Privacy Policy

Rate My City ("we," "us") publishes crowdsourced city reviews. This policy explains what information we collect when you use the site, why we collect it, and the choices you have.

Information we collect

• Reviews and vendor submissions. The city, review category scores, review text, an optional display name, and (for vendor listings and claims) business contact details you choose to submit. Reviews can be posted without creating an account — see "Anonymous reviews" below.
• Account information. If you create an account (currently used for vendor claim management and admin access), we store your email address and authentication credentials via our authentication provider, Supabase.
• Payment information. Vendor claim subscriptions are billed through Stripe. We never see or store your card number — Stripe handles payment data directly under its own privacy policy.
• Technical and usage data. IP address and basic request metadata, used for spam/bot prevention (Cloudflare Turnstile) on review and listing submissions, and aggregate, privacy-respecting traffic analytics (see Cookie Policy).
• Photos. Any photos you upload with a review or vendor listing, stored via Supabase Storage.

Anonymous reviews

You do not need an account to submit a review — the author name field is a free-text display name, not a verified identity. We still record technical metadata (like IP address, retained only for spam/abuse prevention) against every submission regardless of whether it's tied to an account, and every review passes through moderation before it becomes public. See Community Guidelines for the review policy and moderation process.

How we use information

• To display approved reviews, scores, and vendor listings publicly.
• To operate the moderation queue and enforce our Community Guidelines.
• To process vendor claim payments and manage subscriptions.
• To prevent spam, fraud, and abuse of the submission forms.
• To measure aggregate site traffic and improve the product.
• To respond to support, legal, and DMCA requests.

Legal basis for processing (EEA/UK visitors)

If you're in the European Economic Area or the UK, we process personal data under these legal bases:

• Consent — non-essential cookies and advertising (Google AdSense), which we only set after you accept in the cookie banner (see Cookie Policy).
• Contract — processing needed to create an account or run a vendor claim subscription you've signed up for.
• Legitimate interests — operating and securing the Service, preventing spam/fraud/abuse, and aggregate traffic analytics, balanced against your rights and interests.
• Legal obligation — responding to valid legal requests and meeting tax/accounting requirements.

International data transfers

Rate My City and the service providers listed below (Supabase, Stripe, Cloudflare, Vercel, Google) may process and store data in the United States or other countries outside your own. Where we transfer personal data from the EEA, UK, or Switzerland, we rely on the transfer mechanisms those providers make available, such as Standard Contractual Clauses, as required by applicable law.

Third parties we share data with

We don't sell personal information. The services below process data on our behalf, each under their own privacy policy:

• Supabase — database, authentication, and file storage.
• Stripe — payment processing for vendor claim subscriptions.
• Cloudflare — network security and bot verification (Turnstile) on submission forms.
• Google AdSense — displays advertising and may set its own cookies/identifiers, only after you consent to non-essential cookies. See Cookie Policy.
• Vercel Analytics — aggregate, privacy-respecting page-view analytics; does not use tracking cookies or store personal identifiers. See Cookie Policy.
• Vercel — application hosting.

Data retention

Reviews, scores, and vendor listings are retained indefinitely as the site's core content, unless removed under our moderation policy or a valid legal request. Account and payment records are retained as needed to operate claims/subscriptions and to meet tax and accounting obligations.

Your rights

You can request a copy of, correction to, or deletion of personal information we hold about you (an account email, or a review tied to your account) by contacting us at contact@ratemycity.app. Because anonymous reviews aren't tied to an identity, we can only locate and remove them if you provide enough detail (city, review text, approximate submission date) to identify the specific entry. Removing a review does not retroactively change a city's historical score history derived from it at the time it was public.

If you're in the EEA, UK, or another jurisdiction with similar data protection law, this also includes the right to: access the personal data we hold about you; rectify inaccurate data; erase your data; restrict or object to certain processing; receive your data in a portable format; and withdraw consent at any time where we rely on consent (e.g. non-essential cookies). You also have the right to lodge a complaint with your local data protection supervisory authority.

Children's privacy

Rate My City is not directed at children under 13, and we do not knowingly collect personal information from them.

Changes to this policy

We'll update the "Last updated" date above when this policy changes. Material changes affecting how we handle previously collected data will be posted here before taking effect.

Contact

Questions about this policy: contact@ratemycity.app or the Contact page.