Privacy Policy

The Urban Manual (“we”, “our”, or “us”) helps you discover, save, and organize destinations. This Privacy Policy describes the personal information we process when you visit www.urbanmanual.co, use our web and mobile applications, or interact with our communications.

We collect information you provide directly to us, including:

• Account details such as name, email address, password, and profile preferences.
• Content you create inside the product (saved destinations, collections, lists, trips, notes, and activity history).
• Optional trip inputs such as calendar events, flight details, attached photos, and journal notes when you choose to use those features.
• Communications you send to our team (support inquiries, feedback, or survey responses).

We automatically collect certain technical information such as device type, browser, IP address, referring URL, and usage patterns (pages viewed, actions taken, timestamps). When you enable location-based features like “Near Me”, we temporarily collect your device location to show relevant places. Optional visit-aware personalization and saved-place alerts may use background location signals on device when you grant Always location access.

We use personal information to:

• Authenticate you, maintain your account, and sync your saved content across devices.
• Power core product flows such as discovery, saved places, itineraries, trips, and personalized recommendations.
• Send product updates, transactional messages, and respond to your requests.
• Monitor performance, detect abuse, and maintain the reliability and safety of our systems.
• Analyze aggregated usage trends to plan new features and improve the experience.

We do not sell your personal information. We share it only with:

• Trusted service providers who support our infrastructure (Supabase for authentication/database, hosting providers, transactional email vendors, analytics tools, crash diagnostics, maps/search providers, and AI service providers). These partners process data solely on our behalf under strict agreements.
• Other parties when required by law, to respond to legal process, to protect our rights, or to prevent fraud or abuse.
• Successors in the event of a merger, acquisition, or asset sale. We will notify you of any change in control that affects your data.

We may share aggregated or anonymized insights that no longer identify you.

We use first-party cookies and local storage to keep you signed in, remember preferences, and understand how the product performs. You can control cookies through your browser settings, though disabling them may limit core functionality.

Place enrichment: Some planning and admin workflows may use provider data to verify place details, opening hours, or location metadata. When we record selected-place analytics, those events are handled by our first-party analytics pipeline and are not sent to an external analytics tracker.

If you allow location permissions, we use your approximate device location to show nearby destinations and tailor suggestions. Location data stays on our servers long enough to return relevant results and is not stored with your profile unless you save a place. You can disable sharing by turning off location access in your device or browser settings at any time.

The iOS app also offers optional visit-aware personalization and saved-place alerts. If you enable those features and grant Always location permission, iOS may notify the app about significant visits or geofence entries so we can match them to saved Manual destinations and improve your map. These visit signals are stored with your app preferences and can be cleared by disabling the feature or deleting your account.

Calendar import, photo attachment, microphone notes, notifications, and cloud-assisted Concierge features are optional. We use those inputs only to power the feature you selected, such as importing Flighty events, attaching trip photos, recording notes, scheduling reminders, or generating travel recommendations.

We retain account data while your profile remains active so that your saved places, trips, and history stay available across devices. If you delete specific content, it is removed from active systems immediately and from encrypted backups within 30 days.

If you request full account deletion, we purge your saved data and Supabase authentication record as soon as the queued job finishes. Logs referencing your email are minimized to the extent needed for security and audit obligations.

You can manage your data from Account → Settings. Every request is logged in Supabase, processed by our background worker, and confirmed via email.

• Export: We compile your profile, saved/visited places, collections, trips, and interactions, then email a secure download link—typically within 24 hours.
• Deletion: We permanently remove your account, purge saved content, and delete the associated Supabase auth record. This action cannot be undone.
• Support: If you do not receive confirmation within 72 hours, contact privacy@urbanmanual.co with your account email.

• Access, correct, or update your profile information directly within your account.
• Request a copy of your data or deletion of your account as described above.
• Opt out of marketing emails by using the unsubscribe link or adjusting notification settings.
• Disable cookies or location services at the device level.

We secure your information using HTTPS encryption, encrypted storage provided by Supabase, role-based access controls, and continuous monitoring. While no online service can guarantee absolute security, we regularly review safeguards and limit data access to team members who need it.

The Urban Manual is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe we have done so, please contact us so we can delete the information.

Questions or concerns about this Privacy Policy can be sent to privacy@urbanmanual.co.