Privacy Policy.

PTBO (ptbo.ca) is a local business directory serving Peterborough, Ontario. We help residents discover local businesses and help business owners manage a free public listing. We are subject to Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada’s Anti-Spam Legislation (CASL).

Questions about this policy? Contact us or call 705-201-2011.

Account information. When you sign in, we collect your email address. We use a magic-link system — no password is ever stored.

Third-party sign-in (Google). If you choose to log in using your Google Account, we collect your email address, name, and profile picture URL as provided by Google. No password is ever shared with us or stored.

Business listing information. If you claim or create a listing, you provide details such as your business name, address, phone number, contact email, website, social media handles, and business hours. This information is displayed publicly on your profile page.

Usage data. We record anonymous page views and link clicks — on business profiles, category pages, and other pages on the site — to provide business owners with basic analytics and to understand how visitors move between pages during a single visit. A short-lived, anonymous session identifier, stored only in your browser and cleared when you close the tab, lets us connect the pages you viewed in one visit to each other. It is never linked to your identity, never persists across visits, and is not a cookie. We do not use tracking cookies, fingerprinting, or any identifier that follows you across sites or return visits.

Technical event records. Alongside those counts we keep a technical record of each visit — the page visited, the referring website (address and path only, never its query string), a general browser and platform description, and an approximate country and city supplied by our CDN. We never store IP addresses. These records let us correct mistakes in our analytics after the fact: when a counting bug is found, we can recalculate past figures instead of leaving them wrong. The detailed browser description is removed after 90 days, and the records are permanently deleted after 3 years.

Contact form submissions. If you use our contact form, we collect your name, email address, and message in order to respond to you.

• To authenticate you via magic link and maintain your session (JWT stored in an httpOnly cookie).
• To display your business listing publicly on ptbo.ca.
• To send you transactional emails, such as sign-in codes.
• To respond to contact form inquiries.
• To generate aggregated, non-identifiable analytics for business owners (view counts, link clicks).

We do not sell, rent, or share your personal information with third parties for marketing purposes.

We use a small number of trusted services to operate the platform:

• Resend — transactional email delivery. Your email address is transmitted to Resend solely to send you emails you requested.
• Cloudflare — DNS, CDN, and our contact form spam protection (Turnstile). Cloudflare may process request metadata (IP address, browser signals) as described in their privacy policy.
• Google Identity Services — third-party authentication. When you log in with Google, they process your sign-in request and profile data in accordance with their privacy policy.

We set one httpOnly cookie (ptbo_token) when you sign in. It contains a signed JWT used to maintain your session for up to 30 days. The anonymous visit identifier described under “Usage data” above is stored in your browser's session storage, not a cookie — it is cleared automatically when you close the tab. We do not use advertising cookies, tracking pixels, or third-party analytics scripts.

Your account and business listing data are retained for as long as your account is active. You may request deletion of your account and all associated data at any time by contacting us. Anonymous analytics records (page views, link click counts) do not contain personal information and are retained indefinitely. The technical event records described above are kept for at most 3 years and then permanently deleted, with the detailed browser description removed after 90 days.

Under PIPEDA you have the right to access, correct, or request deletion of your personal information. To exercise any of these rights, contact us. We will respond within 30 days.

We store data on servers located in Canada. Session tokens are transmitted only over HTTPS. Passwords are never stored — authentication relies solely on short-lived, single-use magic links. We take reasonable technical and organizational measures to protect your information, though no system is perfectly secure.

If we make material changes, we will update the effective date at the top of this page. Continued use of the platform after changes constitutes acceptance of the revised policy.