Illustrative images. The pictures in this guide are illustrations based on the real place, not photographs, and may differ from it.

What we keep,
and why.

Updated on September 23, 2026.

Summary Without an account, we only count the visit, without knowing who you are.

With an account: name, email, your photo if you add one, what you saved and what you liked.

We don't sell data to anyone.

Who is responsible

Cidade Turismo is run by MX Tecnologia e Gestão. For any matter related to this policy, you can reach us through the contact page.

Browsing without an account

You can read the whole guide without signing up. In that case we don't create a profile of you and we don't keep a browsing history linked to you.

To know how many people visit the guide and which pages they read, we use Google Analytics. It records the visit statistically (page viewed, approximate city and region, type of device, where the person came from) and doesn't receive your name or your email. To do this, Google sets its own cookies in your browser (the ones starting with _ga). The data stays with Google, under the Google privacy policy. You can block those cookies in your browser, and the guide keeps working the same way.

With an account

When you create an account, we keep:

Name and email, which you provide.
Your password, in irreversible form. We apply a key derivation function to it (PBKDF2). We don't store the password, and we have no way of finding it out, not even us.
Your profile photo, if you add one. It appears, small, to other signed-in people when you "like" a place. When you change or remove it, the previous one is deleted.
The destinations, cities and attractions you saved, and the places you "liked". People who "liked" something appear in circles next to the button: to signed-in users, with their photo and first name; to visitors, only with their initials.
Date of creation and of the last access.

We use this to keep your account working and to show what you saved. Nothing else.

Cookie

On our side, we use one cookie, called ct_sessao, and only after you sign in. It holds a random number that identifies your session: it doesn't hold your name, your email or anything about you. It is marked HttpOnly and Secure, which prevents another website or a script from reading it.

Signing out closes the session and deletes the cookie.

What we don't do

We don't sell, rent or share your data.
We don't use behavioral advertising.
The only third-party service our pages load is Google Analytics, described above. No font, image or ad comes from outside.

Your rights

Under Brazil's General Data Protection Law (LGPD), you can at any time see the data we hold about you, correct it, or delete your account and everything linked to it. You change your name, photo and password in My account, and account deletion is also there, without having to ask anyone. For anything else, write to the contact on this page. Deleting means deleting: we don't keep a copy.

For how long

For as long as your account exists. When you delete the account, we delete the data right away. Sessions expire on their own after 30 days.

Security

The website runs entirely over HTTPS. Passwords are stored as hashes, and session identifiers are also stored as hashes: someone with access to the database could not impersonate you.

App

The Android app has its own policy, because it collects things the website doesn't: app privacy policy.

Changes

If this policy changes, the date above changes too. Relevant changes are announced by email to account holders.

What we keep,and why.