Privacy policy

Information you provide

Accounts: when you sign up or sign in, Supabase processes your email address, authentication credentials, and session information. We use your account identity to control access to owner tools and administrative features.

Business listings and claims: we collect business information you submit, such as a name, address, phone, website, category, descriptions, links, and photos, along with submitter role, optional contact email and listing notification preference, claimant name, account email, and verification status. Phone verification, when used, sends the listed business phone number and verification request to Twilio.

Messages and tips: we collect the name, email, message, topic, business or location details, and optional screenshot that you submit. Owner support tickets also include your account identity and the selected business. Do not include passwords, payment card details, identity documents, or sensitive personal information in messages or screenshots.

Resident reviews: we collect the display name you choose, a star rating, your experience text, and confirmation that it is firsthand. Reviews do not require an account or email address. Choose a display name you are comfortable making public and avoid including private information in your review.

What appears publicly

Approved business information, owner descriptions, links, and listing photos may appear on the directory. We also obtain business information and labeled ratings from public business sources and service providers. Public business contact details are displayed as listing information; a submitter's contact email and claimant account email are not published as part of the submission or claim.

Approved resident reviews display the submitted display name, rating, experience text, and review date. Pending, rejected, and hidden reviews are not shown to visitors. Contact messages, contact screenshots, and owner support tickets are kept for administration and support, rather than published. Tips may be used to update public directory or editorial information after review; the optional tip email is not published.

Usage information and browser storage

The site records listing views and clicks, including the business viewed, click type, time, and a referring page when supplied, to understand directory use. Our hosting and service providers may process IP addresses, device or browser information, request URLs, and diagnostic logs to deliver and protect the service.

We use cookies for sign-in sessions and sign-in redirects, and browser storage for your theme preference. Abuse controls may use request IP information and a protected, hashed identifier to limit repeated submissions. This is separate from your public display name and review content.

Google Analytics is enabled on this version of the site. It uses first-party cookies and receives usage information such as pages visited, browser or device details, and referral information to measure site use.

Umami analytics is not enabled on this version of the site.

You can clear or block cookies and browser storage using your browser controls, and use browser tools to block analytics requests. Blocking essential cookies can prevent sign-in. The site does not currently offer an in-site analytics consent or preference control.

How we use and share information

We use information to operate the directory, verify and manage claims, review submissions, answer support requests, correct records, measure use, and investigate spam, abuse, or errors. Administrators can access private submissions and account-linked records for these purposes, including assisting with an owner's dashboard.

Supabase provides authentication, database storage, and uploaded file storage. Transactional email services process recipient addresses and message content to deliver account, submission, and support notifications; the app's submission notifications use Postmark when configured. Map and embedded media providers receive requests from your browser when those features load. The map attribution identifies the map provider. Following an external link shares request information with the destination site.

New paid subscriptions are disabled. If you already have a billing account, Stripe may process billing portal activity. BoroFinder stores customer and subscription references, plan, status, and billing-period information for any existing subscriptions. Card details belong in Stripe's payment interface, not our message forms.

We do not sell the private contact, claim, support, or review abuse-control records collected through these forms. Public directory information and approved reviews are visible to anyone and may be copied by others. We may disclose information when required by law or when necessary to investigate abuse or protect the service and its users.

Retention, corrections, and removal requests

We retain account, listing, submission, support, and billing records to operate the service and resolve questions or disputes. There is no automatic deletion schedule for these records at present. Review abuse-control hashes are eligible for cleanup after 30 days, with cleanup during intake and scheduled maintenance. Backups and service-provider logs can persist separately from an active record; we cannot promise immediate removal from every copy.

To request access to, correction of, or removal of information associated with you, use Contact or email lacey@dusklight.digital. Include the relevant listing or review URL and identify the account or submission involved. We may need to verify that you are entitled to make the request before disclosing or changing private data.

A request to delete an owner account does not automatically remove independently sourced public business information. Tell us separately if a public listing is inaccurate or you want its inclusion reviewed. We assess requests in light of the information involved, our operational needs, and applicable legal obligations and rights.

Children, security, and updates

The submission and account services are intended for adults. Do not use them to submit personal information about children. Contact us if you believe a child has provided personal information so we can investigate and address it.

We use access controls to restrict private records and private screenshot storage, but no internet service can guarantee complete security. Contact screenshots may be accessed through time-limited links sent to administrators; link expiry does not delete the stored file.

We update this policy when our practices change. The date above identifies the latest version. Provider policies linked below explain those providers' own practices.