Privacy Policy

Sign-up asks for a date of birth so we can check that you are at least 16. Your date of birth stays private: no birthday or exact age is shown to other members, and a correction has to go through the team rather than being edited from the browser.

Each account is classified into one of two tiers derived from the date of birth: Ages 16–17, or 18+. The tier, not the birthday, is what the rest of the product acts on: separating who can be discovered, contacted and invited, and which event audience an account may use.

We store your email address and sign-in identity, and the profile you choose to fill in: name, photo, city and country, approximate location, languages, education, profession, bio, interests, connection goals and privacy settings.

Other members only ever see an approximate distance, never your coordinates. Accounts in the Ages 16–17 tier have precise coordinates cleared automatically, and hide the exact city and any distance by default. Fields you hide (education, profession, exact city) are removed on the server before anything is sent to another member. Uploaded photos are kept in scoped storage rather than on openly listable public URLs.

We also store connections and connection requests (including any personal note you attach), conversations and messages, events and RSVPs, notifications, and the blocks and reports you submit. Reports keep the reason, any details you add and a timestamp, and are shared with the CityBridge team for review. Blocks are recorded so contact is prevented in both directions.

You can see and edit your profile fields in the app, ask us to correct information you cannot edit yourself (such as a mistyped date of birth), deactivate your account from Settings, and delete it from Settings. Deletion signs you out everywhere and removes your sign-in, profile, birth date, photos, interests, connections, requests, RSVPs, notifications, blocks and comments. Messages you sent stay in the other person's chat as "Message deleted"; upcoming events you host with guests are cancelled and guests are told; past events and posts others replied to stay without your name. Reports you filed are kept without your name, safety reports about an account are kept for 12 months, and a dated record of the deletion is kept. Self-service data export is planned for later; email us and we will put a copy together.

Access is restricted by server-side rules rather than only in the interface. Live now: you can read and change only your own records, conversations are readable only by their participants, and blocked members cannot reach you. Profile lookups honour your visibility settings field by field, and this is checked by automated tests.

We will update this page as CityBridge changes, and in particular when a planned safeguard becomes live and tested.