Privacy policy

1.Who we are

Citify is provided by its operator (“Citify”, “we”, “us”).

We are the controller of the personal data described in this policy. It applies to the Citify website and the Citify iPhone app (together, the “Service”).

2.Information we collect

We collect only what the Service needs to work:

• Account information. Your name, email address and sign-in credentials. Passwords are stored by our authentication provider in hashed form and are never visible to us.
• Content you add. Trips, including their days, places and stays; saved places and routes; your travel-test answers, stored as five taste scores; cities you like, pass on or have visited; and your usual departure airport, if you provide it.
• Shared trips. When you join or share a trip, other members can see the trip, your name, the flights you add and a history of who changed what.
• Service logs. A request identifier, the requested path without its parameters, the response status and the time taken. Logs do not contain request bodies or access tokens.
• Website statistics. When you open a page on this website, we count the visit with Vercel Web Analytics: the page path, with any search terms, codes and record identifiers removed; the referring site; and your country, browser, operating system and device type. It uses no cookies or browser storage and is not linked to your account.

We do not sell personal data, show advertising, or use advertising or cross-site tracking tools.

3.Location

The iPhone app asks for location access only while you are using it. Your location is processed on your device to show where you are and is never sent to us. The website does not request your location.

4.How we use information and our legal bases

• To provide the Service: create and secure your account, save and sync your content, build routes and itineraries, answer your questions and run the searches you request. Legal basis: performance of our contract with you.
• To keep the Service secure and reliable: verify sign-ins, limit abuse and investigate faults using service logs. Legal basis: our legitimate interest in operating a safe service.
• To understand how the website is used: count page visits so we can see which pages help and which need work, using the website statistics described above. Legal basis: our legitimate interest in improving the Service.
• To communicate with you: send account emails, such as password resets, and respond to your requests. Legal basis: performance of our contract with you.
• To meet legal obligations, where the law requires us to keep or disclose information.

We do not use your information for automated decision-making that has legal or similarly significant effects on you.

5.Service providers

We share information with the following providers only as needed to run the Service. They process it on our instructions.

Bookings are completed with the airline or hotel, through Google. Citify never takes payment. We may also disclose information if required by law or to protect the rights and safety of our users and others.

6.International transfers

Some providers process data outside your country, including in the United States. Where data protection law requires it, these transfers rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

7.Retention

We keep your account and content for as long as you have an account. When you delete your account, we delete it as described below. Service logs are kept for a limited period and then deleted.

8.Deleting your account

Open your profile and choose Delete my data. This deletes your account, saved routes and places, travel test, travel map and any trip you are the only member of. Trips shared with others remain available to the other members, with your personal details removed.

If you signed in with Apple, you can also revoke Citify’s access in your Apple Account settings.

9.Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy in a portable format;
• correct inaccurate data or delete your data;
• restrict or object to certain processing, including processing based on legitimate interests;
• withdraw consent where we rely on it, without affecting earlier processing; and
• lodge a complaint with your local data protection authority.

You can view and edit most of your information directly in Citify. To exercise any other right, contact us using the details below. We may need to verify your identity first. We will not treat you differently for exercising your rights.

10.Security

All traffic is encrypted in transit. Access to personal data is restricted to the account it belongs to, and on iPhone your session is stored in the device Keychain. No system is completely secure, but we work to protect your information and will notify you and the relevant authorities of a breach where the law requires.

11.Children

The Service is not directed to children under 13, or under the minimum age required in your country. We do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

12.Changes to this policy

We may update this policy from time to time. If we make a material change, we will notify you in Citify before it takes effect. The date at the top shows when it was last revised.

13.Contact

For questions about this policy or your personal data:

Email founders@citify.site. We aim to respond within 30 days.

See also our Terms of use and Cookies and storage notice.