What happens to your data

Cityhoppd is run by Bernardo Carvalho, in Brazil. He is the controller of your personal data under Brazil's General Data Protection Law (LGPD, Lei nº 13.709/2018), and the person to write to about it.

Write to privacy@cityhoppd.com about anything on this page.

• Your account. Your email address, your name, username, bio and avatar colour, and your password — kept only as a one-way hash by the sign-in service, so nobody can read it.
• If you continue with Google, Google tells the sign-in service your name, email address and the link to your Google profile picture, and you have no password with Cityhoppd unless you set one.Cityhoppd uses the name and the address; it never shows the picture. Google learns that you signed in here.
• Your travel record. The trips, cities and places you log, with the dates, nights, costs, ratings, reviews and notes you add; the names of companions you type in; your favourite trips; and who you follow and who follows you.
• Your lists. The titles, descriptions, city IDs, the order you put them in, the notes you write under them and the visibility settings of lists you create. Templates copy cities from your trips once; they do not update themselves.
• Your likes. Which lists and reviews you liked, and when.
• Feedback you send from Settings → Feedback: what kind it is and what you wrote, with your name and username, and your email address only if you tick the box asking for an answer.
• Sign-in records. When you sign in, the sign-in service records the time, your IP address and your browser, to keep accounts secure.
• Visit counts. Which pages are opened, the site that sent you there, and your browser and kind of device; and, when an account is made, a trip is logged or Quick add is finished, that it happened and how many cities it had. PostHog counts these without cookies and without storing anything on your device: it tells one visitor from another by a code it makes from your IP address and browser with a key it throws away each day, and then drops the IP address without keeping it. The counts are never linked to your account, name or email, and nothing you type is in them. If your browser sends Do Not Track or Global Privacy Control, nothing is counted.

It does not use advertising, and it never asks your device for its location. Your data is not sold or shared for marketing.

• To run the service you signed up for: keeping your record, showing it to the people you choose, and building the public city pages from the reviews you make public. That is the performance of a contract with you (LGPD, art. 7, V).
• To keep accounts and the service secure, and to fix what breaks: sign-in records and short-lived server logs. That is a legitimate interest (art. 7, IX).
• Email only for your account: to confirm your address and to reset your password. No newsletters, no marketing.
• To read and answer your feedback, and to fix or improve what it is about. That is a legitimate interest (art. 7, IX), and you choose whether to be answered.
• To learn how people find Cityhoppd and where they get stuck — which pages are visited, where visitors came from, and how many go on to make an account and log a trip — from visit counts that are not tied to anyone. That is a legitimate interest (art. 7, IX).

You decide in Settings → Privacy. A new account starts public: everyone with an account can see your profile and trips, your city reviews appear on the city's page, and your Friends tab is shown. You can change each of these at any time, down to only you. Accounts made before 11 October 2026 keep the settings they had.

• Profile and trips can be seen by everyone with an account, only by your friends — the people you follow — or only by you. Being followed by someone opens nothing to them. Anyone who can see a trip sees what is on it, companions' names included, so add only people who are happy to be named.
• City reviews appear publicly — on the city's page, to anyone, signed in or not — only when both your profile and your reviews are set to Everyone. They show your name.
• Lists start visible only to you. On each list you can choose Only me, Friends (the people you follow), or Everyone who can see your profile. A list is never more visible than your profile, and signed-out visitors cannot read it. Lists are reached from your profile; they do not appear on Home, in city browsing or in search. Notes on a list are seen by whoever can see the list.
• Likes on a list or a review are shown as a number to the people who can see it. Nobody, its author included, can see who liked it. Only public reviews can be liked, and never your own. The reviews you liked are listed on your profile, where only you can see them.
• Following is instant: anyone signed in can follow you, and you appear on their profile's Friends tab as followed by them. When you follow someone, they see your name and username among their followers, even if your profile is private; nothing else of yours opens to them, and they can remove you. Who you follow and who follows you start visible to everyone who can see your profile; you can keep them to yourself. If you follow someone, or they follow you, you can appear on their Friends tab when they show it, but only to people who can already see your profile.
• Finding people. Anyone signed in can find your profile by your name or username when they can see it. Someone who types your exact username finds your profile even when it is private, but sees only that username there, and can follow you.
• Link previews are off until you turn them on, from Share on your profile or in Settings → Privacy. Then a link to your profile shows your name, username, avatar colours, your map and how many cities and countries you have logged to anyone who gets the link, even without an account, but never while your profile is set to only you. Apps that already showed a link may keep their copy of it for a while after you turn previews off.
• Story pictures of your map and counts are made only for you, when you ask for one, and go only where you post them.
• Your email address is never shown to anyone.
• Feedback is read only by Bernardo Carvalho, who runs Cityhoppd. Nobody else sees it, and it is never published.
• Travel badges and their progress are calculated only from the trips, city visits, place visits and reviews each viewer can already see. Hidden records do not contribute to that viewer's badges. Badges are calculated when viewed and are not stored separately.

These services do part of the work, and each sees only what its part needs:

• Supabase — the database and the sign-in service. Your account and record are stored in São Paulo, Brazil.
• Vercel — hosts the website and runs its server, in the United States.
• Resend — sends the account emails, and delivers your feedback by email.
• Cloudflare — manages the domain name, and forwards mail sent to privacy@cityhoppd.com.
• PostHog — keeps the visit counts, in the United States. Your browser sends them to Cityhoppd's own address, which passes them on without your sign-in cookies.
• Google — signs you in when you choose Continue with Google, and hosts the inbox where your feedback and mail to privacy@cityhoppd.com arrive.

Because the website runs in the United States, using Cityhoppd means some of your data is processed outside Brazil. City photographs come from Wikimedia Commons, but they are fetched by the server: your browser only contacts Wikimedia if you follow a photo's credit link.

• Sign-in cookies keep you signed in.
• A cookie for a new account, kept for 30 minutes, lets the page that made it sign you in once you confirm your email, even when you confirm it on another device.
• Unfinished work — trips you log and cities in quick add are saved to your account as you go, and words once you leave the box you are typing them in. Words you have not finished, and anything that could not be saved yet, wait in your browser's storage on that device: what could not be saved is saved the next time Cityhoppd opens there, and unfinished words stay until you finish or discard them.

Visit counts use no cookies and store nothing on your device, and there are no advertising cookies, so there is nothing to accept or decline.

Your account and record are kept until you delete them. Deleting a trip removes it at once; deleting your account removes your profile and everything you logged at once, including your lists and their cities. A like goes when you take it back, when the review or list it was on is deleted, or with either account.

Feedback is kept with your account and deleted with it. The copy that arrived by email is deleted when you ask for it to be.

Visit counts are kept by PostHog for one year. They are not tied to your account, so deleting it does not remove them.

Sign-in records, server logs and backups held by the services above are removed on their own schedules, which are limited in time.

Under the LGPD (art. 18) you can ask to confirm whether Cityhoppd holds data about you and get a copy of it; correct it; have it anonymised, blocked or deleted; receive it in a common format to take elsewhere; know who it is shared with; and withdraw consent for anything that depends on it.

• Edit your profile and who sees it in Settings.
• Delete a single trip from its own page.
• Edit or delete a list from its own page, reached from your profile.
• Unfollow someone or remove a follower on your profile's Friends tab.
• Delete your whole account in Settings → Account. It asks for your password (or, for an account made with Google, your username), and it cannot be undone.

For anything else, such as a copy of your data, write to privacy@cityhoppd.com from the address on your account. You will get an answer within 15 days. If you are not satisfied, you can complain to Brazil's data protection authority, the ANPD.

Cityhoppd is not meant for children under 13. If you believe a child has made an account, write to privacy@cityhoppd.com and it will be deleted.

When this page changes, so does the date at the top. If a change affects how data you have already given is used, you will be told before it applies.