Buying Canadian extends to software. For a reason that isn't price.

Canadians have spent the past year reading labels more carefully than they used to. That instinct is sound, but it stops at the grocery aisle — and software is where it matters most and gets checked least. Here's the honest version, including the part most posts on this subject get wrong.

First, the thing nobody says out loud: tariffs don't apply to your apps

Trade coverage has been unavoidable this month. On 19 August the United States imposed additional 50% tariffs on a range of Canadian products, trade talks in Washington collapsed on 21 August, and Canada's counter-tariffs — covering steel, dairy, appliances, agricultural equipment, pulp, paper and electronics — take effect on 8 September.

None of that changes what you pay for software.

Tariffs are duties on physical goods crossing a border. Your streaming subscription, your cloud storage, your child's parental control app: no tariff applies. If you see an app marketed as a way to "avoid tariffs," that's a claim with nothing behind it. Note also that "electronics" on the counter-tariff list means devices — the phone, the laptop — not the software running on them.

So if the reason to choose Canadian software isn't price, is there one at all?

Yes. It's just a completely different argument, and it's a stronger one.

The real question is jurisdiction, not geography

When you install an app on your child's phone, you're not buying a product so much as entering a relationship with whoever operates it. They decide what gets collected. They decide how long it's kept. And critically, the country their company answers to decides who else can demand it.

This is where most "data sovereignty" marketing falls apart, so it's worth being precise.

"Our servers are in Canada" is weaker than it sounds

Plenty of American companies now advertise Canadian data centres. It sounds decisive. It isn't, because of a piece of American law called the CLOUD Act.

Passed in 2018, the CLOUD Act allows US authorities to compel a US-based provider to hand over data in its possession, custody or control — regardless of which country that data physically sits in. A US company storing Canadian families' data in Toronto is still a US company receiving a US legal order.

Server location is a fact about geography. Jurisdiction is a fact about ownership. Only the second one determines who can compel disclosure.

What Canadian ownership actually gets you

A company incorporated in Canada operates under Canadian privacy law — PIPEDA for the private sector — and is answerable to the Privacy Commissioner of Canada, an office you can complain to, in your own language, without hiring a foreign lawyer.

That's a genuine difference. It is not, however, the strongest protection available.

The strongest protection is data that was never collected

Every safeguard above — Canadian ownership, Canadian servers, encryption, retention limits — is a rule about how collected data is handled. Rules can be changed by a court order, a policy update, or an acquisition. Two years ago the company was Canadian; today it's owned by someone else, and your data went with the sale.

There is exactly one category of information that survives all of that intact: the information that was never recorded in the first place.

A browsing history that doesn't exist can't be subpoenaed, sold in an acquisition, leaked in a breach, or handed over under a foreign statute. No policy change reaches backwards and creates it.

This is the question worth asking of any family app, and it is not the question most people ask:

Not "where do you store my child's browsing history?" but "why do you have it at all?"

How to check any app yourself, in about five minutes

This works for any app, including ours. Don't take a marketing page's word for it.

1. Find where the company is incorporated. Not "headquartered," not "founded in" — incorporated. It's usually in the privacy policy under a heading like "Who we are." If you can't find it anywhere, that itself is the answer.
2. Read the collection section, not the security section. Security tells you how they protect what they hold. Collection tells you what they hold. Only the second one matters here.
3. Look for the word "browsing." Search the privacy policy for "browsing history," "URLs," "web activity" and "sites visited." A parental control app that reports which sites your child visited is, by definition, keeping a log of it somewhere.
4. Check retention periods. "As long as necessary" means indefinitely. A real policy gives you a number.
5. Check who it's shared with. "Trusted partners" and "affiliates" are doing a lot of work in most policies. Advertising networks should appear by name or not at all.
6. Ask what happens if they're bought. Nearly every policy says data transfers with the business. That's normal — which is exactly why the amount collected matters more than the current owner's nationality.

Where Defenras actually stands

Applying our own checklist to ourselves, since it would be a strange article not to.

Incorporation. Defenras Inc. is incorporated in Ontario, Canada. Canadian-owned, operating under PIPEDA, answerable to the Privacy Commissioner of Canada.

What we store. Licence key records — the key, plan type, activation count, expiry date — and the device IDs attached to an active licence. If you turn on Guardian Alerts, the email address those alerts go to.

What we don't store. Your child's browsing history. Not encrypted, not anonymised, not aggregated — we don't create it. Filtering happens at the network level, and on Android the domain list is downloaded to the device and matched there, so the check itself never leaves the phone.

And the part we won't dress up: our infrastructure runs on Cloudflare, an American company, distributed across a global edge network — not on Canadian servers. We could have led with "your data never leaves Canada." It wouldn't be true.

What we'd say instead is that this is precisely why the collection question matters more than the location question. The records described above are a licence key and a device ID. There is no browsing history in that dataset to protect, subpoena, or lose — which is a stronger guarantee than any promise about which building the servers are in.

You're welcome to disagree with that trade-off. You can't evaluate it if we don't tell you about it.

So should "buy Canadian" apply to software?

Yes — but for the right reason, and with the right test.

Not because it dodges a tariff; it doesn't. Not because Canadian servers put data out of reach; frequently they don't. Buy Canadian in software because ownership determines which laws a company answers to and which regulator will take your call — and because a smaller domestic company is far likelier to have built something that doesn't need your child's browsing history in the first place.

Then verify it. Open the privacy policy of whatever is on your child's phone right now and search it for the word "browsing." Whatever you find, you'll know more than you did five minutes ago.