Privacy policy

Signing in with Google

You sign in with your Google account. From Google we receive only your name, your email address and a Google account id (the "openid email profile" permissions). We use them to sign you in, to show your first name next to what you post, and to contact you about your account. We don't get access to your contacts, files, calendar or anything else in your Google account.

Toronto Citizen's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data for advertising, we don't sell it, and we don't let people read it except as this policy describes.

What we collect, and why

• Your account: your display name (the first word of your Google name, which you can change), email address, and whether you're verified, an admin or suspended.
• Your home area: if you set one, a hexagon a few blocks wide, never an address or a point. It's used to show your listings in the right area and is never shown to anyone else.
• ID verification: to post, message or find your people you verify that you're an adult. You take a photo of a government ID and a selfie; both are encrypted on your device before they're uploaded, so our server can't read them. A reviewer decrypts them on their own device, checks them, and the photos are deleted at once (or after 72 hours if nobody has reviewed them). We keep only: that you're verified and an adult, and a scrambled code made from your ID’s type, issuer and number (a keyed hash, which can't be turned back into the number) to catch repeated use of the same ID and enforce bans. We accept an Ontario Photo Card, a driver’s licence from any Canadian province or territory, a Canadian passport, or a Permanent Resident card. Health cards are not accepted.
• What you post and do: plans and who joined them, chatter, listings and their photos (re-encoded on our server, which strips location and camera details), messages, group chats, reactions, reports, blocks, and what you say you're looking for people for (an activity, a time, and an area as a hexagon).
• Group preferences (optional): if you choose, your gender and whether you'd like not to be the only one of it in a group. Only the matching uses it; nobody else ever sees it, not even the people in your group.
• Vibes and crowd counts: when you share a vibe, or have the map open, we count it toward an area. These are kept in memory only (never written to our database), gone within hours, and only ever shown as counts of five or more people per area.
• Notifications: if you turn on push notifications, we keep that device's push address. Personal notifications contain updates you can already see about your groups and plans; admin alerts contain counts only. Activity emails are on by default when push isn't available, and you can choose email alongside push in your settings. Weekly email is off unless you choose it. You can turn either off in your profile or unsubscribe from any email without signing in.
• Technical: a sign-in cookie (only its scrambled form is stored), and short error logs. Our server logs each request (time, IP address, the page or API address without its query, the result, how long it took, your browser and the page that linked to us, never cookies) to keep the site fast, running and safe from abuse. Google Analytics uses cookies to count visits; we use no advertising cookies.
• City interest (optional): if you suggest a city, we store the city name and, if you choose to provide it, your email so we can tell you if Toronto Citizen comes to that city. We delete the email on request. The city vote is kept to help decide where to expand.

Google Analytics

We use Google Analytics to see which features are used (for example, starting a group), without names, ids or locations, and to count visits: pages viewed, rough location derived from IP addresses as Google provides it, device and browser information, and the referring website. It sets cookies in your browser. Google processes this information under its Google Analytics terms and privacy policy.

We don't send Google Analytics your name, email, account id, exact location or home area. We omit query strings and fragments, use generic paths for individual plans and listings, and exclude admin, development, verification and messages pages. There are no ads, advertising features are disabled, and we don't sell your data. You can block analytics cookies in your browser or install Google's Analytics opt-out browser add-on.

Anonymous usage

PostHog records anonymous usage (which pages and features are used). It doesn't record your screen. It uses a random browser identifier to connect visits, never your name, email or account id. We respect Do Not Track and Global Privacy Control for PostHog. You can also block its browser storage. See PostHog's privacy policy.

Email updates

We use Resend to deliver email to your Google address. Resend receives the address and the update being sent. Emails never include anyone's home address or exact position. Weekly emails contain personal plan updates, without event or movie promotions. We keep a delivery record (type, account and time) for 90 days to limit how often we email. Pending delivery payloads are removed after success or within about a day. See Resend's privacy policy.

Your location

If you let the map use your device's location, it's used only on your device: to stand your character where you are, and to work out which area you're in. Only the area (a hexagon, roughly a neighbourhood) is ever sent to us, and only when you share a vibe or say you're looking for people. Your exact location is never sent, saved or shown to anyone. No one else can see where you are. With “Where I am” enabled, your character moves with you while the board is visible. Tapping the logo or your character lets the camera follow; dragging the map or tapping Stop ends following. The location watch stops when you hide the app, leave the board or turn the setting off. Walking never updates a shared vibe or matching preference, and never sends a trail of positions or neighbourhoods to us.

This browser remembers your nearby district, your “Check where I am when I open the app” preference (on by default), and the districts you chose to stay put for today. With location permission already granted, opening the board can check for a new neighbourhood and offer to switch. Otherwise you can tap Update. These choices stay in this browser; exact coordinates are never stored or sent, and your account's home area never changes automatically. Turn checks off on Me or clear your browser's site data to remove these saved choices.

Who sees what

• Everyone can see public posts (plans, chatter, listings) with your first name, and counts.
• Verified neighbours can see the first names of people going on a plan before they join.
• Messages and group chats are only for the people in them.
• Reports are only seen by admins, and never say who reported.
• Admins (people we trust to moderate and review IDs) can see reports and the ID review queue, and act on accounts that break the terms.

We don't sell your information, and we don't share it with anyone except:

• Service providers that run the site: our server is hosted by OVHcloud in Canada; sign-in is by Google, which also processes visit information through Google Analytics as described above; map tiles come from OpenFreeMap and fonts from Google Fonts (your browser asks them directly, so they see your IP address, as with any website). Encrypted backups may be stored with a cloud storage provider; they're encrypted before they leave our server.
• When the law requires it, or to protect someone's safety (for example, a report that a child is at risk).

The city information on the map (events, drop-in programs, library programs, washrooms, TTC vehicles, Bike Share) comes from public open data, which our server fetches. Using the map doesn't share anything about you with those sources.

How long we keep it

• ID photos: deleted as soon as they're reviewed, and within 72 hours at most.
• Vibes: 2 hours. Crowd counts: minutes. Your activity search: until its time has passed.
• Chatter: removed after a week without new replies. The public activity feed: 30 days.
• Sign-in sessions: 30 days after you last use them. Server request logs: 14 days.
• Your account and what you've posted: until you delete your account.
• After you delete your account we keep only the scrambled ID code (without your account), so someone who was banned can't simply sign up again.

Your choices and rights

You can see and change your name, home area and group preferences on your page. You can ask us for a copy of the information we hold about you, to correct it, or to delete your account and everything you've posted, by emailing privacy@torontocitizen.ca from the email address you sign in with. We answer within 30 days. You can also remove Toronto Citizen's access in your Google account settings.

If you're not satisfied with how we handle your information, you can complain to the Office of the Privacy Commissioner of Canada.

Children

Accounts are for adults (18 and over), and ID review checks this. The site isn't meant for children, and we don't knowingly collect information from them.

Security

Everything is sent over HTTPS. ID photos are encrypted on your device and never readable on our server. Access to the server is limited to the operator. No system is perfectly secure; if something goes wrong that affects you, we'll tell you and the Privacy Commissioner as the law requires.

Changes

If this policy changes in a way that matters, we'll say so on the site before it takes effect.

Contact

Miad Abrin, Toronto, Ontario · privacy@torontocitizen.ca