Privacy Policy

Introduction

This Privacy Policy explains how City by Locals collects, uses, stores, and shares personal information when you use the City by Locals website, applications, and related services (the "Platform").

Effective Date: July 21, 2026 · Version 1.0

1. Who We Are

City by Locals is operated by Adam Raber, an individual based in Buenos Aires, Argentina, under the trade name "City by Locals" ("City by Locals", "we", "us", or "our").

Privacy contact: hello@citybylocals.com.

Website: https://www.citybylocals.com.

2. Scope

This Privacy Policy applies to personal information processed in connection with the Platform, including information about:

Visitors to the Platform;

Travelers who create accounts or make bookings;

Guides and backup guides who offer or support Tour Experiences;

Administrators who operate and moderate the Platform; and

People who submit support or assistance requests, whether or not they have an account.

3. Information We Collect

Depending on how you use the Platform, we may collect the categories of information described below.

3.1 Information You Provide Directly

Account and profile information, such as names, profile photos or avatars, biography, experience, languages, country, city, and other profile details you choose to provide;

Contact information, such as email address and phone number;

Booking and logistics information, such as tour preferences, schedule details, party size, participant information, hotel, meeting, and pickup location details, and related notes;

Accessibility information you voluntarily provide, including mobility-aid preferences or descriptions;

Messages, proposals, and change-request content exchanged through the Platform;

Reviews and ratings you submit;

Support requests, including your name, contact details, and the content of your message;

Uploaded listing images and other content you submit for tours or your profile; and

Information needed for account settings, terms acceptance records, and similar Platform preferences.

3.2 Information from Google Sign-In

If you sign in with Google, we may receive basic Google account information used to authenticate you and create or update your City by Locals profile, such as identifiers, email address, and profile display information provided by the authentication flow.

If a Guide connects Google Calendar, we may receive and store connection-related data as described in Section 6.

3.3 Information Generated Through Platform Use

Booking, schedule, party, participant, proposal, payment, platform-fee, refund, and guide-balance or payout records created through Platform activity;

Favorites and in-app notifications;

Technical and diagnostic information related to errors, security, and Platform reliability; and

Analytics and usage information when analytics is enabled, as described in Section 8.

3.4 Browser, Device, and Infrastructure Data

Our hosting and service providers may process technical information such as IP address, browser or device characteristics, request logs, and similar infrastructure data as part of operating the Platform.

4. How We Use Information

We use personal information to:

Authenticate users and manage accounts;

Operate the marketplace that connects travelers with independent local guides;

Facilitate bookings, tour coordination, proposals, and change requests;

Enable traveler-guide communication;

Support accessibility and mobility-related arrangements when you provide that information;

Process platform fees, refunds, and related payment records when those functions are active;

Send transactional and service-related emails and reminders;

Provide customer support;

Protect safety, prevent fraud, and enforce Platform rules;

Analyze usage and improve the Platform;

Diagnose errors and maintain Platform security; and

Comply with legal obligations and respond to lawful requests.

5. How Information Is Shared

We share personal information only as needed to operate the Platform and as described in this Privacy Policy.

5.1 Sharing Within the Marketplace

Assigned travelers and guides may see booking, logistics, and communication information needed to fulfill a Tour Experience, subject to Platform access controls;

Administrators may access information needed to operate, support, and moderate the Platform;

Public guide profiles may display information such as name, photo, biography, languages, and related public listing content; and

Published reviews may display limited reviewer information such as first name, avatar, and country, together with the review content.

5.2 Service Providers

We use service providers that process personal information only to support the Platform and their contracted services, including:

Supabase, for authentication, database, and storage;

Vercel, for application hosting and related infrastructure;

Resend, for transactional and service-related email delivery;

Google, for sign-in, maps/places-related functionality, timezone lookups, and optional Google Calendar connections;

Mixpanel, for product analytics when analytics is enabled;

Sentry, for error monitoring and technical diagnostics; and

Stripe, when payment or refund functionality that uses Stripe is active.

These providers may process personal information only as needed to provide their services to City by Locals.

5.3 Other Disclosures

We may disclose personal information to professional advisers or to authorities when required by law or necessary to protect rights, safety, or the integrity of the Platform.

If City by Locals is involved in a business transfer, reorganization, or similar transaction, personal information may be transferred as part of that process, subject to applicable requirements.

5.4 No Sale and No Cross-Context Behavioral Advertising

City by Locals does not sell personal information.

City by Locals does not share personal information for cross-context behavioral advertising.

6. Google Sign-In and Google Calendar Data

Google Sign-In and Google Calendar are separate features and are described below.

6.1 Google Sign-In

If you choose to sign in with Google, basic Google account information may be used to authenticate you and to create or update your City by Locals profile.

6.2 Google Calendar

Google Calendar access is optional and intended for Guides.

When connected, City by Locals requests the OAuth scope https://www.googleapis.com/auth/calendar.events.owned.

City by Locals uses this access to create, update, and remove City by Locals booking events in calendars owned by the Guide.

In connection with a Calendar connection, City by Locals may store the connected Google account email, calendar identifiers, event identifiers, OAuth scopes, encrypted access and refresh tokens, sync status, and related error information.

Booking events synced to Google Calendar may include tour scheduling and logistics information needed by the Guide.

Google Calendar data is not used for advertising.

Guides can disconnect Google Calendar through the Platform.

City by Locals' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Cookies and Browser Storage

The Platform uses cookies and other browser storage technologies. Not every browser-storage entry is a cookie.

Authentication cookies managed through Supabase support signed-in sessions;

Short-lived OAuth state cookies support secure Google Calendar connection flows;

sessionStorage may store post-authentication redirect destinations, pending change-request drafts, and guide tour-creation draft or session identifiers;

localStorage may store proposal-conversation "seen" state; and

When Mixpanel is enabled, Mixpanel may store identifiers and related analytics persistence values in localStorage.

Necessary storage supports authentication, security, and requested Platform functionality. Analytics-related storage may be used when analytics is enabled.

8. Analytics and Diagnostics

When Mixpanel is enabled, Mixpanel may receive allowlisted usage events, a Platform user identifier (UUID), role information, and authentication-provider information. Application controls are designed so Mixpanel does not receive names, email addresses, phone numbers, pickup locations, or other properties blocked by the Platform's analytics allowlist.

Session Replay is disabled in the Platform's Mixpanel client configuration.

Sentry receives errors and technical diagnostics. Default collection of personally identifiable information in Sentry is disabled, and the application applies scrubbing. Identifiers related to an affected booking or flow may still appear when needed for diagnosis.

These measures reduce unnecessary personal data in analytics and diagnostics, but they do not guarantee absolute anonymization of every technical log or event.

9. Retention

Account and profile data is generally retained while the account remains active.

In-app notifications normally expire after approximately three days and are purged by an automated job.

Booking, message, review, payment, support, security, and transaction records may be retained as necessary to operate the Platform, resolve disputes, prevent fraud, maintain records, and comply with legal obligations.

Following account deletion, data may be deleted or anonymized, except where retention is necessary for legitimate operational or legal reasons. For example, historical booking or payment records may need to remain associated with an anonymized account where Platform integrity requires it.

Service-provider backups or logs may persist temporarily according to those providers' practices.

10. User Rights and Choices

Subject to applicable law, you may have the right to:

Access personal information we hold about you;

Request correction or updates;

Request deletion;

Object to or request restriction of certain processing where applicable;

Withdraw optional permissions, such as by disconnecting Google Calendar; and

Delete your account through available Platform controls, subject to eligibility rules such as the absence of active bookings or tours.

You may also lodge a complaint with a competent data-protection authority. Users in Argentina may contact the Agencia de Acceso a la Información Pública where applicable.

To submit a privacy request, email hello@citybylocals.com. We may need to verify your identity before responding.

We may decline or limit a deletion request where retention is required or permitted for operational, security, dispute-resolution, accounting, or legal reasons.

11. International Processing

City by Locals is based in Argentina. Personal information may be processed internationally by the service providers used to operate the Platform.

Where required by applicable law, we use reasonable safeguards for such processing.

12. Security

We use administrative, technical, and organizational measures designed to protect personal information, including access controls, Supabase row-level security, encryption in transit, encryption of Google Calendar tokens at rest, server-side authorization and validation, protection of secrets, and monitoring with redaction practices for diagnostics.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Children

You must be at least 18 years old to create an account, submit a booking, or register as a Guide on the Platform.

Minors may participate in a Tour Experience only as part of a booking made and supervised by an adult Traveler, who is responsible for their supervision and participation.

The Platform is not directed to children creating their own accounts.

If you believe information was submitted improperly for a minor, contact hello@citybylocals.com.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes may be communicated by email or through an in-product notice.

The version and effective date of this Privacy Policy appear at the top of this document and in the introduction.

15. Contact

For privacy questions or requests, contact:

Adam Raber

Operating under the trade name City by Locals

Buenos Aires, Argentina

Email: hello@citybylocals.com

Website: https://www.citybylocals.com