Privacy Policy

1 — Who This Policy Covers

This policy covers:

• Residents who create a free Townzy account to browse and follow local town events (the mobile app)
• Unregistered visitors who preview town events before creating an account, or view publicly shared event pages on the web

This policy does not govern the practices of third-party services we use. Their policies are linked in Section 5.

Town staff (portal users): Townzy's Town Admin Portal is a separate web application used by municipal employees. Staff accounts are created and maintained under the terms agreed to between Townzy and the municipality. Staff data (work email, portal login activity) is processed on behalf of the municipality and is not covered by this resident-facing privacy policy.

2 — Information We Collect

2.1 Information You Provide

When you create an account:

• Email address — required. Used to identify your account and to send transactional notifications (cancellation and reschedule alerts only). Never used for marketing.
• Name — required. Used to personalize your experience and displayed in your profile.
• Phone number — optional. Stored only if you choose to enter it. Not currently used for outbound communication. If we add SMS notification features in the future, we will update this policy and you will have the option to opt in before any messages are sent.

When you sign in with Google or Apple:

• We receive the name and email address provided by your Google or Apple account. We do not receive your password, payment information, or any other account data.
• Apple Sign In note: If you choose Apple's "Hide My Email" option, Apple provides a private relay email address instead of your real email. We store whichever address Apple sends and use it only for account management and transactional notifications.

2.2 Information Collected Automatically

Your preferences and in-app activity:

• Town selection — the municipality you choose during setup. Used to display your town's events.
• Category preferences — the event categories you choose to follow. Used to filter your event feed and notification settings.
• Saved events — events you mark as favorites or set reminders for, along with the timestamps of when you saved them. Stored so your preferences sync across devices.
• Notification preferences — your setting for town broadcast updates (all events, selected categories, or none).

Push notification token: When you enable notifications, we store a push notification token (an Expo push token, backed by Apple APNs on iOS and Google Firebase Cloud Messaging on Android) in your account record. This token is how your device receives push notifications. It is not used for tracking or advertising. You can revoke it at any time by disabling notifications in the app or in your device's system settings. When revoked or when you delete your account, the token is removed from your record.

Crash and performance data: Firebase may collect anonymized crash reports and device-level diagnostics (device model, OS version, app version) to help us identify and fix technical issues. This data does not include your event feed, saved favorites, or account content. It is retained for 90 days by Firebase and then automatically deleted.

IP addresses: Standard network operations may result in your IP address being visible to Firebase infrastructure (Google LLC) as part of normal data transmission. Townzy does not store or log IP addresses separately.

2.3 What We Do Not Collect

• Precise GPS location — your town is selected manually from a list during onboarding. We never request access to your device's location.
• Calendar contents — the "Add to Calendar" feature opens your device's native calendar interface (provided by iOS or Android), pre-filled with event details. You confirm or edit the event in that native screen. Townzy does not read, access, or store any data from your device calendar.
• Contacts, photos, camera, or microphone — not accessed.
• Payment information — the app is free. No payment data is collected.
• Cross-app tracking data — we do not use advertising identifiers (IDFA/GAID) and do not track you across third-party apps or websites.
• Advertising profiles — we do not build behavioral advertising profiles of any kind.

2.4 Pre-Account Browsing

During onboarding, you can preview your town's upcoming events before creating an account. During this phase, event data is read from Firestore anonymously — no personal information is collected or associated with an unregistered user. Account creation is required only to save favorites, set reminders, and receive notifications.

2.5 Public Web Pages

When a Townzy user shares an event link, clicking that link opens a public web page hosted on Firebase Hosting (Google LLC). No Townzy account is required to view it. Standard web server data — including IP address, browser type, and request timestamp — may be logged by Firebase infrastructure and is governed by Google's Privacy Policy. Townzy does not separately store or process this web visitor data.

3 — How We Use Your Information

• To provide the service — displaying your town's events, saving your preferences and favorites, and delivering your event feed.
• To send transactional email alerts — email notifications when an event you saved or set a reminder for is cancelled or rescheduled. These emails are sent through SendGrid (Twilio Inc.), which receives your email address for delivery purposes only.
• To deliver push notifications — in-app reminders you've set and town broadcast updates, based on your notification preferences. Delivered through Expo's notification service, which routes through Apple APNs (iOS) and Google FCM (Android).
• To maintain your account — syncing your preferences, saved events, and town selection across sessions and devices.
• To improve app stability — using anonymized crash and performance data to diagnose and fix technical issues.

We do not use your data for advertising, behavioral profiling, or sale to third parties. We do not share your data with municipalities — towns use the admin portal to manage events only; they do not have access to resident account data.

4 — Information Sharing

We share your data only in the following circumstances:

• Service providers — we share data with the third-party services listed in Section 5 solely to operate the platform. These providers are not permitted to use your data for their own marketing.
• Legal obligations — if required by a court order, subpoena, or applicable law, we may disclose data as legally required. We will attempt to notify you in advance where permitted by law.
• Business transfers — in the event Townzy is acquired or merges with another company, your data may transfer as part of that transaction. You will be notified, and the privacy practices described in this policy will remain in effect unless we provide updated notice.

We will never sell your personal data, share it with advertisers, or disclose individual resident account data to municipalities.

Future commercial features: If Townzy introduces features such as opt-in local business offers or aggregate data partnerships, we will update this policy before those practices begin and give you meaningful choices about participation. Those features will be strictly opt-in.

5 — Third-Party Services

All providers receive only the minimum data required for their stated function. All data transmitted between the app and these services is encrypted in transit using TLS.

6 — Data Retention

• Account data — retained while your account is active. Permanently deleted within 30 days of account deletion.
• Public event records — municipal event data is retained as a permanent civic record. Not linked to your personal account.
• Push notification tokens — removed when you disable notifications or delete your account.
• Crash and performance logs — retained for 90 days by Firebase, then automatically deleted.
• Anonymized aggregate data — non-identifying statistics may be retained indefinitely for service improvement.

7 — Your Rights and Choices

Within the app:

• View and edit your name, email, phone number, town, and category preferences in the Profile section at any time.
• Notification control — adjust or disable all push notifications in Notification Preferences, or revoke at the device level in system settings.
• Account deletion — permanently delete your account and all associated data from the Profile section. Data removed within 30 days.

By contacting privacy@mytownzy.com:

• Access — request a copy of the personal data we hold about you, including any inferences derived from it.
• Correction — request that we correct inaccurate or outdated data.
• Portability — request your data in a portable, machine-readable format.
• Deletion — request deletion of your data (available via email if you no longer have app access).

We will respond within 45 days. In complex cases, we may extend this by an additional 45 days with notice.

8 — Children's Privacy

Under 13 (COPPA): Townzy is a general-audience civic information app rated 4+. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected data from a child under 13, contact us at privacy@mytownzy.com and we will delete it promptly.

Minors under 18: Townzy does not engage in targeted advertising, build behavioral profiles, or sell user data for any users, including minors. The app displays publicly posted municipal event information — the same civic content accessible on town websites.

If you are a parent with questions about your child's use of Townzy, contact us at privacy@mytownzy.com.

9 — Connecticut Residents — CTDPA

If you are a Connecticut resident, you have rights under the Connecticut Data Privacy Act (CTDPA), effective July 1, 2023, as amended through July 2026.

• Right to confirm — confirm whether we process your personal data.
• Right to access — obtain a copy of the personal data we hold, including any inferences made from it.
• Right to correct — request correction of inaccurate personal data.
• Right to delete — request deletion of your personal data.
• Right to portability — receive a copy of your data in a portable, usable format.
• Right to opt out of sale — we do not sell personal data. No action needed.
• Right to opt out of targeted advertising — we do not conduct targeted advertising. No action needed.
• Right to opt out of profiling — we do not use automated profiling for decisions that produce legal or significant effects on you. No action needed.
• Right to appeal — if we decline to act on your request, email privacy@mytownzy.com with "CTDPA Appeal" in the subject line. We will respond within 60 days.

To exercise any right, email privacy@mytownzy.com. We will respond within 45 days.

10 — California Residents — CCPA/CPRA

If you are a California resident, you have rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to know — the categories of personal data we collect and how we use it (Sections 2 and 3).
• Right to access — request a copy of the personal data we hold about you.
• Right to correct — request correction of inaccurate data.
• Right to delete — request deletion of your personal data (Section 7).
• Right to portability — receive your data in a portable format.
• Right to opt out of sale or sharing — we do not sell or share personal information for cross-context behavioral advertising. No opt-out is needed.
• Non-discrimination — we will not discriminate against you for exercising any CCPA/CPRA rights.

To exercise these rights, contact privacy@mytownzy.com.

11 — Data Security

Your data is stored in Google Cloud (Firebase) infrastructure. Google maintains industry-standard security certifications and encrypts data at rest. All data transmitted between the app and Firebase is encrypted in transit using TLS.

Access to your account is protected by Firebase Authentication. When you use Sign in with Google or Sign in with Apple, your password is never stored by Townzy directly.

No system is completely secure. We take reasonable technical and organizational measures to protect your data. If you discover a security concern, contact us at privacy@mytownzy.com.

12 — Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by email before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

If you object to material changes, you may delete your account before the changes take effect.

13 — Contact Us

Email: privacy@mytownzy.com
Mailing address: Townzy, Connecticut, USA

This Privacy Policy applies to the Townzy mobile application (iOS and Android) and associated web services, including publicly shared event pages and the full town schedule web experience.