Privacy Policy

01Who we are

TownRatings is operated by Cullinet LLC. For anything in this policy, use our contact form or email [email protected].

02Information we collect

• Account information. When you create an account: your name, email address and a password. We store only a one-way hash of the password (bcrypt), never the password itself. We also record whether you’ve confirmed your email, when you signed up, how many times you’ve signed in and when you last did.
• Profile details you choose to add. A display name, an @handle, a short bio, a profile photo, your home town and the towns you follow.
• Sign in with Google. If you choose “Continue with Google”, Google tells us your name, your email address and whether Google has verified it. We never receive your Google password.
• What you post. Where TownRatings lets you contribute (posts, replies, questions, facts, photos), what you contribute is linked to your account and shown publicly with your display name.
• Messages you send us. Through the contact form: your name, email address, the topic and your message.
• Technical data. Like every website, each request to TownRatings carries your IP address and browser details. Cloudflare and our web host receive them to deliver and protect the site. To limit abuse (password guessing, spam), we count attempts per IP address and per email address; those counters store only a one-way hash, never the address itself, and expire within a day.

03Accounts and posts from our earlier community site

TownRatings succeeds our earlier community site. If you had an account there, your account, profile and the posts and replies you shared have moved here, under the same email address and settings. You can sign in to edit or delete any of it, or close your account in Settings, and we’ll remove it as this policy describes. For questions, use our contact form or email [email protected].

04How we use it

• To create your account, keep you signed in and keep the account secure.
• To show your profile and the things you choose to post.
• To send the emails the site needs: confirming your address, sign-in links, password resets and notices about changes to your account. We don’t send marketing email.
• To answer messages you send us, and to correct data you tell us is wrong.
• To prevent abuse, moderate content and keep the site running.

05Cookies and browser storage

• One session cookie. It’s set only when you sign in or use a form (sign-in, account settings, the contact form), so the site knows it’s you and can block forged form submissions. It can’t be read by scripts, and a session ends after 2 hours without activity or 12 hours after you sign in.
• Storage in your browser. The site remembers the towns you recently visited and your Compare priorities in your browser’s local storage, so it can show “Recently visited” and keep your choices. This stays on your device and is never sent to us; the “Forget” link clears the list.
• Cloudflare. Cloudflare protects the site and may set cookies it needs for security. When the “I’m human” check (Cloudflare Turnstile) appears on a form, Cloudflare processes the information it needs to tell people from bots.
• We don’t use advertising cookies, and TownRatings shows no ads.

06Analytics

We use Google Analytics 4 to count visits and see which pages people find useful. It sets its own first-party cookies (named _ga and _ga_…) and sends Google your browser details, the pages you view and an approximate location derived from your IP address. Google processes this under its own privacy policy. Google signals and ads personalization are turned off for this site, and Google Analytics keeps this data for 2 months, its default, before deleting it.

Outside the United States (and wherever we can’t tell where you are), Google Analytics is off until you choose “Accept” on our cookie banner: until then nothing is loaded from Google Analytics and none of its cookies are set. You can change your choice at any time from “Cookie settings” at the foot of every page; choosing “Reject” then also deletes the _ga cookies. We use Google’s Consent Mode to pass your choice to Google, with advertising storage and ad personalization always off.

If your browser sends a Global Privacy Control signal, we treat it as an opt-out, as described on our Do Not Sell or Share page.

07Who helps us run TownRatings

We use a few service providers. They handle data only to provide their service to us:

• Cloudflare: delivers and protects the site (it sees every request, including your IP address), runs the Turnstile check on forms, and stores profile photos (Cloudflare R2).
• Our web host: runs the servers and database, and sends our emails (sign-in links, confirmations, password resets) from our own mail server.
• Google: Sign in with Google, if you use it; and the site’s fonts (Google Fonts), which your browser loads from Google.

Some pages show images and maps from other services, such as Wikimedia Commons photos and OpenStreetMap map tiles; your browser loads those from them directly. Share buttons and “Directions” links (Facebook, Google Maps and others) only contact those services if you click them.

09Public data on our pages

Town pages are built from public sources: federal and state agencies (such as the Census Bureau, FBI, CDC, Department of Education and FEMA), open datasets (such as Wikidata, Wikipedia and OpenStreetMap), housing data from Zillow and Redfin, and information neighbors have contributed. Some of it names people in their public roles, such as elected officials, local offices and notable residents. If something about you is wrong or you want it reviewed, use our contact form or email [email protected].

10How long we keep it, and closing your account

• Your account is kept while it’s open.
• Closing your account (Settings → Close account) signs you out everywhere and wipes your personal details: your name is replaced with “Former neighbor”, your display name, handle, bio, home town and pending email change are erased, your email address is replaced with a placeholder, your password is replaced with a random one, your profile photo and followed towns are deleted, and any sign-in or reset links stop working. The account record itself stays, so things you posted keep a (now anonymous) author. To have those posts removed too, use our contact form or email [email protected].
• Contact messages are kept for 2 years.
• Server logs at Cloudflare and our host are kept for about 30 days.
• Abuse counters (hashed) expire within a day; one-time email links expire within 48 hours and are then cleared out.

11Your choices and rights

You can see and change your profile, email and password in Settings, and close your account there at any time. You can also ask us for a copy of your personal information, to correct it, or to delete it: use our contact form or email [email protected]. Depending on where you live (for example California, Colorado, Connecticut, Virginia and other U.S. states, or the EU and UK), you may have further rights under your local law; we honor them for everyone. We may ask you to confirm a request from the email address on your account. You can use an authorized agent, and we won’t treat you differently for using any of these rights.

12If you’re in the UK or Europe

If you use TownRatings from the United Kingdom, the European Economic Area or Switzerland, the UK GDPR and the Data Protection Act 2018, the EU General Data Protection Regulation, or the Swiss Federal Act on Data Protection give you the rights below. This part of the policy applies to you as well as the rest of it.

• Controller: Cullinet LLC, in the United States, decides how and why your personal information is used. To reach us, use our contact form or email [email protected].

Why we use your information (lawful bases)

• To provide the service you asked for (performance of a contract): for members who already have an account, running your account, your profile, showing what you choose to post, and the emails the site needs to send.
• Our legitimate interests, balanced against yours: keeping the site secure and free of abuse (rate limits, server logs, Cloudflare’s protection), moderating posts, answering messages you send us, and correcting the data on our pages.
• Your consent: Google Analytics cookies. You can withdraw it at any time from “Cookie settings”, and withdrawing doesn’t affect what happened before.
• Legal obligations: when the law requires us to keep or disclose information.

New accounts. We currently accept new sign-ups only from the United States, so you can’t create an account, or post in Town Square, from the UK, the European Economic Area or Switzerland. You can still read everything on TownRatings. If you already have an account, you can sign in and use it as before, and we keep relying on the contract basis above for it. We tell where you are from the country your connection appears to come from.

Your rights. You can ask us for a copy of your personal information, and to correct it, delete it, restrict how we use it, or send it to you or another service in a portable format. You can object to any use based on our legitimate interests, and withdraw consent at any time. We don’t make decisions about you based solely on automated processing. To use any of these rights, use our contact form or email [email protected]. We’ll answer within one month, and may ask you to confirm the request from the email address on your account.

Complaints. We’d like the chance to put things right first, so please contact us. You also have the right to complain to a data protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk, 0303 123 1113); in the EEA, the authority in the country where you live or work (the European Data Protection Board lists them); in Switzerland, the Federal Data Protection and Information Commissioner.

International transfers. TownRatings is run from the United States, and our service providers (Cloudflare, Google and our web host) process information in the United States and elsewhere, so your information is handled outside the UK and Europe. Where a provider is certified under the EU-U.S. Data Privacy Framework and its UK Extension (as Google and Cloudflare are), we rely on that; otherwise on the European Commission’s standard contractual clauses with the UK Addendum.

How long we keep it. As set out in How long we keep it above. Your cookie choice is kept for 6 months, and Google Analytics keeps what it collects after you accept for the period described under Analytics.

13Security

The site is served only over HTTPS. Passwords are stored as bcrypt hashes; sign-in, confirmation and reset links are single-use, expire, and are stored only as hashes; and sessions end after a period without activity. No system is perfectly secure, so please use a password you don’t use elsewhere.

14Children

TownRatings is not directed to children under 13, and we don’t knowingly collect their personal information. If you believe a child under 13 has given us information, use our contact form or email [email protected] and we’ll delete it.

15Changes to this policy

If we change this policy, we’ll post the new version here with a new effective date.

16Contact

Questions about this policy? Use our contact form or email [email protected].