Privacy Policy
Last updated: August 2026
CityServ is a free, nonprofit volunteer directory for New York City's East Village. This policy explains what personal information we collect, why we collect it, and how you can control it. We keep this short and plain on purpose.
The short version
We never sell your data
Not to anyone, ever
No ad tracking
Cloudflare analytics uses no cookies
Delete anytime
Email us and we remove your account
1. What We Collect
- Email address — When you create an account or sign up with Google
- Display name — When you create an account (you choose this)
- Year of birth — At account creation — used only to verify age eligibility (16+)
- Google profile info — Only if you sign up with Google (name and email from your Google account)
- Review content — Text and rating you submit for a volunteer organization
- IP address and browser type — Recorded only at the moment of review submission for legal compliance and abuse prevention — never shown publicly, never used for tracking
- Site usage data — Via Cloudflare Web Analytics — privacy-preserving, no cookies, no cross-site tracking, no fingerprinting
We do not collect payment information, location data beyond what you voluntarily share in a review, or any health or financial information.
2. Why We Collect It
- To operate your account and authenticate you securely
- To verify that account holders are at least 16 years old
- To send transactional emails (email verification, password resets)
- To prevent spam, abuse, and fake reviews
- To comply with legal obligations and respond to lawful requests
- To understand aggregate site usage so we can improve CityServ
3. How We Use It
We use your data only for the purposes listed above. We do not build advertising profiles, track you across other websites, or use your data for any commercial purpose. Your reviews are published under your chosen display name. Your email address is never shown publicly.
4. Sharing & Disclosure
We never sell, rent, or trade your personal data.
We disclose personal data only in these circumstances: (a) to the third-party service providers listed in Section 5, who process data on our behalf under data processing agreements; (b) when required by valid legal process, such as a court order or subpoena; (c) to protect the rights, property, or safety of CityServ, our users, or the public; or (d) with your explicit consent.
5. Third-Party Services
Hosting, CDN, DDoS protection, and privacy-preserving analytics. Data stored on Cloudflare infrastructure.
Sends transactional emails (verification links, password resets). Receives your email address for delivery only.
Bot-prevention CAPTCHA. No cookies, does not track you across sites.
Optional sign-in method. If you use it, Google shares your name and email with us per their privacy policy.
6. Data Retention
- Account data (email, name, year of birth): retained while your account is active, plus 90 days after deletion for backup recovery
- Published reviews: retained indefinitely unless removed by moderation or at your request
- IP address and browser type logged at review submission: purged after 1 year unless tied to an open legal complaint or report
- Session tokens: expire automatically; active sessions are revoked on account deletion
7. Your Rights
Regardless of where you live, you can:
- Request a copy of the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your account and associated personal data
- Opt out of any future marketing communications (we currently send none)
To exercise any of these rights, email privacy@cityserv.org. We will respond within 30 days. We honor CCPA/CPRA-style rights for California residents and similar rights for all users regardless of location.
8. Children
CityServ requires account holders to be at least 16 years old. Anyone may browse the Site without an account, regardless of age. We do not knowingly collect personal information from children under 13. If we discover we have inadvertently collected such data, we will delete it immediately. Parents who believe their child under 13 has created an account should email privacy@cityserv.org.
9. Security
All data is encrypted in transit using TLS. We use Cloudflare's Web Application Firewall, access controls, and encrypted secrets management to protect stored data. Passwords are hashed and never stored in plaintext. In the event of a data breach affecting your personal information, we will notify you as required by New York's SHIELD Act (NY GBL § 899-bb) as expeditiously as possible and no later than the legally required timeframe.
10. Changes to This Policy
We may update this Privacy Policy from time to time. For material changes we will post a notice on the Site and, where required, seek fresh consent. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Site after changes take effect constitutes acceptance of the revised policy.
11. Contact
Privacy questions or requests: privacy@cityserv.org
General contact: contact@cityserv.org
Note: This Privacy Policy reflects CityServ's actual data practices as of the date above. It is not a substitute for legal advice. We recommend periodic review by a New York-licensed attorney, particularly as the Site grows or services change.