Privacy Policy.

PTBO (ptbo.ca) is a local business directory serving Peterborough, Ontario. We help residents discover local businesses and help business owners manage a free public listing. We are subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL).

Questions about this policy? Contact us or call 705-201-2011.

Account information. When you sign in, we collect your email address. We use a magic-link system — no password is ever stored.

Third-party sign-in (Google). If you choose to log in using your Google Account, we collect your email address, name, and profile picture URL as provided by Google. No password is ever shared with us or stored.

Business listing information. If you claim or create a listing, you provide details such as your business name, address, phone number, contact email, website, social media handles, and business hours. This information is displayed publicly on your profile page.

Usage data. We record anonymous page views and link clicks on business profiles to provide owners with basic analytics. These records are not tied to individual visitors — we do not use tracking cookies or fingerprinting.

Contact form submissions. If you use our contact form, we collect your name, email address, and message in order to respond to you.

• To authenticate you via magic link and maintain your session (JWT stored in an httpOnly cookie).
• To display your business listing publicly on ptbo.ca.
• To send you transactional emails — sign-in codes and, in future, optional weekly stats digests for your listing.
• To respond to contact form inquiries.
• To generate aggregated, non-identifiable analytics for business owners (view counts, link clicks).

We do not sell, rent, or share your personal information with third parties for marketing purposes.

We use a small number of trusted services to operate the platform:

• Resend — transactional email delivery. Your email address is transmitted to Resend solely to send you emails you requested.
• Cloudflare — DNS, CDN, and our contact form spam protection (Turnstile). Cloudflare may process request metadata (IP address, browser signals) as described in their privacy policy.
• Google Identity Services — third-party authentication. When you log in with Google, they process your sign-in request and profile data in accordance with their privacy policy.

We set one httpOnly cookie (ptbo_token) when you sign in. It contains a signed JWT used to maintain your session for up to 30 days. We do not use advertising cookies, tracking pixels, or third-party analytics scripts.

Your account and business listing data are retained for as long as your account is active. You may request deletion of your account and all associated data at any time by contacting us. Anonymous analytics records (page views, link click counts) do not contain personal information and are retained indefinitely.

Under PIPEDA you have the right to access, correct, or request deletion of your personal information. To exercise any of these rights, contact us. We will respond within 30 days.

We store data on servers located in Canada. Session tokens are transmitted only over HTTPS. Passwords are never stored — authentication relies solely on short-lived, single-use magic links. We take reasonable technical and organizational measures to protect your information, though no system is perfectly secure.

If we make material changes, we will update the effective date at the top of this page. Continued use of the platform after changes constitutes acceptance of the revised policy.