Privacy

The short version

• No accounts, no ads, and no analytics or tracking scripts.
• What you type is used to answer you. We don't save it, and it's gone when you close the tab.
• Your location is used only when you tap "Near me". It's rounded to about 100 metres and never saved.
• Plans keep the names people give, the needs they add and their votes until they leave or the plan is deleted. Needs go sooner, once the plan is done or called off.
• A correction you send about a place is read by a person, never shown on the site, and its note is deleted 30 days after we decide.
• We don't sell or rent anything about you, to anyone.

What you type

When you ask Social something or tap a suggestion, your browser sends the conversation so far to our server. The server uses it to find your options and sends back an answer. We don't save the conversation, and our logs never include it. It lives in your browser tab until you tap Start over or close the tab.

Typed messages can be read with help from a language model. When that's switched on, your latest message and the last few turns of the conversation go to Anthropic, the company that makes the Claude models, which turns your words into a search we can run. Suggestions you tap never go to the model, and neither does your location. When the model is off, or the day's budget for it is used up, a simple keyword reader on our own server reads your words instead.

Your location

Social asks for your location only when you tap "Near me", and your browser asks your permission first. Your device rounds it to about 100 metres before Social uses it. It's kept in the page's memory and sent only with your questions to our server, which uses it to work out distances. It isn't saved or logged, it never goes to Anthropic, and a location outside Saskatoon is ignored. Tap "Stop using it" to stop, or close the tab.

Plans

When you make a plan or join one, we keep:

• the name you give, which everyone in the plan sees;
• the plan itself: its places, its time and what it was for, but never where anyone started from;
• the needs you add while the plan is being made, like vegetarian, a budget, a time to be home by or walking only. Everyone in the plan sees them, next to your name unless you choose to keep it off. If you type them in a sentence, we keep only the needs it names, never the sentence, and it never goes to a language model;
• your votes;
• after the plan, anything you choose to tell us about how it went, like what you got or whether you'd go back.

So the plan knows it's you when you come back, your browser keeps a cookie for it. Only our server can read the cookie. It lasts 90 days and renews each time you open the plan. It holds a long random code, and so does the plan's share link. We store only a one-way scrambled copy of each (a SHA-256 hash), so neither can be rebuilt from our database. The share link's code sits after the # in the address, a part browsers never send to a server, so it stays out of our logs.

Your browser also remembers the name you last made a plan under, in its own storage on your device, so you don't have to type it again.

A plan is kept until it's deleted. Anyone who joined a plan can leave it from the plan's page at any time, even after it's done, and their name, needs, votes and answers go with them. Whoever made the plan can take someone out of it, and can delete the whole plan from its page. If you're in a plan you didn't make, you can ask us to delete it. Deleting a plan removes everyone's names, needs, votes and answers in it. Needs are erased from a plan, for everyone, as soon as it's marked done or called off: they're only for deciding where to go.

After a plan, you can tell us what you got, whether you'd go back, and whether a place lived up to its reason ("were the spring rolls as good as they say?"). You can change or take back an answer until 48 hours after the plan is done. After that, an answer about a place's reason goes to a person, who reviews it before it counts. One that counts becomes evidence under a random label, never your name. While the plan exists, our database links your answer to that evidence. If you leave or the plan is deleted, your answers are deleted and anything not yet reviewed is withdrawn. Evidence already approved stays, with nothing linking it to you.

Telling us something is wrong

When you use "Something wrong?" on a place, we keep what you chose, the note you wrote, if any, and when you sent it. We don't keep your IP address or browser with it, and it's never shown on the site. A person reads it and checks it before anything changes. If we decide it's not right, we delete it 30 days later. If we act on it, the change stays and your note is deleted 30 days later. Please leave names and contact details out of the note.

Limits against abuse

To keep Social up and stop anyone running up our costs, our server counts requests from each connection. It doesn't store your IP address to do this. It stores a code made from the address with a secret key (for an IPv6 address, from the block of addresses it belongs to), a count and a time. A nightly cleanup deletes each count once its time window has passed, so none lasts more than about two days.

Server logs

Like most websites, our web server writes an access log entry for each request: your IP address, the time, the address of the page or file asked for, your browser's name and version, and the page that linked you here, if any. We use it to fix problems and to fend off attacks. It's kept for 11 days. The app's own logs record errors only, never what you typed, your location or a plan's codes.

Cookies and scripts

Social sets no cookie until you make or join a plan, and then only the plan cookie described above. There are no advertising or analytics cookies, no tracking pixels and no third-party scripts. The map, its labels and the site's fonts all come from our own server, so looking around the map tells no one else where you're looking.

What your device remembers

Your device remembers a few settings for the map in its own storage. They never leave your device, and we can't see them:

• which map suits this device (the full 3D city, a lighter 3D city, the flat map or the list) and how many visits since it last checked, so the map opens the right way next time. To choose, the page may time a few milliseconds of work on your device; only the choice is kept;
• for the open tab only, that this visit is counted and whether the map switched to a lighter version because it was running slowly, until you close the tab;
• the view you picked (3D, Map or List), if you picked one;
• for the open tab only, which of the site's two looks you opened it with, if a link chose one, until you close the tab;
• that you've seen the short opening move over the city, so it plays only on your first visit;
• how many times the tip about moving the map has shown, so it shows at most twice;
• for the open tab only, how you're getting between a plan's stops (drive, walk or ride), if you changed it, until you close the tab.

Clearing this site's data in your browser removes them, and the map simply checks again.

Who else is involved

• Anthropic, only while the language model is switched on, and only your typed messages as described above. Anthropic is a US company, so those words may be processed outside Canada, under Anthropic's privacy policy (opens in a new tab).
• Our hosting company. Social and its database run on a server we rent and manage ourselves, in the United States, so what we keep is stored outside Canada.
• Nobody else. Facts about places come from public sources and the places themselves: their own websites, menus and calendars, the Overture Maps and OpenStreetMap place lists, and Ticketmaster's event listings. Our server fetches those; nothing about you is sent to any of them.

Links that leave Social (a place's website or Instagram, tickets) open in a new tab, and we don't tell the other site you came from Social. Once you're there, that site's own privacy policy applies. We'd hand over information about you only if the law required it.

The route between a plan's stops is worked out on our own server from OpenStreetMap's streets, so no one else learns where your plan goes. Two links leave Social on purpose: "Directions in Google Maps" opens Google Maps with the next stop's map coordinates (and, between stops, the previous stop's) and how you're getting there; "Open in Uber" opens Uber with the stop's coordinates and name as the drop-off. Neither link carries anything about you or the plan. Google Maps and Uber may then use your own location, under their privacy policies, to start the trip from where you are.

Seeing, fixing or deleting your data

You can ask to see what we hold about you, to correct it, or to delete it. Send us a request and we'll answer within 30 days. With no accounts, the way for us to find your part in a plan is the plan's name and the name you used in it. Please don't send us the plan's link: it works like a key.

A request holds only what you write in the form. A person reads it, and we keep it until we've dealt with it, then delete it 30 days later. Lusterworks is responsible for privacy at Social.

If you're not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada (opens in a new tab).

Changes

When this policy changes, so does the date at the top.