CityCrumbs is operated by CityCrumbs, Inc. ("CityCrumbs", "we", "us"), a Delaware corporation. You can reach us at hello@citycrumbs.com, and we will provide a postal address on request.
This policy covers both this website and the CityCrumbs mobile app for iOS and Android.
If you join the waitlist, we collect the phone number you enter and the date you submitted it. We record that you agreed to receive text messages, along with the exact wording you agreed to, so we can demonstrate consent if asked. Stored alongside it are the city the form was set to, which form you used, your browser's user-agent string, and a one-way hash of your IP address — we keep the hash rather than the address itself, and it exists to evidence that consent, not to identify you. When you join, we also ask Twilio whether the number is a mobile line, because we can only text mobiles, and we store the answer.
Your phone number is never sent to our analytics or advertising partners. The tools below are set up not to read anything you type into the form.
This website, and the public pages for crumbs, lists, places and profiles, use Google Analytics and PostHog to see how they are used, and Google Ads to show CityCrumbs ads to people who have visited. They record the pages you view, the site that sent you, a few actions — tapping a "join" button, and whether a waitlist signup worked — your browser and device type, and an approximate location worked out from your IP address. Embeds of our pages on other websites carry none of this, and neither do pages for a profile nobody has claimed yet.
These tools use cookies and similar browser storage, but only if you press Accept All when the site asks about cookies:
_ga and _ga_…) — tells repeat visits apart; lasts up to two years_gcl_…) — lets Google show our ads to past visitors (remarketing). If you are signed in to Google and allow ad personalisation, Google may also link your visit to your Google accountph_…_posthog, and the same in local storage) — tells repeat visits apart; lasts a yearOne more cookie is our own, and it is set only when you answer: cc_consent remembers whether you pressed Accept All or Required Only, so we do not ask on every page. It holds only "yes" or "no" and lasts 13 months.
Until you answer, nothing is stored in your browser for analytics or ads, and if you press Required Only it stays that way. We still count the visit, without cookies: Google Analytics and PostHog receive the page view, a tap on a "join" button and whether a waitlist signup worked, and PostHog tells visits apart using a code worked out on its server from your IP address and browser that changes every day, so nothing is stored on your device. Google Ads remarketing stays off. Session recording, heatmaps and click tracking are never turned on, whatever you choose. If you press Accept All, Google's cookies start at once and PostHog's on the next page you open.
The website's fonts are served from our own servers, so loading a page does not send your visit to a font service.
When you create an account we collect your email address, username, display name, and optionally a profile photo, a short bio, and a home city you type in yourself.
You can sign in with Google or with Apple instead of a password. From Google we receive your basic Google profile information. From Apple we receive an identifier, your email address, and — only on the very first sign-in — your name. If you use Apple's Hide My Email, we only ever see the relay address Apple gives us, never your real one.
If you sign in with Google and keep your Google profile photo, it loads from Google's servers, so Google can see when someone views it.
We collect the content you create: the places you save, your notes about them, photos and videos you upload, the lists you build, and who you follow.
We send uploaded photos, including profile photos and list covers, to Google Cloud Vision SafeSearch to check for adult or very likely violent imagery. For a video, our server extracts its first still image and sends that image for the check. We do not send the full video or its audio to Vision. We store the result of the check.
Screening happens after upload, so media may be visible before it is checked. If the check is delayed or fails, the media stays visible while we retry. If it flags adult or very likely violent imagery, we stop serving the public file and keep a private copy for review, accessible only to you and our authorised operators. Copies already loaded or cached elsewhere may still be visible. We email you and our operators about the hold through SendGrid. If you think a hold is wrong, contact hello@citycrumbs.com.
The app asks permission to use your location, camera, photo library, and microphone. These are used to show nearby places and to let you attach media to a recommendation. You can decline any of them, and you can change your mind later in your device settings — parts of the app will simply not work. When you search for a place, what you type and your current location (if you allowed location access) go to our own server, which passes them to Google Maps so the results are near you; we hold the Google key there so it never ships inside the app.
Your location also leaves your phone in two other ways. The maps in the app are Apple Maps on iPhone and Google Maps on Android, so Apple or Google receives requests for the area of map on your screen. When you tap "Use my location" while adding a place, your phone sends your exact position to its own address lookup — Apple's on iPhone, Google's on Android — to turn it into an address. And if you ask for directions, the app opens Apple Maps or Google Maps with the place, under their privacy policies, not ours.
We use PostHog to understand how the app is used. This is product analytics, not advertising. When you are signed in, the app tells PostHog your account id, email address, username and display name, so a person's use of the app can be followed across sessions and devices.
If you have already allowed the app to use your location for its features — nearby places, the map, adding a place — the app attaches an approximate location to its PostHog events: your latitude and longitude rounded to two decimal places, which is accurate to roughly 1 km. It also records the distance between you and a place or post you view. Your precise location is never sent to PostHog: it stays on your device and is used only to work out those distances. The app asks for no extra permission for this, and if location access is off, neither your approximate location nor those distances are sent.
When you move the map by hand, the app also records the approximate centre of the map you were looking at, rounded to about 100 m. That is where the map was pointed, not necessarily where you are, and it does not depend on location access.
After you sign out, your location is no longer attached to events. Events already sent are kept for the period in "How long we keep it" below.
We use Sentry to find out when the app breaks. It collects crash reports and error details, your device model and operating system version, and your IP address. We do not attach your account to these reports.
Likes, comments, follows, and list updates are stored as notifications on your account so the app can show them to you, and the unread count is mirrored onto the app icon badge. We do not currently send push notifications, and we do not collect a push token for your device. If that changes we will update this policy first.
You can report a crumb, a comment, a list or an account in the app. When you do, we store:
The copy stays even if the original is changed or deleted later, so we can still look into the report, unless the person who made it deletes their account. When we have dealt with it, we note what we did.
Only we can read a report. Nobody else using CityCrumbs can, and that includes you: once a report is sent, the app cannot show it to you again. We never tell the person you reported that it was you. We are also told about reports by email. The email says what kind of thing was reported and why, with a link to the report in our records. It never says who reported it or who it is about, and it stays in our mailbox after the report is deleted.
To stop report spam and repeated emails, we also keep short-lived records, such as how many reports an account sent today, stored under a one-way hash of its account id, and when we last emailed about the same thing. The ones about an account or a reported thing expire 1 to 2 days after the last report or email they count, and are then deleted automatically, usually within a day.
Blocking someone stops them from following you or your lists, commenting on or liking your crumbs and lists, recrumbing them, and sending you notifications. It also ends any follows between you, both ways, including follows of each other's lists, and unblocking does not bring them back. What you publish stays public, and they can still see it.
Blocking does not delete what they did before: their old comments, likes and recrumbs stay, and so do notifications from them. In the app, you no longer see their crumbs, lists or comments, or notifications from them, and they show again if you unblock. They can still report you, and still use the rest of CityCrumbs.
The block is stored on your account: which account you blocked, and when. Nobody else using CityCrumbs can see who you have blocked. We don't tell the person, but they may notice what they can no longer do.
If you delete your account, reports you filed stay, because they are about someone else, but they lose your account id and your note. Reports about you, or about something you made, lose everything we copied from you. The rest stays until the report is deleted: the reason, who reported it and any note they added, what we did about it, and the ids of the item and account it was about, including your old account id. Blocks other people made of your account are deleted, and your own blocks are deleted with your account.
Moderation can hide a crumb or list rather than erase it, so we can review a decision and restore it after an appeal. A removed comment is moved out of its thread into a private archive. Only our authorised operators can read that archive, including when the comment was yours. Restoring a comment moves it back to its thread.
Removing a comment also deletes the notifications it created. Suspending an account deletes notifications it sent to other people. Restoring the comment or lifting the suspension does not bring those notifications back.
We keep a private log of operator actions: who acted, what they did, when, and any note they added. Only our authorised operators can read that log. A separate suspension record holds the suspended account's id and the time it was suspended. Other signed-in people can read an individual suspension record so the app can show a suspended profile as unavailable, but they cannot browse a list of suspended accounts. That record does not show the operator's identity or notes.
We also keep private records of which content and media are held or removed, including the previous file-access codes needed to restore access when all holds on a file have ended. We keep those codes while the file is held and until its release is complete, unless your account is deleted first. To resume interrupted actions, we also keep the latest request to suspend an account or lift its suspension. Only our authorised operators can access these records. They follow the account-deletion periods described next.
Hidden content, archived comments and moderation records can stay while your account is open. Deleting an individual post or comment does not necessarily erase its moderation records. If you delete your account, we remove its hidden content, archived comments, private held media, suspension record and moderation logs within 30 days, along with records used to keep its content removed. If your account acted as an operator on someone else's content, we remove your identity and notes from those records while keeping the other person's protections. Reports follow the separate rules under "Reports and blocks", and the short account-deletion record and backups follow "How long we keep it".
US state privacy laws, California's among them, ask for this summary. Each row is a category of personal information we collect, where it comes from, why, and who receives it. We collect it all in the ways described above, and keep it for the periods in "How long we keep it".
| Category | What | From | Why | Who receives it |
|---|---|---|---|---|
| Identifiers | Name, username, email address, phone number (waitlist), account id, IP address, and cookie or device identifiers | You; your device or browser | Running your account, texting you, delivering app updates, security, analytics, website remarketing | Google Firebase, Expo, Twilio, SendGrid, PostHog, Sentry, Google Analytics, Google Ads, and Google or Apple if you sign in with them |
| Account login | Your email address and password. The password is held by Google Firebase in hashed form; we never see it | You | Signing you in, and nothing else | Google Firebase |
| App and website activity | Screens and features you use, pages you view, the site that sent you, and crash reports | Your device or browser | Fixing bugs, understanding what gets used, website remarketing | PostHog, Sentry, Google Analytics, Google Ads |
| Location | Your location when you search for a place or tap "Use my location"; the area of map on your screen; an approximate location (about 1 km) with app analytics; the rough centre of the map (about 100 m); on the website, an approximate location worked out from your IP address | Your device; your IP address | Showing maps and results near you, turning your location into an address, and analytics | Render and Google Maps (place search); Apple Maps on iPhone and Google Maps on Android (maps and addresses); PostHog; Google Analytics |
| Photos, video and audio | Photos and videos you upload, including any sound in a video; screening results and private copies of flagged media | You; screening results from Google Cloud Vision | Showing what you post; screening for adult or very likely violent imagery and reviewing flagged media | Google Firebase; Google Cloud Vision (photos and the first still image from each video, without audio); anyone who views published media; you and our authorised operators for private held copies |
| What you post and your profile | Places, notes, lists, comments, likes, who you follow, your bio and home city | You; for profiles set up before someone joined, their public posts | Running the service | Google Firebase, and anyone who views it |
| Reports, blocks and moderation | Reports you file: what you reported, the reason, your note, and a copy of what you reported. The accounts you block. Hidden content, archived comments, operator actions and notes, and suspension records | You; the copy, from what you reported; our operators and moderation checks | Looking into reports, reviewing moderation decisions, and keeping blocked people away from you | Google Firebase; SendGrid, which emails us about reports; our authorised operators for private archives and logs; signed-in people for individual suspension records |
| Ad audiences | Google may place a website visitor in an audience, such as "visited citycrumbs.com", so our ads can reach them | Google, from your visit | Website remarketing | Google Ads |
We use your location for place search, and your login, only to give you what you asked for. We do not use them to work out anything else about you.
We do not sell your personal information for money. What the website shares with Google for remarketing is explained under Your privacy choices.
Joining the waitlist means agreeing to receive automated marketing texts at the number you gave us. Message frequency varies. Message and data rates may apply — those are charged by your carrier, not by us.
Reply STOP to any message to stop receiving them. Reply HELP for help. Opting out is immediate and permanent unless you text START to us. We keep your number and the fact that you opted out, and nothing else, so we never text you again unless you do.
We use Twilio to send these messages, so your number is shared with Twilio for that purpose. Carriers are not liable for delayed or undelivered messages.
What you publish is public — every published crumb and list. Content held or removed by moderation is described under "Moderation" above. It is worth reading before you assume anything else.
Public means public on the open web, not just inside the app. Other CityCrumbs users can see what you post, and your crumbs and lists get pages on citycrumbs.com — as do your profile and the places in them — showing your username, your photo, your notes, and the media you attached. Those pages are:
Deleting a crumb or a list removes it from the app straight away, though someone who already has it on screen may still see it until they refresh. Within an hour it is gone from citycrumbs.com too, and an embed of it on another site shows that it is no longer available. A share image can take up to a day.
Deleting stops us serving it, but we cannot make a search engine forget it and we cannot reach a copy someone already took — a screenshot, or a page cached somewhere we don't control. Treat anything you have published as published.
We share data with companies that run parts of the service for us, and only for that purpose:
One more is not only working for us: Google Ads receives information about visits to the website from people who pressed Accept All, so it can show CityCrumbs ads to past visitors, and Google uses it under its own privacy policy as well. See Your privacy choices.
We may also disclose information if the law requires it, or to protect our rights or someone's safety.
Some profiles and lists on CityCrumbs were set up by us, or by a friend as a gift, from places a person or business had already recommended in public — a creator's posts, say, or a venue guide on a website — so that the person behind them can claim the account and take it over. They hold that person's public name and handle, the places, and captions and photos from those public posts. These profiles are public, like any other.
Until September 2026 we also ran an internal tool that turned a publicly posted roundup — a food writer's list of ten restaurants, say — into a draft list for that writer to claim. The tool is switched off. A draft it made holds the public handles and names in the post, the post's address and its caption. Only we can see it, and an unclaimed draft is deleted 30 days after it was made.
If you have found yourself in either and would rather not be, email us and it goes immediately.
Waitlist numbers are deleted 24 months after you join. If you opt out, we keep only your number and the fact that you opted out, for as long as we operate, so we never text you again unless you text START to us. Account data is kept while your account is open. Hidden content, archived comments and moderation records follow the periods described under "Moderation" above. Crash reports are kept for up to 90 days. App and website analytics in PostHog are kept for up to one year, and website analytics in Google Analytics for up to 14 months. Unclaimed drafts from the tool described above are deleted after 30 days. Reports are deleted about 12 months after they are filed. If you delete your account we delete or anonymise your data within 30 days, including the analytics PostHog holds about your account, except reports about you or something you made, which keep the details listed under "Reports and blocks" until they are deleted, a short record that your account was deleted, described next, and records we must keep to comply with the law. That record is kept permanently. It holds your old account id, when the account was deleted, how the deletion went and how much was removed, and whether you used Sign in with Apple and we cut that link, but never any code or token from Apple. If an operator handles the deletion, it also records that operator's account id. We remove that id if the operator later deletes their own account. For up to 15 days after the deletion starts, the record also keeps the ids of the crumbs and lists you owned, so that restoring a backup cannot bring back links to them. Those ids are then deleted automatically. We use it to finish the deletion safely and to stop deleted data coming back, including your name on other people's recrumbs. Anything we delete can stay in our backups for up to 7 days afterwards.
Some privacy laws — the California Consumer Privacy Act, the Delaware Personal Data Privacy Act, the GDPR — grant rights to know what a company holds about you, to have it corrected or deleted, to take it elsewhere, and not to be treated worse for asking. Whether any of them currently applies to a company our size, we extend those rights to everyone who uses CityCrumbs. Email us and we will honour the request.
How we check a request is yours. Before we act on a request, we match it to what we already hold. For an account, we reply to the email address on the account and ask you to confirm. For a waitlist number, we text that number and ask you to reply. We only ask for what we need to verify you, and we use it for nothing else.
Someone can ask for you. You can have an authorized agent make a request on your behalf. We will ask the agent for your signed permission, and we may still ask you to confirm the request with us directly.
The first time you open a page on this website, a box asks whether we may use cookies. Nothing is stored until you answer, and the site works the same whichever you choose.
cc_consent cookie for this browser, so you will be asked again in another browser, after you clear your cookies, or if your browser clears them itself (Safari does this after seven days without a visit).CityCrumbs is not intended for anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, email us and we will delete it.
Data is stored with Google Firebase and protected by access rules, encryption in transit, and encryption at rest. No system is perfectly secure, and we cannot guarantee absolute security.
If we change this policy we will update the date at the top, and for significant changes we will tell you in the app or by email.
CityCrumbs, Inc., a Delaware corporation
hello@citycrumbs.com
For privacy requests, put "Privacy" in the subject line. We will provide a postal address on request.