Privacy policy

Signing in with Google

You sign in with your Google account. From Google we receive only your name, your email address and a Google account id (the "openid email profile" permissions). We use them to sign you in, to show your first name next to what you post, and to contact you about your account. We don't get access to your contacts, files, calendar or anything else in your Google account.

Toronto City's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data for advertising, we don't sell it, and we don't let people read it except as this policy describes.

What we collect, and why

• Your account: your display name (the first word of your Google name, which you can change), email address, and whether you're verified, an admin or suspended.
• Your home area: if you set one, a hexagon a few blocks wide, never an address or a point. It's used to show your listings in the right area and is never shown to anyone else.
• ID verification: to post, message or meet people you verify that you're an adult. You take a photo of a government ID and a selfie; both are encrypted on your device before they're uploaded, so our server can't read them. A reviewer decrypts them on their own device, checks them, and the photos are deleted at once (or after 72 hours if nobody has reviewed them). We keep only: that you're verified and an adult, and a scrambled code made from your licence number (a keyed hash, which can't be turned back into the number) so one person can have one account and bans stick.
• What you post and do: plans and who joined them, chatter, listings and their photos (re-encoded on our server, which strips location and camera details), messages, group chats, reactions, reports, blocks, and what you say you're "up for" (an activity, a time, and an area as a hexagon).
• Group preferences (optional): if you choose, your gender and whether you'd like not to be the only one of it in a group. Only the matching uses it; nobody else ever sees it, not even the people in your group.
• Vibes and crowd counts: when you share a vibe, or have the map open, we count it toward an area. These are kept in memory only (never written to our database), gone within hours, and only ever shown as counts of five or more people per area.
• Notifications: if an admin turns on notifications on a device, we keep that device's push address. Notifications say what kind of thing is waiting, never who or what.
• Technical: a sign-in cookie (only its scrambled form is stored), and short error logs. We don't keep access logs of the pages you visit, and we use no analytics or advertising cookies.

Your location

If you let the map use your device's location, it's used only on your device: to stand your character where you are, and to work out which area you're in. Only the area (a hexagon, roughly a neighbourhood) is ever sent to us, and only when you share a vibe or say you're up for something. Your exact location is never sent, saved or shown to anyone. No one else can see where you are.

Who sees what

• Everyone can see public posts (plans, chatter, listings) with your first name, and counts.
• Verified neighbours can see the first names of people going on a plan before they join.
• Messages and group chats are only for the people in them.
• Reports are only seen by admins, and never say who reported.
• Admins (people we trust to moderate and review IDs) can see reports and the ID review queue, and act on accounts that break the terms.

We don't sell your information, and we don't share it with anyone except:

• Service providers that run the site: our server is hosted by OVHcloud in Canada; sign-in is by Google; map tiles come from OpenFreeMap and fonts from Google Fonts (your browser asks them directly, so they see your IP address, as with any website). Encrypted backups may be stored with a cloud storage provider; they're encrypted before they leave our server.
• When the law requires it, or to protect someone's safety (for example, a report that a child is at risk).

The city information on the map (events, drop-in programs, library programs, washrooms, TTC vehicles, Bike Share) comes from public open data, which our server fetches. Using the map doesn't share anything about you with those sources.

How long we keep it

• ID photos: deleted as soon as they're reviewed, and within 72 hours at most.
• Vibes: 2 hours. Crowd counts: minutes. What you're "up for": until its time has passed.
• Chatter: removed after a week without new replies. The public activity feed: 30 days.
• Sign-in sessions: 30 days after you last use them.
• Your account and what you've posted: until you delete your account.
• After you delete your account we keep only the scrambled licence code (without your account), so someone who was banned can't simply sign up again.

Your choices and rights

You can see and change your name, home area and group preferences on your page. You can ask us for a copy of the information we hold about you, to correct it, or to delete your account and everything you've posted, by emailing privacy@torontocitizen.ca from the email address you sign in with. We answer within 30 days. You can also remove Toronto City's access in your Google account settings.

If you're not satisfied with how we handle your information, you can complain to the Office of the Privacy Commissioner of Canada.

Children

Accounts are for adults (18 and over), and ID review checks this. The site isn't meant for children, and we don't knowingly collect information from them.

Security

Everything is sent over HTTPS. ID photos are encrypted on your device and never readable on our server. Access to the server is limited to the operator. No system is perfectly secure; if something goes wrong that affects you, we'll tell you and the Privacy Commissioner as the law requires.

Changes

If this policy changes in a way that matters, we'll say so on the site before it takes effect.

Contact

Miad Abrin, Toronto, Ontario · privacy@torontocitizen.ca