Privacy Policy
Effective Date: June 10, 2026 | Last Updated: June 11, 2026 | Version: 2.1
1. Introduction
Welcome to CitySettle ("we," "our," or "us"). We are committed to protecting your privacy and being transparent about how we collect, use, and share your information. This Privacy Policy explains our practices when you use the CitySettle mobile application ("App").
By using CitySettle, you agree to the collection and use of information in accordance with this policy.
Privacy Officer: For any privacy-related questions or concerns, contact our Privacy Officer at privacy@citysettle.com.
2. Information We Collect
2.1 Information You Provide
Account Information:
- Phone number (for authentication via SMS OTP)
- Display name
- Profile photo
- City/location preference
User Content:
- Posts (listings, reviews, community updates)
- Photos uploaded to posts
- Messages sent to other users
- Comments and reviews
2.2 Information Collected Automatically
Device Information:
- Device type and operating system
- Unique device identifier
- App version
Usage Data:
- Features you use
- Pages you visit
- Time spent in the app
- Interaction with posts and other users
Location Data:
- City-level location (based on your preference)
- Precise device location (GPS) — only when you tap "Near Me" in the Places directory and grant the location permission. Your coordinates are sent to our server solely to find places near you; they are used for that request only and are not stored or used to track you. You can use the app fully without granting location access (browse by city instead).
2.3 Information from Third Parties
We use third-party services to operate the App. Each service collects specific data:
Supabase (backend hosting, authentication, database, file storage):
- Account data (user ID, phone number, profile information)
- Posts, messages, reviews, and other user-generated content
- Uploaded photos and files
- Authentication tokens and session data
- Data location: Hosted on Supabase's infrastructure (primarily US/Canada data centers)
- Privacy policy: supabase.com/privacy
Twilio (SMS verification):
- Phone number (for SMS OTP delivery)
- Message metadata (timestamps, delivery status)
- Note: Twilio acts as an independent data controller for communications data
- Privacy policy: twilio.com/legal/privacy
Expo (app development platform, push notifications):
- Push notification tokens (device identifiers for routing notifications)
- App metadata (version, project ID)
- Note: Expo does not collect end-user analytics from apps built with Expo
- Privacy policy: expo.dev/privacy
Stripe (payment processing):
- Payment card details (processed directly by Stripe; never touches our servers)
- Transaction history (amounts, dates, merchant info)
- Device information (IP address, device fingerprint for fraud prevention)
- PCI compliance: Stripe is PCI DSS Level 1 certified; card data never passes through our servers
- Privacy policy: stripe.com/privacy
Sentry (crash reporting and error tracking):
- Error stack traces and diagnostics
- Device information (model, OS version, memory)
- App state (foreground/background, navigation breadcrumbs)
- Note: Sentry is integrated and activates in production builds. We set
sendDefaultPii: false, so Sentry does not collect IP addresses or other default personal identifiers, and events are scrubbed of request data before sending - Privacy policy: sentry.io/privacy
All third-party providers are contractually obligated to protect your data and use it only for the specified purposes.
3. How We Use Your Information
We use your information to:
- Provide the Service: Authenticate your account, display your posts, enable messaging, and facilitate connections between users
- Improve the App: Analyze usage patterns to enhance features and user experience
- Send Notifications: Deliver push notifications for messages, follows, reviews, and place updates (you can control these in settings)
- Prevent Abuse: Detect and prevent spam, fraud, and violations of our community guidelines
- Comply with Legal Obligations: Respond to legal requests and comply with applicable laws
We do NOT:
- Sell your personal information to third parties
- Use your data for advertising purposes
- Share your precise location with other users (only city-level)
4. Data Retention
We retain your data only as long as necessary to provide the service and comply with legal obligations.
4.1 Account Data
| Data Type | Retention Period |
|---|---|
| Active accounts | Retained as long as your account is active |
| Deleted accounts | Deleted within 30 days of account deletion request |
| Posts and listings | Retained until you delete them or your account is deleted |
| Messages | Retained until you delete them or your account is deleted |
| Photos and files | Retained until you delete them or your account is deleted |
| Reviews and comments | Retained until you delete them or your account is deleted |
4.2 Logs and Analytics
| Data Type | Retention Period |
|---|---|
| Error logs | 90 days |
| Activity logs | 30 days |
| Analytics data | Aggregated and anonymized, retained indefinitely |
| Crash reports (Sentry) | 90 days |
4.3 Payment Data
| Data Type | Retention Period |
|---|---|
| Transaction records | 7 years (for tax and legal compliance) |
| Payment card details | Not stored by CitySettle; retained by Stripe per their retention policy |
4.4 Legal Requirements
We may retain certain information if required by law or to resolve disputes, even after you delete your account. This includes:
- Transaction records (for tax purposes)
- Fraud prevention data
- Legal compliance records
5. Data Sharing and Disclosure
5.1 Public Information
The following information is publicly visible to other CitySettle users:
- Your display name and profile photo
- Your posts and reviews
- Your city preference
5.2 Private Information
The following information is private and only visible to you:
- Your phone number
- Your messages (only visible to conversation participants)
- Your notification preferences
5.3 Third-Party Service Providers
We share data with these service providers to operate the App:
| Provider | Purpose | Data Shared |
|---|---|---|
| Supabase | Backend hosting, authentication, database | Account data, posts, messages, photos |
| Twilio | Phone verification | Phone number (for SMS OTP) |
| Expo | App development, push notifications | Device tokens, app metadata |
| Stripe | Payment processing | Payment details, transaction history |
| Sentry | Error tracking | Crash logs, error reports |
All third-party providers are contractually obligated to protect your data and use it only for the specified purposes.
5.4 Legal Disclosures
We may disclose your information if required by:
- Court order or legal process
- Law enforcement requests
- Applicable laws or regulations
We will notify you of such disclosures unless legally prohibited.
6. Your Rights and Choices
6.1 Access and Correction
You can access and update your account information at any time through the App:
- Edit your profile (name, photo, city)
- View your posts and messages
- Update notification preferences
6.2 Data Portability
You can request a copy of your data by contacting us at support@citysettle.com. We will provide your data in a machine-readable format within 30 days.
6.3 Deletion
To delete your account:
- Go to Settings → Account → Delete Account
- Confirm deletion
All your data (posts, messages, profile) will be deleted within 30 days. Some aggregated, anonymized data may be retained for analytics.
6.4 Opt-Out of Notifications
You can control push notifications in your device settings or within the App:
- Settings → Notifications → Toggle categories on/off
6.5 Children's Privacy
CitySettle is not intended for users under 13. We do not knowingly collect information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at support@citysettle.com.
7. Security
We implement industry-standard security measures to protect your data:
7.1 Technical Measures
- Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.3
- Encryption at rest: Authentication tokens are encrypted using AES-256 encryption
- Access controls: Database access is restricted via Row Level Security (RLS) policies; users can only access their own data
- Input validation: All user inputs are validated and sanitized to prevent injection attacks
- Rate limiting: API endpoints are rate-limited to prevent abuse
- Secret scanning: Automated scanning for leaked credentials in our codebase
- Dependency auditing: Regular audits of third-party dependencies for security vulnerabilities
7.2 Organizational Measures
- Access control: Only authorized personnel can access production data
- Regular audits: We regularly review our security practices and update them as needed
- Incident response: We have a documented incident response plan for security breaches
- Employee training: Team members are trained on data protection and security best practices
7.3 Payment Security
- PCI DSS compliance: Payment card data is processed directly by Stripe (PCI DSS Level 1 certified)
- No card storage: CitySettle never stores payment card details on our servers
- Tokenization: Payment methods are tokenized; we only store Stripe tokens, not card numbers
7.4 Breach Notification
In the event of a security breach that affects your personal data:
- We will notify affected users within 72 hours of discovering the breach
- We will notify the Office of the Privacy Commissioner of Canada if the breach poses a real risk of significant harm
- We will provide details about the breach, what data was affected, and steps you can take to protect yourself
However, no system is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your data and will notify you of any security breach as required by law.
8. International Data Transfers
Your data may be transferred to and processed in countries other than your own. Specifically:
8.1 Where Your Data is Stored
| Service | Primary Data Location |
|---|---|
| Supabase (database, auth, storage) | United States (AWS us-east-1) |
| Twilio (SMS) | United States |
| Stripe (payments) | United States |
| Sentry (crash reporting) | United States |
| Expo (push notifications) | United States |
8.2 Safeguards for International Transfers
When your data is transferred outside Canada, we ensure appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs): We use SCCs approved by the European Commission for transfers to countries without adequate privacy laws
- Service provider agreements: All third-party providers contractually commit to protecting your data
- Encryption: Data is encrypted in transit (TLS) and at rest (AES-256)
- Access controls: Only authorized personnel can access your data
By using CitySettle, you consent to such transfers. We will notify you if we change the countries where your data is stored.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by:
- Posting the updated policy in the App
- Sending you a push notification
- Updating the "Last Updated" date at the top
Your continued use of the App after the effective date constitutes acceptance of the updated policy.
10. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:
Privacy Officer:
- Email: privacy@citysettle.com
- Response time: We will respond within 30 days
General Support:
- Email: support@citysettle.com
- In-app: Settings → Help & Support
10.1 Your Rights by Region
Canada (PIPEDA):
- Right to access your personal data
- Right to correct inaccurate data
- Right to withdraw consent
- Right to file a complaint with the Office of the Privacy Commissioner of Canada
California (CCPA):
- Right to know what personal information we collect
- Right to delete your personal information
- Right to opt-out of the sale of personal information (we do not sell personal information)
- Right to non-discrimination for exercising your rights
European Union (GDPR):
- Right to access, rectify, or erase your personal data
- Right to restrict or object to processing
- Right to data portability
- Right to lodge a complaint with your local supervisory authority
To exercise any of these rights, contact us at privacy@citysettle.com.
11. Additional Information for California Residents (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
- Right to Know: You can request details about the personal information we collect about you
- Right to Delete: You can request deletion of your personal information
- Right to Opt-Out: You can opt-out of the sale of personal information (we do not sell personal information)
- Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights
Note: CCPA applies to businesses that meet certain thresholds (annual gross revenue > $25 million, or buy/receive/sell personal information of 100,000+ California residents). While CitySettle may not currently meet these thresholds, we provide these rights as a best practice.
To exercise these rights, contact us at privacy@citysettle.com.
12. Additional Information for EU/EEA Residents (GDPR)
If you are in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR):
- Right to Access: You can request a copy of your personal data
- Right to Rectification: You can correct inaccurate personal data
- Right to Erasure: You can request deletion of your personal data ("right to be forgotten")
- Right to Restrict Processing: You can request that we limit how we use your data
- Right to Data Portability: You can request your data in a machine-readable format
- Right to Object: You can object to certain types of processing
- Right to Lodge a Complaint: You can file a complaint with your local supervisory authority
Legal Basis for Processing:
- Contract performance: Providing the service (authentication, posts, messages)
- Legitimate interests: Improving the app, preventing abuse, analytics
- Consent: Push notifications, optional features (you can withdraw consent at any time)
Note: While CitySettle primarily targets Canadian users, we provide GDPR-compliant features as a best practice for any EU/EEA users who may download the app.
13. Canadian Privacy Rights (PIPEDA)
CitySettle is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal privacy law for commercial activities.
13.1 Your Rights Under PIPEDA
- Right to know: Why we collect your data and how we use it
- Right to access: You can request a copy of your personal data
- Right to correct: You can correct inaccurate or incomplete data
- Right to withdraw consent: You can withdraw consent at any time (though this may limit your ability to use the App)
- Right to challenge compliance: You can file a complaint with the Office of the Privacy Commissioner of Canada
13.2 Consent
We obtain your consent in the following ways:
- Express consent: For sensitive data (phone number, location, payment information), we require explicit opt-in
- Implied consent: For non-sensitive data (app analytics, usage patterns), consent is implied by your use of the App
You can withdraw consent at any time by deleting your account or contacting us at privacy@citysettle.com.
13.3 Data Retention
We retain your data only as long as necessary to fulfill the purposes for which it was collected (see Section 4 for specific retention periods).
13.4 Cross-Border Transfers
Your data may be transferred outside Canada (primarily to the United States). We ensure appropriate safeguards are in place (see Section 8 for details).
13.5 Breach Notification
If a security breach poses a real risk of significant harm to you, we will:
- Notify you as soon as feasible
- Report the breach to the Office of the Privacy Commissioner of Canada
- Notify other organizations or government institutions that may be able to reduce the risk of harm
13.6 Filing a Complaint
If you believe we have violated your privacy rights, you can file a complaint with:
Office of the Privacy Commissioner of Canada
- Website: priv.gc.ca
- Phone: 1-800-282-1376
We encourage you to contact us first at privacy@citysettle.com so we can address your concerns directly.
This Privacy Policy is designed to be transparent about our data practices. If anything is unclear, please reach out to us at privacy@citysettle.com.