Victor Nketiah, Steglitzer Straße 7, 22045 Hamburg, Germany, trading as “Citypins”, is the data controller for the personal data described here. Because Citypins is a location-based app, we try to collect as little as possible and to show other people as little as possible about you.
What we collect and why
- Account data — email, login credentials, display name, handle, avatar, account type (private or business). Used to create and secure your account. Legal basis: performance of our contract with you.
- Optional gender — only if you provide it as a private user. Used solely in the anonymous, aggregated area-activity breakdown, which is shown only for areas with enough users. Legal basis: your consent.
- Location data — approximate and precise coordinates while you use the map. Used to show what is near you, to power aggregated area activity and, if you turn it on, to share your position with mutual friends. Legal basis: contract and consent.
- Content — posts, area tags, event listings, ZIP codes, flyer images, RSVPs and favourites. Used to provide the Service. Legal basis: contract.
- Usage and device data — IP address, device/browser information, error logs. Used for security, fraud prevention and improving the product. Legal basis: legitimate interests.
- Support messages — used to answer you. Legal basis: legitimate interests.
What other people can see
- Your display name, handle and avatar are visible to signed-in users.
- Your “going” RSVPs and derived category preferences may be visible on your public profile; your “not going” answers are private to you.
- Your live location is shown to others only if you enable friends-sharing, and only to mutual friends. Invisible and Ghost modes hide it.
- Area activity circles are aggregated and only appear once enough users are in an area, so individuals cannot be identified.
Who we share data with
- Hosting and database providers that run the app infrastructure.
- Map providers (Google Maps) to render maps, places search and street view.
- Paddle, our Merchant of Record, for sale of listings and subscriptions, payments, subscription management, invoicing and tax compliance.
- Professional advisers such as legal and accounting, where needed.
- Authorities where we are required by law.
We do not sell your personal data.
International transfers
Some of our providers process data outside the UK/EEA. Where that happens, transfers are covered by adequacy decisions or Standard Contractual Clauses.
Retention
Location points are kept only as long as needed to power live features and aggregates and are then deleted or anonymised. Account data and content are kept while your account is active and deleted or anonymised after you delete your account, except where we must keep records for legal or accounting reasons.
Your rights
You can request access, rectification, erasure, restriction, portability, or object to processing, and withdraw consent (for example by turning off location sharing or removing your gender field) at any time. We respond within one month. If you are in the UK or EEA you may also complain to your local supervisory authority.
Security
We use appropriate technical and organisational measures, including encryption in transit, row-level access controls in the database so users can only read what they are allowed to, and restricted administrative access.
Cookies and local storage
We use essential cookies and browser storage to keep you signed in and remember app preferences. We do not use advertising cookies. You can clear them in your browser settings, though the app will sign you out.
Contact
For any privacy request, email citypinsofficial@gmail.com (Victor Nketiah, Steglitzer Straße 7, 22045 Hamburg, Germany). Billing-related data handled by Paddle is covered by Paddle's own privacy notice.