Back to legal

Privacy Policy

How Vicinity collects, uses, shares, and protects personal information.

Privacy Policy

Effective date: May 20, 2026

1. Who we are and what this policy covers

Vicinity is a location-based event and business discovery service operated jointly by Spencer Spiegelman and Varun Mehrotra ("Vicinity," "we," "us," or "our"), based in Ontario, Canada. This policy explains what personal information we collect when you visit or use the Vicinity website at inyourvicinity.ca (the "Service"), how we use that information, who we share it with, and the choices and rights you have.

This policy applies only to information collected through the Service. It does not apply to any third-party site, application, or service that we link to or that is integrated with the Service.

The current iteration of the Service is a beta app launched during Toronto Tech Week it is not an official Toronto Tech Week resource. We are not affiliated with Toronto Tech Week nor are we trying to replace the Toronto Tech Week resources. Features, data sources, and supported regions may change as the Service develops.

If you have any questions about this policy, contact us at inyourvicinity.ca.

2. Information we collect

2.1 Information you provide to us

  • Account information. When you sign in with Google, we receive your Google account's display name, email address, profile picture URL, and a stable Google account identifier. We do not store your Google password.
  • Calendar permission. If you grant permission, we store a Google OAuth refresh token so we can read your calendar's free/busy windows on your behalf. The token is held server-side in our database and is used only to call Google's free/busy API.
  • Content you submit. If you create an event listing through the in-app form, we collect the information you enter: title, description, date and time, venue name, street address, latitude and longitude, category, the city or region within the GTA, price text, an optional ticket or booking URL, and an optional contact email or phone number. The form requires you to provide at least one of a contact method or a booking URL.
  • Trip plans. If you build a trip in the Service, we store the trip's name and date, plus a list of items. Each item references an event you've added and saves a snapshot of its title, venue name, and the time window you allocated to it.
  • Communications. If you email us for support, we keep the message and your email address so we can reply.

2.2 Information we collect automatically

  • Log and device information. Our servers automatically receive standard request data including IP address, user-agent string, referring page, requested URL, timestamps, and response status.
  • Session cookies. Supabase Auth sets cookies in your browser to keep you signed in. See our Cookie Policy for details.
  • Analytics. We use Google Analytics to understand aggregate usage of the Service (which pages are visited, approximate location at city level, device and browser type). Google Analytics sets its own cookies and shares some of this data with Google. See our Cookie Policy for the cookies involved and how to opt out.

2.3 Information from other sources

  • Google profile. Through Supabase Auth, Google sends us the profile fields listed in §2.1 once you complete the sign-in flow.
  • Google Calendar free/busy. When you ask the Service to schedule a trip around your availability, we call Google's free/busy API using the refresh token from §2.1. The free/busy endpoint returns only the start and end times of blocks marked busy on your primary calendar. We do not receive event titles, descriptions, attendees, locations, or any other event details. Free/busy results are cached on our server for up to five minutes to reduce repeated calls.
  • Third-party event data. The Service displays event listings sourced from the Toronto Tech Week website. This data is about events and their organizers — it is not personal information about you.

3. How and why we use information

We use the information described above to:

  • create and maintain your account and keep you signed in;
  • show you events and businesses in your area;
  • read your Google Calendar free/busy windows so the Service can suggest times that don't conflict with your existing commitments;
  • store and display the events and trips you create;
  • detect, investigate, and prevent abuse, fraud, security incidents, and violations of our Terms of Service;
  • understand how the Service is used in aggregate, so we can improve it;
  • respond to your support requests;
  • comply with our legal obligations.

Our legal bases under Canadian law (PIPEDA). We rely on your consent for processing your Google profile, calendar free/busy data, and any optional contact information you submit. We rely on the necessity of providing the Service for the basic account, event, and trip data you submit. We rely on our legitimate interest for security, fraud prevention, and aggregate analytics.

4. Sharing information

We share personal information only in the limited circumstances described below. We do not sell your personal information, and we do not share it with third parties for cross-context behavioural advertising.

4.1 Service providers we rely on

  • Supabase — our database and authentication provider. All account, event, trip, and calendar-connection records are stored in Supabase Postgres.
  • Google — provides Google Sign-In, the Google Calendar API, and Google Analytics. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
  • Hosting infrastructure — the Service runs on a self-hosted Kubernetes cluster operated by us.

These providers receive only the personal information they need to perform their function and are bound by their own privacy and security commitments.

4.2 Legal compliance and protection of rights

We may disclose personal information when we believe in good faith that disclosure is required to comply with a valid legal process (such as a subpoena, court order, or government request), to enforce the Terms of Service, to address claims that content violates the rights of a third party, or to protect the rights, property, or safety of Vicinity, our users, or the public.

4.3 Business transfers

If Vicinity is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction. We will provide notice through the Service if your personal information becomes subject to a materially different privacy policy as a result.

4.4 With your consent

We may share personal information for other purposes if you direct or authorize us to.

4.5 Aggregated or de-identified information

We may share information that has been aggregated or de-identified so that it cannot reasonably be used to identify you.

5. How long we keep information

  • Account information — kept while your account is active. If you delete your account, we delete or de-identify your profile, events, and trips within 30 days, except where retention is required by law.
  • Calendar refresh token — kept until you disconnect Google Calendar from inside the Service, delete your account, or ask us to remove it. Disconnecting marks the stored connection as revoked and stops further calls to Google. To have the underlying record deleted from our database immediately, email us at info@inyourvicinity.ca.
  • Calendar free/busy cache — each cached window expires automatically about five minutes after it is stored.
  • Server access logs — retained for approximately 30 days for security and debugging.
  • Google Analytics data — retained according to the data-retention setting configured in our Google Analytics property (currently the platform default).
  • Support correspondence — retained for as long as needed to resolve your inquiry and a reasonable period afterward for our records.

6. Security

We protect personal information in transit using HTTPS. Access to production data is restricted to the operators of the Service, and Supabase row-level security policies further restrict access at the database layer. The Google Calendar refresh token is stored only on the server and is never exposed to your browser.

No system can guarantee perfect security. We recommend you enable two-step verification on the Google account you use to sign in.

7. Your choices

  • Disconnect Google Calendar. Use the in-app "disconnect Google Calendar" action at any time. This marks our stored connection as revoked and stops free/busy calls. You can additionally revoke Vicinity's access from your Google Account permissions.
  • Opt out of Google Analytics. Install the Google Analytics opt-out browser add-on or block analytics cookies in your browser settings.
  • Close your account. Email info@inyourvicinity.ca to request account deletion.
  • Limit what you submit. You can choose what optional content (contact info, ticket URLs, prices) to include in event listings you create.

8. Your rights

8.1 Canadian residents (PIPEDA)

You have the right to:

  • Access the personal information we hold about you;
  • Correct information that is inaccurate or incomplete;
  • Withdraw consent for processing where we rely on consent (note: this may limit your ability to use parts of the Service); and
  • File a complaint with the Office of the Privacy Commissioner of Canada if you believe we have not handled your personal information appropriately.

To exercise any of these rights, contact us at info@inyourvicinity.ca. We will respond within 30 days.

8.2 United States residents (including California)

Where US state privacy laws apply, you have the following rights. References to "personal information" below mean the same as "personal information" or "personal data" under the applicable state statute.

Categories of personal information we collect. In the last 12 months we have collected the following categories of personal information described under the California Consumer Privacy Act (Cal. Civ. Code §1798.140):

  • Identifiers (name, email address, IP address, Google account identifier);
  • Internet or other electronic network activity (pages visited, referrer, device/browser, analytics events);
  • Geolocation data (approximate city-level location derived from IP; precise location only for events you choose to create);
  • Inferences drawn from the above used to surface events you may want to attend.

We collect these categories from the sources described in §2 and use them for the purposes described in §3. We disclose these categories to the service providers listed in §4.1.

Your rights. Subject to verification, you may:

  • Know / access what personal information we have collected, used, disclosed, and the categories of sources and recipients;
  • Delete personal information we hold about you, subject to legal exceptions;
  • Correct inaccurate personal information;
  • Receive a portable copy of your personal information;
  • Opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioural advertising, so no opt-out is necessary.
  • Be free from retaliation for exercising these rights. We will not deny service, charge different prices, or provide a different level of quality because you exercised a privacy right.

Authorized agents. You may use an authorized agent to submit a request on your behalf if the agent provides written, signed permission from you and we can verify your identity.

Appeals. If we deny your request, you may appeal by replying to our response or emailing info@inyourvicinity.ca with the subject line "Privacy Appeal." We will respond to appeals within 60 days. If your appeal is denied, residents of states that provide for it may contact their state Attorney General.

To exercise any of these rights, email info@inyourvicinity.ca. We may need to verify your identity by matching information you provide against the information we have on file.

9. Children's privacy

The Service is intended for users 13 years of age and older. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us with personal information, contact us at info@inyourvicinity.ca and we will delete it.

10. International transfers

We operate from Canada, and our service providers (Supabase, Google) process data in the United States and other countries. When you use the Service, your personal information may be transferred to and processed in countries other than your own, which may have different data-protection laws than your home country.

11. Third-party services

The Service relies on and links to third-party services, including Google, Supabase, and the Toronto Tech Week website. Your interactions with those services are governed by their own privacy policies, which we do not control.

12. Changes to this policy

We may update this policy from time to time. If we make a material change, we will update the effective date at the top of this document and notify you through the Service before the change takes effect. Your continued use of the Service after the new effective date constitutes acceptance of the updated policy.

13. Change log

  • May 20, 2026 — initial version.

14. How to reach us

Spencer Spiegelman & Varun Mehrotra Ontario, Canada info@inyourvicinity.ca