Privacy Policy

When you create an account: your email address and (if provided via Google/Facebook OAuth) your name and profile photo.

When you use the platform: your selected city, reviews and accessibility ratings you submit, venue claims you file, and Plan a Visit records.

Automatically: basic device and browser information (browser type, operating system, IP address) and session data used for authentication and security.

We do not collect precise geolocation data. City-level location is inferred from your city filter selection only.

To provide the CityAxS service — authenticate your account, display your reviews, process venue claims, and send Plan a Visit notifications.

To send transactional emails — account sign-in links, claim verification emails, and claim approval/rejection notifications.

To improve the platform — understanding how features are used helps us prioritize improvements. We do not build individual behavioral profiles.

We do not use your data for advertising, and we do not sell, rent, or trade your personal information to any third party.

Supabase (database and authentication infrastructure) — your account data and reviews are stored in Supabase's managed PostgreSQL database. Supabase is SOC 2 Type 2 certified.

Google and Facebook (OAuth sign-in only) — if you choose to sign in with Google or Facebook, those providers authenticate you. We receive only your email address and name. We do not receive or store your Google/Facebook password.

Vercel (hosting and deployment) — our application is hosted on Vercel's infrastructure. Server logs may include IP addresses and request data.

We do not share your data with any other third parties, data brokers, or advertising networks.

We retain your account data for as long as your account is active.

If you request account deletion, we will delete your personal data (email, name, reviews, claims) within 30 days of your request.

Some data may be retained longer where required by law or for legitimate business purposes such as fraud prevention.

To request deletion, email hello@cityaxs.com with subject line 'Delete My Account'.

CityAxS uses session cookies solely for authentication — to keep you signed in across pages. These are strictly necessary and cannot be disabled without losing sign-in functionality.

We do not use advertising cookies, tracking pixels, or any third-party analytics that follow you across other websites.

No ad targeting. No cross-site tracking. No data sold to advertisers.

CityAxS links to external websites including LegalZoom, Amazon (affiliate product links), Reddit, and other services.

We are not responsible for the privacy practices of any third-party site we link to. We encourage you to review the privacy policies of any external sites you visit.

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):

Right of access — you may request a copy of the personal data we hold about you.

Right to rectification — you may correct inaccurate personal data.

Right to erasure — you may request deletion of your personal data ('right to be forgotten').

Right to data portability — you may request your data in a machine-readable format.

Right to object — you may object to processing of your personal data for certain purposes.

Right to lodge a complaint — you may file a complaint with your local data protection authority.

To exercise any of these rights, contact us at hello@cityaxs.com. We will respond within 30 days.

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

Right to know — you may request disclosure of the categories and specific pieces of personal information we collect about you.

Right to delete — you may request deletion of personal information we have collected.

Right to opt-out of sale — we do not sell personal information. You do not need to opt out.

Right to non-discrimination — we will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request, email hello@cityaxs.com with subject line 'CCPA Privacy Request'.

CityAxS is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. Continued use of CityAxS after changes constitutes acceptance of the revised policy.

For significant changes, we will notify users via email where feasible.

For any privacy questions, data requests, or concerns, contact us at: hello@cityaxs.com

We aim to respond to all privacy inquiries within 30 days.