Privacy Policy

Vicinity World, Inc. Effective Date: March 28, 2026 Last Updated: March 28, 2026

Vicinity.World Inc. (“Vicinity.World,” “we,” “our,” or “us”) operates a neighborhood coordination and exchange platform that enables neighbors to discover, coordinate, reuse, and exchange services locally. This Privacy Policy describes how we collect, use, store, share, and protect your personal information when you use our website, mobile application, and related services (collectively, the “Service”).

By accessing or using the Service, you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree with this policy, please do not use the Service.

1. Information We Collect

1.1 Information You Provide Directly

When you create an account or use the Service, you may provide:

Account information: Name, email address, mobile phone number, profile photo, and biographical information.
Service listings: Descriptions of services you offer or request, pricing, availability, and related images.
Messages: Content of messages you send to other users through our in-app messaging feature.
Reviews and ratings: Feedback you provide about other users or services.
Financial account information: When you choose to link a financial account or set up payments, you provide authorization for our third-party payment providers (Stripe and Plaid) to access or process your financial information on your behalf. We do not directly collect or store your bank account numbers, routing numbers, or credit card numbers.

1.2 Information Collected Automatically

When you use the Service, we automatically collect:

Authentication data: We use one-time passwords (OTPs) delivered via email or SMS to verify your identity. OTPs are time-limited (10 minutes) and consumed upon use.
Session data: Encrypted cookies that manage your authenticated session. These cookies are HttpOnly, Secure, and host-bound. Session cookies expire between 10 minutes and 14 days depending on their function.
Device and usage information: Browser type, operating system, IP address, pages visited, and interaction patterns. This information is collected via server logs and is used for security monitoring and service improvement.

1.3 Information from Third-Party Services

When you connect third-party financial services, we receive:

From Plaid: Account metadata (institution name, account type, masked account number), access tokens for ongoing account access, and transaction data as authorized by you.
From Stripe: Payment processing tokens, transaction status, and customer identifiers. Stripe processes your payment card and bank-account information directly; we never receive or store your full card or account number.

2. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve the Service
Authenticate your identity and manage your account
Facilitate transactions and payments between neighbors
Enable communication between users via in-app messaging
Display your service listings to other users in your neighborhood
Send you transactional communications (OTP codes, account notifications, booking confirmations)
Monitor for and prevent fraud, unauthorized access, and other security threats
Comply with legal obligations and enforce our Terms of Service
Analyze usage patterns to improve the Service (using aggregated, non-identifying data)

We do not sell your personal information. We do not use your information for targeted advertising. We do not share your information with third parties for their own marketing purposes.

3. How We Share Your Information

We share your information only in the following circumstances:

3.1 With Other Users

Your profile information (name, profile photo, bio) and service listings are visible to other users of the Service. Messages you send are visible to the recipients. You control what information you include in your profile and listings.

3.2 With Third-Party Service Providers

We use third-party service providers to operate the Service, including Plaid (financial account linking and verification) and Stripe (payment processing, including card and bank transfers). Each provider processes your financial data under their own privacy policy and data handling agreements.

3.3 For Legal Reasons

We may disclose your information if required to do so by law, or if we believe in good faith that disclosure is necessary to comply with a legal obligation, protect the safety of any person, protect the rights or property of Vicinity.World, or prevent fraud or address security issues.

3.4 Business Transfers

If Vicinity.World is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

4. Data Security

We implement industry-standard technical and organizational measures to protect your information:

All data in transit is encrypted using TLS 1.2 or better (HTTPS enforced across all environments)
All data at rest is encrypted using AES-256 encryption
Authentication cookies are HttpOnly, Secure, SameSite=Lax, and host-only
Financial data is tokenized — we store only tokens and references, never raw account numbers or card numbers
Database access requires mutual TLS (mTLS) authentication and is restricted by IP whitelisting
All database queries use parameterized bind variables, eliminating SQL injection risk
Multi-factor authentication is enforced on all internal systems that store or process consumer data

While we take reasonable measures to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

5. Cookies and Session Management

We use strictly necessary cookies to manage your authenticated session. We do not use advertising cookies, tracking cookies, or third-party analytics cookies.

Cookie	Purpose	Duration
Authentication (VCN)	Maintains your logged-in session	14 days
Access (CDN)	Short-lived access to application resources	10 minutes
Sign-in (SGN)	Preserves OTP verification flow state	10 minutes
Verification (VRF)	Tracks email or mobile verification flow	30 minutes

All cookies are HttpOnly (not accessible to JavaScript), Secure (transmitted only over HTTPS), and SameSite=Lax. No cookie data is shared with third parties.

6. Data Retention

Account data: For the duration of your active account, plus 30 days following a deletion request.
Session data: Automatically expires within 10 minutes to 14 days, depending on cookie type.
Financial tokens: For the duration of your active financial connection. Revoked when you disconnect an account.
Transaction records: As required by applicable financial record-keeping laws (typically 5–7 years).
Messages and content: For the duration of your active account.
Server logs: 90 days, with automatic rotation.

7. Your Rights and Choices

7.1 All Users

Access: You can view and download your profile information through your account settings.
Correction: You can update your profile information at any time through your account settings.
Deletion: You can request deletion of your account by contacting admin@vicinity.world. We will process your request within 30 days.
Disconnect financial accounts: You can disconnect linked financial accounts at any time through your account settings.

7.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the CCPA and CPRA, including the right to know what personal information we collect, the right to delete, the right to correct, and the right to opt-out of sale. We do not sell your personal information.

To exercise any of these rights, contact us at admin@vicinity.world.

8. Children’s Privacy

The Service is not directed to children under the age of 18. We do not knowingly collect personal information from children under 18. If you believe we have inadvertently collected information from a child under 18, please contact us at admin@vicinity.world.

9. Third-Party Links and Services

The Service may contain links to third-party websites or integrate with third-party services (such as Plaid Link for financial account connection). These third parties have their own privacy policies, and we are not responsible for their privacy practices.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last Updated” date and notify you via email or prominent notice within the Service before the changes take effect.

11. Contact Us

If you have questions or requests regarding this Privacy Policy, please contact us:

Vicinity.World Inc.

Email: admin@vicinity.world

Website: vicinity.world