Privacy Policy

1. Introduction

Welcome to Local Commons, operated by Pixel Mixel Inc. ("we," "us," or "our"), the company behind LocalXP. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Local Commons living map and related services on localcommons.ca.

Local Commons and LocalXP share the same platform backend and account system. Signing in on Local Commons uses the same secure one-time code flow. Steward tools and org layers may live on LocalXP; the public living map is Local Commons.

By using our services, you agree to this Privacy Policy and our Terms of Service. If you do not agree, please do not use the services.

2. Information We Collect

2.1 Information you provide

Required to create an account:

• Email address: used to send your one-time login code (OTP). We do not use your email for marketing without your explicit consent.

Optional (you choose what to share):

• Display name: shown with public contributions when you choose to credit yourself
• Profile details: such as city or avatar, if you add them
• Business or event listing details: when you suggest or create a listing for moderator review
• Contributions: signals, place suggestions, photos, check-ins, and other map participation you submit

You can use Local Commons with only an email address. Other profile information is voluntary and can be changed or removed.

2.2 Automatically collected information

When you use Local Commons, we may automatically collect:

• Device information (IP address, browser type, operating system) for security and fraud prevention
• Participation events (time, place or venue ID, interaction type) linked to your user ID, not your name or email in the event row
• Location data only when you grant browser permission, used for on-site verification and local discovery
• Analytics data (pages viewed, features used) only if you consent via the cookie banner
• Session tokens necessary to keep you signed in securely

2.3 Photos and embedded metadata (EXIF)

When you upload a photo to certain features (including event participation photos and similar evidence uploads), we may read technical metadata embedded in the file, commonly called EXIF. That can include:

• Capture time (when the camera recorded the photo)
• GPS coordinates (when the camera stored a location)
• Limited device or camera identifiers when present in the file

We use this information to verify that a contribution is consistent with the place and time of the event or report. Uploads that fail these checks may be rejected.

Verified contribution details may be stored with the photo and associated with your account. The public living map typically shows the photo and optional credit name, not a full EXIF dump. After processing, we may strip or rewrite image files for storage and delivery. Do not upload photos you do not want associated with a place and time on the map.

2.4 Payment information

Paid steward or organization features (when offered through LocalXP) are processed by Stripe. We do not store your complete credit card information. Stripe processes payment data under its own privacy policy and PCI-DSS standards.

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the living map and related services
• Create and manage your account
• Enable public contributions, listings, signals, and place awareness
• Moderate submissions and keep the shared place trustworthy
• Send administrative messages (such as sign-in codes and notices)
• Respond to support requests
• Monitor usage patterns and reliability
• Detect, prevent, and address fraud and security issues
• Verify place-based photo contributions using capture time and location metadata when provided
• Comply with legal obligations
• Send marketing communications only with your consent

3.1 How participation is recorded

3.2 Steward and organization insights

When organizations use steward tools (often through LocalXP) on the same shared place, they may see aggregated or permissioned engagement insights about activity on their layer. Individual identity is protected as described above. This data is not sold for third-party advertising.

4. Information Sharing and Disclosure

4.1 Public map visibility

Content you publish to the living map (listings, signals, photos, place suggestions, and similar contributions) may be visible to other visitors according to moderation status and product settings.

4.2 Service providers

We share information with trusted providers who help us:

• Payment processing (Stripe), when applicable
• Cloud hosting and storage (Supabase, Vercel)
• Analytics and performance monitoring (with consent where required)
• Email delivery
• Customer support tools

4.3 Legal requirements

We may disclose information if required by law, court order, or government request, or to protect our rights, property, or safety, or that of our users or the public.

4.4 Business transfers

In a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

5. Data Security

We implement industry-standard measures, including:

• Encryption of data in transit and at rest
• Secure authentication and access controls
• Monitoring and operational reviews
• Employee awareness of data protection

No method of transmission over the internet is completely secure. We work to protect your information but cannot guarantee absolute security.

6. Your Rights and Choices

6.1 Access and update

You can access and update account information through your profile settings where available.

6.2 Data portability

You may request a copy of your personal data in a structured, machine-readable format.

6.3 Deletion

You can request deletion of your account and personal data by contacting us at hello@localxp.ca. Some information may be retained as required by law or for legitimate business purposes.

6.4 Marketing communications

You can opt out of marketing emails via the unsubscribe link or your communication preferences.

6.5 Cookies and consent

We use a cookie consent banner for non-essential cookies:

• Necessary: always active for login, sessions, security, and core product features
• Analytics: optional; denied by default until you consent
• Functional: optional; remembers theme, language, and display preferences

You can update cookie preferences via the cookie banner or account privacy settings where available.

7. Children's Privacy

Local Commons is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe we have, contact us immediately.

8. International Data Transfers

Local Commons is operated from Canada. Your information may be processed by providers in other countries, including the United States (for example Supabase, Vercel, Stripe, and analytics providers). Transfers are made on the basis of contractual necessity, appropriate safeguards where required, and the legitimate interests of operating a cloud-hosted platform.

9. Data Retention

• Account data: while your account is active, then deleted about 30 days after a deletion request
• Transaction records: up to 7 years where required for tax and accounting
• Analytics data: aggregated or anonymized per provider defaults
• Audit logs: retained for security and fraud prevention (typically up to 2 years)
• Cookie consent records: typically 1 year from consent

10. Third-Party Links

The map and site may link to third-party websites or services. We are not responsible for their privacy practices. Review their policies before sharing information with them.

11. Changes to This Privacy Policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date on this page. Continued use after changes constitutes acceptance of the updated policy.

12. Contact Us

Questions about this Privacy Policy or our data practices:

13. Regional Privacy Rights

13.1 Canadian residents (PIPEDA)

Pixel Mixel Inc. is a Canadian corporation subject to PIPEDA. Canadian residents may access their information, challenge accuracy, withdraw consent for non-essential processing (subject to legal limits), and file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca. Contact our Privacy Officer at hello@localxp.ca.

13.2 California residents (CCPA)

California residents have rights to know, delete, and opt out of the sale of personal information. We do not sell your personal information.

13.3 European residents (GDPR)

If you are in the EEA or UK, you may have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Contact hello@localxp.ca. We aim to respond within 30 days. You may also lodge a complaint with your local data protection authority.