Privacy Policy

This Privacy Policy explains what information 17988117 CANADA CORP., operating as ShowMeThirdPlaces (“we,” “us”), collects, how we use it, and the choices you have. ShowMeThirdPlaces is a community-powered directory for finding “third places” — cafes, libraries, parks, and other spots to work, study, and gather. This policy is a notice about our practices; it does not waive privacy rights that apply to you.

Information we collect

Information you provide

• Account details. When you register, we collect your email address, a display name, and a password. Passwords are never stored in plain text — they are salted and hashed before storage.
• Account security. We store hashed email-verification, password-reset, and sign-in challenge tokens. If you trust a browser, we store a hashed trusted-device token for up to 30 days. Administrators can enroll an authenticator app; its secret is encrypted and recovery codes are stored only as one-way hashes.
• Contributions. Content you add to the service — attribute observations, third-place-fit ratings and reviews, tips, photos, place or activity submissions, and closure, cancellation, or correction reports. Eligible observations and activity submissions may be associated with an optional account or with a private guest identifier stored in an essential browser cookie. Approved contributions may be shown publicly alongside the relevant place or activity.

Information collected automatically

• Essential cookies. We use a session cookie when you sign in and an optional trusted-device cookie when you ask us to remember a browser. If you contribute without an account, we use a separate private guest cookie so only that browser can update or withdraw eligible contributions. These cookies are not used for advertising or cross-site tracking.
• Saved places. Signed-out favorites are stored locally in your browser. When you sign in, saved places can be synchronized to your account so they are available across devices; deleting the account removes that server-side list.
• Activity personalization. If you enter an exact age or a starting address for activity discovery, the age and geocoded origin are kept only in this browser tab's session storage. They are sent in a private, non-cacheable request, are not added to URLs or account preferences, and are excluded from analytics and application request logging.
• Network and device information. IP addresses and user-agent information are processed to enforce rate limits, verify sign-in challenges, and protect the service. Where the application retains these security signals, it stores shortened hashes rather than the raw IP. We do not use them to build an advertising profile.
• Privacy-friendly analytics. When enabled, we use Plausible Analytics, which is cookieless and does not collect personal data or track you across sites. It gives us only aggregate metrics such as page views and referrers.
• Error diagnostics. When enabled, we use Sentry to capture scrubbed technical details about errors so we can fix problems. We disable default personal-information capture and remove user, cookie, authorization-header, form-data, and query-string fields before sending an event.

How we use your information

• To create and maintain your account and authenticate you.
• To display, attribute, and moderate the contributions you make.
• To operate, secure, and improve the service, including preventing abuse and spam.
• To send you transactional emails you request or that are necessary to the service, such as password-reset messages. We do not send marketing email.

Service providers

We share information only with the vendors that help us run the service, and only as needed for them to perform their function:

• Vercel — application hosting and content delivery. Vercel also provides firewall and rate-limiting protection.
• Supabase — hosting of our PostgreSQL database, where account records, security records, and contributions are stored.
• Mapbox — renders the interactive maps. Your browser loads map tiles directly from Mapbox. When you choose to search for an activity origin, our rate-limited proxy also sends the search text to Mapbox using temporary geocoding results. Mapbox processing is subject to Mapbox’s own privacy policy.
• Our transactional email provider — delivers account-verification, new-device sign-in-code, and password-reset messages.
• Plausible and Sentry — analytics and error monitoring, when enabled.

We do not sell your personal information, and we do not share it with third parties for their own advertising.

Place data and attribution

Information about the places themselves (names, addresses, categories, and similar details) comes from sources including Yelp and OpenStreetMap contributors, combined with community contributions. OpenStreetMap data is © OpenStreetMap contributors, available under the Open Database License. This place data is not personal information about you.

Data retention

We keep your account information for as long as your account is active. Public contributions may remain visible as part of the community record even if de-identified. When you delete your account, we remove or anonymize your personal information, except where we must retain it to comply with legal obligations or resolve disputes.

Guest cookies expire after one year. Clearing that cookie sooner removes this browser’s ability to update or withdraw its earlier eligible contributions unless they were first attached to an account.

Emailed sign-in challenges expire after ten minutes. Trusted-device cookies expire after 30 days, and administrator verification cookies expire after 12 hours. Security and moderation records may be retained longer when reasonably necessary to investigate abuse, protect the service, or meet a legal obligation.

Transactional-email audit events contain a keyed recipient hash rather than the address itself and are removed after 90 days. They let us enforce a fixed sending budget and investigate delivery failures.

Your choices and rights

• You can review and update your account information from your profile page.
• You can request access to, correction of, or deletion of your personal information by contacting us.
• You can stop providing contributions at any time, and you can delete your account.

Depending on where you live, you may have additional rights under laws such as PIPEDA, the GDPR, or the CCPA. To exercise any of these rights, email us at showmethirdplaces@halfwoods.com.

How to make a privacy request

Email showmethirdplaces@halfwoods.com with the subject “Privacy request” and say whether you want access, correction, deletion, or an explanation of our handling. Send the request from your account email when possible. We may ask for limited additional information to verify that we are responding to the right person. We will acknowledge the request and respond within the period required by applicable law, or explain any permitted extension.

Cookie-consent position

We currently use only cookies and browser storage needed for sign-in, security, guest-contribution control, preferences, and locally saved places. Plausible analytics is configured without cookies or cross-site tracking. For that current setup we do not show a generic cookie banner, because there is no optional advertising or behavioural-tracking cookie to accept. If we introduce a non-essential cookie or tracking technology that requires consent, we will add an appropriate consent control before enabling it.

Security

We use safeguards including encrypted connections (HTTPS), hashed passwords, expiring sign-in codes, session revocation, trusted-device controls, and authenticator MFA for administrator access. No system is perfectly secure, but we work to protect your information and to respond promptly to any issues.

Children’s privacy

The service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

International users

We operate the service from, and store data with providers located in, jurisdictions including Canada and the United States. By using the service, you understand your information may be processed in these locations.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will revise the “Last updated” date above and, where appropriate, provide additional notice.

Contact us

Questions about this policy or your information? Email us at showmethirdplaces@halfwoods.com. See also our Terms of Service.