This page explains what data CityTown collects, why, and how you stay in control of it. Last updated 23 July 2026. We’ve written it to match how the site actually works rather than to cover every hypothetical, so if something here doesn’t line up with what you see on the site, tell us via the contact page and we’ll fix it.
CityTown is owned and operated by Devonil Hosting [OWNER TO SUPPLY: registered legal entity name, company number and registered address]. For anything in this policy, including data requests, contact us at [OWNER TO SUPPLY: data/privacy contact email address].
What we collect, and when
We keep data collection deliberately small. There are three ways your data reaches us:
- Analytics (only with your consent). We use Google Analytics 4 to understand which guides get read and whether they help. It doesn’t run until you accept analytics in the consent banner — decline, and no analytics cookies are set and no analytics data is sent.
- Email sign-ups (only if you ask for them). If you enter your email to get our monthly city briefings, we store that address to send you that email. Sign-up is double opt-in: you confirm via a link we email you before you’re added, so nobody can subscribe you without access to your inbox.
- Server logs (automatic, technical). Like almost every website, our hosting keeps standard server logs — IP address, browser type, the page requested, and the time — to keep the site running, secure and debuggable. This happens for every visit and isn’t tied to the consent banner because it’s a normal part of serving a web page.
We don’t ask you to create an account, we don’t run display ads, and we don’t sell or rent your data to anyone. Ever.
Analytics and consent mode
When you first visit, you’ll see a consent banner. Analytics stays off until you choose. If you accept, Google Analytics 4 loads and sets cookies that let us count visits and measure how long people spend on a page — aggregated, to improve the guides, not to build a profile of you. If you decline, analytics doesn’t load at all.
We record a small number of custom events in GA4 so we can see what’s useful: which affiliate links get clicked, when someone signs up for the email, when a map loads, and when the table of contents is used. These events are tied to the analytics consent above — no consent, no events.
Because there are no display ads on CityTown, there are no advertising or retargeting cookies to worry about. You can change your mind at any time using the consent controls on the site, or by clearing cookies in your browser.
Affiliate links and the /go/ redirect
Some links on CityTown are affiliate links, as explained in full on how we make money. Every commercial link routes through our own /go/ redirect before sending you to the partner’s site. That redirect is how we count clicks for our own reporting; the count is about the link, not about identifying you.
Once you land on a partner’s site (a hotel search, a tour seller, an eSIM provider), that company sets its own cookies and applies its own privacy policy so it can credit us with the referral if you book. We don’t control those cookies and we’d encourage you to read the partner’s privacy policy if that matters to you. We never pass your name or email to a partner — the affiliate relationship works on an anonymous referral tag, not your personal details.
Cookies in plain terms
- Consent preference — remembers your choice on the banner so we don’t ask on every page.
- Analytics — set by Google Analytics 4, only after you accept.
- Partner cookies — set by affiliate partners on their own sites after you follow a
/go/link, not by us.
How long we keep things
Analytics data is retained according to Google Analytics 4’s settings and Google’s own retention policies. Email addresses are kept for as long as you stay subscribed; unsubscribe (there’s a link in every email) and you’re removed from the active list. Server logs are kept for a limited period for security and troubleshooting, then rotated out in the normal course of hosting.
Third parties involved
- Google Analytics 4 — analytics, consent-gated.
- MailPoet — handles our email list and sends the monthly briefing.
- Our hosting provider — stores the site and its server logs.
- Affiliate partners and networks — chiefly Travelpayouts, plus the travel brands it covers, reached only when you click a
/go/link.
Your rights
If you’re in the UK or the EU, data protection law (the UK GDPR and the EU GDPR) gives you the right to ask us for a copy of the personal data we hold about you, to correct it, to have it deleted, to restrict or object to how we use it, and to withdraw consent you’ve previously given. Withdrawing analytics consent or unsubscribing from the email doesn’t undo processing that already happened, but it stops it going forward.
In practice, the personal data we actually hold on a typical reader is minimal: an email address if you subscribed, and technical log data. We’re not building profiles, so most requests are quick to handle.
How to make a request
Email [OWNER TO SUPPLY: data/privacy contact email address] with what you’d like — access, correction, deletion, or a question — and enough detail for us to find your data (for example, the email address you subscribed with). We’ll respond within the timeframe the law requires, normally one month.
If you’re in the UK and think we’ve handled your data badly, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk. If you’re in the EU, you can complain to your national data protection authority. We’d rather you came to us first so we can put it right.
Changes to this policy
When the site’s data practices change, this page changes with them and the “last updated” date at the top moves. If a change is significant, we’ll make that clear rather than editing quietly.