual and legal requirements.
Identity document images and biometric-related data processed by Canada Post Identity+ are retained only for the duration necessary to complete identity verification and are automatically purged upon consumption or within a short technical window, in accordance with Canada Post’s processes.
Where personal information is no longer required for the purposes described above, OneFeather securely deletes or de-identifies the information, subject to any legal retention obligations.
12. User Rights and Choices
OneFeather respects the rights of individuals with respect to their personal information and provides choices regarding how personal information is used across its services.
12.1 Access and Correction
Users may request access to the personal information OneFeather holds about them and may request corrections where information is inaccurate or incomplete. Access and correction requests are handled in accordance with applicable privacy laws and may be subject to identity verification requirements.
12.2 Consent and Withdrawal
Where OneFeather relies on consent to collect, use, or share personal information, users may withdraw their consent at any time, subject to legal or contractual restrictions. Withdrawing consent may affect a user’s ability to access certain services or features that rely on that information.
Users may withdraw consent for optional programs, such as rewards programs or community participation features, through available in-app controls or by contacting OneFeather.
12.3 Marketing Communications Preferences
In addition to the communications practices described above, users may manage their preferences for receiving commercial electronic messages. Where permitted by law, OneFeather may send commercial electronic messages such as product updates or promotional communications. Users may withdraw consent to receive such messages at any time by using unsubscribe mechanisms provided in the message or by contacting OneFeather. Withdrawing consent for marketing communications does not affect the delivery of essential account or transactional messages.
13. Contact Information
OneFeather has designated a Privacy Officer responsible for overseeing compliance with applicable privacy laws and this Privacy Policy.
If you have questions about this Privacy Policy, about how OneFeather handles personal information, or if you wish to make a request regarding access, correction, or consent withdrawal, you may contact the OneFeather Privacy Officer at:
OneFeather will respond to privacy-related inquiries and requests in accordance with applicable law and may take reasonable steps to verify your identity before processing a request.