Privacy Policy.

PTBO (ptbo.ca) is a local business directory serving Peterborough, Ontario. We help residents discover local businesses and help business owners manage a free public listing. We are subject to Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada’s Anti-Spam Legislation (CASL).

Questions about this policy? Contact us or call 705-201-2011.

Account information. When you sign in, we collect your email address. We use a magic-link system — no password is ever stored.

Third-party sign-in (Google). If you choose to log in using your Google Account, we collect your email address, name, and profile picture URL as provided by Google. No password is ever shared with us or stored.

Business listing information. If you claim or create a listing, you provide details such as your business name, address, phone number, contact email, website, social media handles, and business hours. This information is displayed publicly on your profile page.

Usage data. We record anonymous page views and link clicks — on business profiles, category pages, and other pages on the site — to provide business owners with basic analytics and to understand how visitors move between pages during a single visit. A short-lived, anonymous session identifier lets us connect the pages you viewed in one visit, and the links you clicked, to each other. Your browser keeps it only for the current tab and clears it when you close the tab; we store it on our servers alongside those page-view and click records (and the search and outside-link records described below), where it is used only to count visits and routes through the site in aggregate. It is never linked to your identity, never persists across visits, and is not a cookie. We do not use tracking cookies, fingerprinting, or any identifier that follows you across sites or return visits.

Technical event records. Alongside those counts we keep a technical record of each visit — the page visited, the referring website (address and path only, never its query string), a general browser and platform description, and an approximate country and city supplied by our CDN. We never store IP addresses. These records let us correct mistakes in our analytics after the fact: when a counting bug is found, we can recalculate past figures instead of leaving them wrong. The detailed browser description is removed after 90 days, and the records are permanently deleted after 3 years.

Searches, missing pages and links to other websites. We keep what you search for in the directory (with the number of results and any filters), the address of any page you reach that doesn't exist, and which outside websites our guides send you to, along with your type of device, your approximate country and, for searches and guide links, the visit identifier described above. We automatically discard searches and addresses that look like contact details or a street address, but we can't catch everything, so please don't type personal information into the search box.

We use these records to see what people can't find, to fix broken links and to improve our guides. Only our administrators see them, only as totals (something typed once is never shown), and they are never exported. Search and missing-page records are deleted after 90 days, and outside-link records after 400 days.

Contact form submissions. If you use our contact form, we collect your name, email address, and message in order to respond to you.

• To authenticate you via magic link and maintain your session (JWT stored in an httpOnly cookie).
• To display your business listing publicly on ptbo.ca.
• To send you transactional emails, such as sign-in codes.
• To respond to contact form inquiries.
• To generate aggregated, non-identifiable analytics for business owners (view counts, link clicks).
• To improve the directory and our guides: seeing what visitors search for and cannot find, fixing broken links, and learning which outside websites our guides send people to. Our administrators see these only as totals.

We do not sell, rent, or share your personal information with third parties for marketing purposes.

We use a small number of trusted services to operate the platform:

• Resend — transactional email delivery. Your email address is transmitted to Resend solely to send you emails you requested.
• Cloudflare — DNS, CDN, and our contact form spam protection (Turnstile). Cloudflare may process request metadata (IP address, browser signals) as described in their privacy policy.
• Google Identity Services — third-party authentication. When you log in with Google, they process your sign-in request and profile data in accordance with their privacy policy.

We set one httpOnly cookie (ptbo_token) when you sign in. It contains a signed JWT used to maintain your session for up to 30 days. The anonymous visit identifier described under “Usage data” above is kept in your browser's session storage, not a cookie — your browser clears it automatically when you close the tab — and is also stored on our servers with the page-view, click, search and outside-link records it connects. We do not use advertising cookies, tracking pixels, or third-party analytics scripts.

Your account and business listing data are retained for as long as your account is active. You may request deletion of your account and all associated data at any time by contacting us. Page-view and link-click records for business profiles, categories and other pages are kept indefinitely; they are tied only to the short-lived, anonymous visit identifier described above, never to you. Search, missing-page and outside-link records are not treated as anonymous: they are kept for the shorter periods described above (90 days for searches and missing pages, 400 days for links followed to other websites) and then permanently deleted. The daily count of discarded searches, which contains no search words, is kept indefinitely. The technical event records described above are kept for at most 3 years and then permanently deleted, with the detailed browser description removed after 90 days.

Under PIPEDA you have the right to access, correct, or request deletion of your personal information. To exercise any of these rights, contact us. We will respond within 30 days.

We store data on servers located in Canada. Session tokens are transmitted only over HTTPS. Passwords are never stored — authentication relies solely on short-lived, single-use magic links. We take reasonable technical and organizational measures to protect your information, though no system is perfectly secure.

If we make material changes, we will update the effective date at the top of this page. Continued use of the platform after changes constitutes acceptance of the revised policy.