Canada’s “private” COVID Alert app wasn’t so private after all