Things To Do In Chicago
Log InJoin Free

Privacy Policy

Effective 2026-10-16 · Version privacy-2026-10-16

This Privacy Policy explains how Things To Do Worldwide Inc. ("ThingsToDoCity", "we", "us" or "our") collects, uses and shares information when you use thingstodocity.com (the "Service"). Questions or requests: support@thingstodocity.com.

1. Information we collect

Account information. When you create an account we collect your email address and password. Your password is stored by our authentication provider in hashed form; we cannot see it. We also keep your account identifier and when you created your account and signed in.

Sign-up confirmations. When you sign up we record that you confirmed you are 18 or older, the versions of the Terms of Service and Privacy Policy you accepted, your optional email preference for ThingsToDoCity recommendations, events and updates, and the time of each of these.

Email preference history. Each time you opt in or out, we record the choice, where you made it and when.

Saved events and plans. If you use Save or I'm Going, we store which events and experiences you saved or marked.

Side Quests. If you take part in a Side Quest, we store which Side Quest you joined, each place you mark with "Mark as Visited", the date and time you did so, and when your progress was last active. These check-ins are self-reported: we do not collect your device's location to record them, and we do not store your IP address, browser or device details with them. If you are not signed in, your progress is linked to a random identifier kept in a cookie in your browser (see section 4), not to your name or email address. If you are signed in, it is linked to your account.

Messages to us. If you email support, we receive your email address and the content of your message.

Technical information. When you use the Service, our hosting and security providers process information sent by your browser, such as your IP address, browser and device type, operating system, the pages you request and the referring website. See sections 3, 4 and 7.

We do not collect payment information, and you cannot buy anything through ThingsToDoCity. We do not ask for your location from your device. We do not use social sign-in.

2. How we use information

We use information to:

  • create and secure your account, verify your email address, sign you in and reset your password;
  • show your saved events and plans;
  • show your Side Quest progress, the places you have discovered, your completed adventures and your collectibles, and make sure each place is counted only once;
  • apply Side Quest rules, such as accepting check-ins only on a Side Quest's event days (based on the event's local time) and at places that are open that day;
  • move Side Quest progress from a browser into your account when you sign in, as described in section 4;
  • record your consent choices and honor them;
  • send emails necessary to operate your account;
  • protect the Service against bots, abuse and fraud, including limiting repeated sign-in and sign-up attempts;
  • understand how the Service is used in aggregate, such as which pages are visited and where visitors come from;
  • respond to your requests and comply with legal obligations.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

3. Website analytics

We use Vercel Web Analytics to understand traffic to the Service in aggregate: page views, including views of event pages, estimated unique visitors, referring websites, campaign tags in links (utm parameters), approximate location derived from the request (country, region and city), and browser, operating system and device type.

Vercel Web Analytics does not use cookies. According to Vercel, visitors are counted using a hash created from the incoming request, which is discarded after 24 hours, and the data is used for aggregated statistics that are not tied to an individual.

We limit what is sent. Account, sign-in, password and other private pages, including your My Adventures pages, are never sent to analytics. For other pages, we remove everything from the web address except the page path and campaign tags. Analytics does not receive which places you mark as visited.

We do not use advertising cookies, advertising pixels or cross-site tracking.

4. Cookies and browser storage

We use only storage that is necessary for the Service to work:

  • Sign-in cookies. When you sign in, our authentication provider sets cookies whose names begin with "sb-" to keep you signed in. When you create an account or ask for a sign-in or password-reset link, a cookie is set so that the link can complete securely in the same browser. It is removed when the link is used, or expires after 30 days. We do not set cookies for visitors who are only browsing.
  • Side Quest guest cookie. If you take part in a Side Quest without signing in, we set a cookie named "ttd_qd" the first time progress is saved from your browser, which happens when you record your first check-in. It contains a random identifier; we store only a scrambled (hashed) version of it, which links your guest progress to that browser. We use this identifier only to save and show your Side Quest progress and to keep the Service working, never for advertising or to build a profile of you. The cookie cannot be read by scripts on our pages, is sent only over secure connections, is not sent with requests started by other websites (except when you follow a link to the Service), expires 90 days after it is set, and is not renewed. Just browsing Side Quests sets no cookie.
  • Guest progress belongs to one browser. Guest progress can be reached only from the browser that holds the cookie. If you clear your cookies, the cookie expires, or you use a different browser or device, you will not be able to get back to that progress from there. In-app browsers, such as the one inside Instagram, keep their own cookies separate from Safari and your other browsers, so guest progress started in one does not appear in the other.
  • Moving guest progress into an account. If you sign in on the same browser and then open a Side Quest page that shows your progress, the guest progress on that browser moves into your account and the cookie is removed. If your account already has progress for the same Side Quest, the two are combined, and for a place checked in to both, the earlier check-in is kept. If the move does not complete, the cookie is kept so the move can be tried again the next time. If more than one person uses the same browser, the guest progress on it moves into whichever account next opens a Side Quest page while signed in on that browser. Once progress is in your account, you can see it wherever you sign in.
  • Side Quest invitation. If you choose "Continue as Guest" when we invite you to create an account, your browser's local storage remembers that choice so we do not show the invitation again in that browser.
  • Pending action. If you tap Save or I'm Going before signing in, your browser's local storage remembers that choice so it can be completed after you sign in. It is removed once used.
  • Tab storage. Your browser's session storage, which is cleared when you close the tab, remembers the website that referred you and any campaign tags in the link you arrived from, and whether you have already seen a scrolling hint on the homepage. This information is not sent to us at this time.
  • Bot check. On the sign-in and account creation page, the email sign-in link page and the password reset request page, Cloudflare Turnstile runs a bot check and may set cookies described in Cloudflare's Cookie Policy.

You can clear cookies and browser storage in your browser settings. If you block sign-in cookies, you will not be able to stay signed in. If you block or clear the Side Quest guest cookie, you will not be able to keep or reach guest progress in that browser.

5. Emails

We send emails that are necessary to operate your account: email verification, sign-in links, password resets and important account or security notices. You cannot opt out of these while you have an account.

When you sign up, or later on your Account page, you may tell us you would like ThingsToDoCity recommendations, events and updates by email if we start sending them. This choice is optional and unchecked by default. We record your choice, but we do not send promotional emails, and we will update this Privacy Policy before that changes. You can change your choice at any time on your Account page.

6. Service providers

We use the following service providers to run the Service. They process personal information on our behalf under their terms with us.

  • Supabase: database, account authentication, sending account emails, logs and backups. Links in our account emails pass through Supabase's authentication service before returning you to the Service.
  • Vercel: website hosting, content delivery, request logs and Web Analytics.
  • Cloudflare: Turnstile bot checks. Cloudflare acts on our behalf to detect bots. Cloudflare also states that it uses Turnstile signals, such as IP address, TLS fingerprint and browser user agent, as an independent controller to improve its bot detection. See the Turnstile Privacy Addendum at cloudflare.com/turnstile-privacy-policy.
  • Resend: delivery of our account emails.

We may also disclose information if required by law or legal process, to protect the rights, safety and security of our users, the public or ThingsToDoCity, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to your information.

7. How long we keep information

  • Account information, sign-up confirmations, email preference history and saved events and plans: until your account is deleted, or until you remove a saved event or plan.
  • Side Quest progress in an account: until your account is deleted (see section 8). Completed adventures and collectibles in an account remain viewable after a Side Quest's event ends.
  • Guest Side Quest progress: progress that is not linked to an account is deleted once 90 days have passed after the Side Quest's last day. For the Open House Chicago 2026 Side Quest, which ends on October 18, 2026, this deletion is scheduled for January 17, 2027. Until then, guest progress stays on our servers even if you can no longer reach it from your browser; after it is deleted, guest adventures and collectibles are no longer available. The same schedule applies to progress that has been disconnected from a deleted account.
  • Side Quest guest cookie: 90 days after it is set.
  • Bot-protection counters: stored only in a scrambled (hashed) form that does not contain your email or IP address. Bot-protection counters stop counting after five minutes. Expired records are removed during subsequent bot-protection checks.
  • Analytics: Vercel discards the visitor hash after 24 hours. Aggregated statistics are kept for analysis.
  • Service provider logs: our hosting, database and email providers keep logs of requests, sign-in events and email delivery, which can include your email address and IP address. Each provider keeps these logs for a limited period that depends on its service and our plan with it, and deletes them on its own schedule. A provider may also keep copies for longer under its own policies, for example in its backups or where the law requires it.
  • Backups: our database provider may keep backups of our database for a limited period that depends on our plan. Deleted information remains in backups until they expire, and backups are used only to restore the Service.
  • Support emails: for as long as needed to handle your request and keep a record of it.

8. Deleting your account

To delete your account, email support@thingstodocity.com from the email address on your account. We may ask you to confirm the request. When we delete your account:

  • your sign-in account, email address and password are deleted, and you are signed out on every device;
  • your sign-up confirmations, email preference history, saved events and plans are deleted;
  • your Side Quest progress is disconnected from your account right away, so it is no longer linked to you, and is then deleted on the guest progress schedule in section 7, or, if that date has already passed, when we process your request.

Some information may remain for a limited time after deletion:

  • in our service providers' logs, for the retention periods described in section 7;
  • in our database provider's backups, until those backups expire as described in section 7;
  • in our support mailbox, as a record of your request.

As section 7 explains, a provider may keep copies for longer under its own policies, for example in its backups or where the law requires it.

Emails already delivered to your inbox are not affected.

9. Your choices and rights

You can view your saved events, plans and email choice on your Account page and your Side Quest progress in My Adventures, change your email choice on your Account page, and ask us to delete your account at any time.

You may also email support@thingstodocity.com to ask for a copy of, or correction to, the personal information we hold about you. Depending on where you live, you may have additional rights under local law. We will not discriminate against you for exercising any of these rights. We may need to verify your request, usually by confirming it from the email address on your account.

Guest Side Quest progress is not linked to your name or email address, and we keep only a scrambled version of the browser cookie, so we generally cannot find, show, correct or delete a particular person's guest progress on request, or confirm that it belongs to the person asking. You can stop using guest progress at any time by clearing your cookies; the progress is then deleted on the schedule in section 7. If you have an account, you can sign in on the same browser and open a Side Quest page so the guest progress moves into your account, where your account requests apply to it.

Because we do not use tracking for advertising, we do not respond differently to Do Not Track or Global Privacy Control signals; we do not sell or share personal information for advertising whether or not those signals are sent.

10. Security

We use measures designed to protect your information, including encrypted connections (HTTPS), hashed passwords, restricted access to account data, bot checks and limits on repeated attempts, and two-factor authentication for our administrators. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Where information is processed

ThingsToDoCity is operated in the United States. Our database is hosted in the United States (Ohio, Amazon Web Services region us-east-2) and our website functions run in the United States (Washington, D.C. area, Vercel region iad1). Our providers may also process information in other countries, for example to deliver content quickly or detect bots. If you use the Service from outside the United States, your information will be transferred to and processed in the United States.

12. Children

The Service is a general-audience service and is not directed to children. Anyone can browse the Service, and you must be 18 or older to create an account. Side Quests are designed for adults and families to enjoy together. Children should take part with a parent or guardian, who can record the family's visits on the adult's own device or with the adult's own eligible account. We do not ask visitors their age before they record a Side Quest check-in, and we do not offer accounts or profiles for children. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, contact support@thingstodocity.com. We will delete the information we can find and connect to that child, such as an account. Guest Side Quest progress is not linked to a name or email address, so we may not be able to find it on request (see section 9); it is deleted on the schedule in section 7.

13. Other websites

Event listings may link to organizers' or ticketing partners' websites, and Side Quest places may link to the organizer's official information and to map services for directions. We do not share your account information with them when you follow these links. Their privacy policies, not this one, apply to information you give them or that they collect when you use them.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a new effective date. If a change is material, we will give reasonable notice before it takes effect, for example by a notice on the Service or by email to account holders.

15. Contact

Questions or requests about privacy: support@thingstodocity.com. ThingsToDoCity is operated by Things To Do Worldwide Inc.