Privacy policy

CityPlate has no accounts and never asks for your name. Most of what it knows about you stays on your own device. This page explains the few things that are sent, only when you use them.

Last updated 30 September 2026. CityPlate is run by Max Lin in New Zealand. Contact: max@maxlin.art.

Kept only on your device

• Your saved (★) and visited (✓) places, your chosen city, settings and your answer to the 18+ question. These live in your browser's storage. CityPlate uses no cookies and no tracking or advertising tools.
• Your location, if you tap Use my location. Your device uses it to measure distances. It is sent only for Where's my bus and directions (below).
• A random code this device makes up the first time you use Pals, feedback or sync. It identifies the device, not you.

Sent only when you use a feature

• Pals (optional). Your pal name and the device's random code; your pals, requests, blocks and places sent between pals; and, only while Share my places is on, your saved and visited places, which only pals you accepted can see.
• Bot check. Choosing a pal name or sending a pal request may show a Cloudflare Turnstile check, which reads basic browser signals to tell people from bots. See Cloudflare's privacy policy.
• Feedback. What you write, the city and screen you were on, your browser and phone type (for example Chrome on Android), and a contact line only if you fill it in.
• Sync between your own devices (optional). Your saved and visited lists, stored against the device's random code. The sync code works like a password and also controls your pal name: anyone who has it can see and change your lists and act as you in Pals, so only share it with your own devices.
• Where's my bus and directions. Where's my bus sends your start point, rounded to about 100 metres, to CityPlate's own transit server to find nearby stops and departures. Directions send your start point and the place's location to plan the route. Live vehicles only download public transport data.
• Stopping abuse. Anything a device sends to CityPlate is counted against a scrambled (one-way) form of the network address, kept for about a day, so one network cannot flood the service.

Other services your browser talks to

• OpenStreetMap supplies the map pictures, so its servers see your network address and the area you are viewing (their policy).
• cdnjs (Cloudflare) supplies the map library, and Cloudflare hosts cityplate.fun and protects it from attacks.
• Links you tap, such as a venue website, a phone call, directions or Uber, open that provider with the venue's details. Uber is sent the venue as the drop-off and, if you set a start pin, that as the pickup. Nothing is sent until you tap.

Why, and who sees it

Everything above is used only to make that feature work, to prevent abuse, and, for feedback, to improve CityPlate. Only Max, and the services that run CityPlate for him (listed below), can see stored data. It is never sold, shared for advertising, or used to build a profile of you.

Where it is kept

Pals, feedback and sync data are stored with Supabase in Sydney, Australia. The transit server is rented from DigitalOcean. The website is served by Cloudflare. These providers store the data for CityPlate and do not use it for their own purposes.

How long

• Feedback: 12 months, then deleted.
• Pals and sync: until you delete them.
• Scrambled network addresses: about one day.

See, correct or delete your information

In the app, open Data and privacy and tap Delete what this device has sent. That removes your pal name, anything you shared or synced, corrections, and feedback sent from that device. Pals also has its own delete button. If a pal blocked you, their block is kept so it keeps protecting them.

You can also email max@maxlin.art to ask what is held about your device, to correct it, or to delete it. Include your sync code or pal name so the right records can be found.

If you are unhappy with how your information has been handled, you can complain to the Office of the Privacy Commissioner in New Zealand.

Age

CityPlate is for a general audience. Drink specials are shown only after you confirm you are 18 or over. Pals is not intended for children under 16.

Changes

If CityPlate starts collecting anything new, this page and the in-app note will be updated before it does.