Privacy

Short version: no accounts, no tracking cookies, and the free calculator still runs in your browser. Buying a Decision Pack creates a short-lived encrypted pending scenario, then a pseudonymous order record that expires three years after purchase. Your report link carries the encrypted scenario needed to build the report. It never becomes a cityparity profile.

Longer version follows. Optional paid reports are covered below.

No accounts

There's no signup wall and no login, and nothing on the calculator is required beyond the numbers you want compared. Optional boxes ask for an email for the updates list or a reply to a correction. A Decision Pack purchase also requires an email so Stripe can record the transaction and Resend can deliver the report link. None of these create a cityparity account.

No invasive tracking

No Google Analytics, no Mixpanel, no Hotjar, no Segment, no advertising pixels, no tag managers, no cookies that follow you around. Two things run here, both cookieless. The first is Cloudflare Web Analytics: a counter that tells us aggregate things like how many people visited and which page they landed on. The second is a small feature-usage counter we wrote ourselves. It records that a comparison was run and for which two cities, that a salary was entered (never the amount), which result tab was opened, roughly how long the page stayed open, your country as a two-letter code, the outside site you arrived from (just the domain, say google.com or a LinkedIn referral), and which links you click (the internal page, or the domain if the link leaves the site). Cloudflare resolves that country code at its edge; we never log or keep the IP address it came from. Each event is an anonymous count with a random id that dies when you close the tab: no stored IP address, no browser fingerprint, no profile, and the data never leaves our own hosting account. We added both for one reason: to know whether anyone's actually finding the tool and which parts are worth improving. Want out anyway? Visit any page with ?rum=off in the URL once and that browser is excluded from both. You can verify all of this by viewing source or watching your network panel.

localStorage

The site uses your browser's localStorage for three small, impersonal things: the exchange rate from a free currency API (valid for 24 hours, so we don't hammer their service on every page load), the last few cities you've viewed so they're handy in the picker, and, if you've used the opt-out above, a flag remembering that choice. Small JSON blobs and one flag: currency codes, city names, a timestamp. Nothing about you, your IP, your salary, or your behavior. Clearing your browser data clears it.

Exchange rate API

When the localStorage cache expires, your browser fetches fresh rates from exchangerate-api.com. That request goes from your machine to their server, which means they see your IP per their privacy policy. We don't see anything about it on our end and don't proxy the request.

Google Fonts

The display and body typefaces load from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Your browser pulls them straight from Google, so Google sees your IP address per their privacy policy. We hand them nothing else and get nothing back about you. Prefer to skip it? Block those two domains and the page falls back to your system fonts. Nothing else breaks.

Hosting

The site is served by Cloudflare. They handle traffic at the network level and have their own privacy disclosures. We don't pull custom logs from them and don't have access to per-visitor data.

Cookies

We don't set any. Cloudflare may set its own at the edge for fraud detection; that's outside our control and isn't used for tracking.

If you contact us

Two ways to reach us: the form on the contact page, or the email address. Either way we see your message, plus your email if you gave one. Form submissions sit in a private review queue that only we can read, and they stay there while we work through the backlog. Nothing goes on a mailing list. Nothing gets shared. Want yours deleted? Ask and it's gone.

If you flag a number

The "Spot something off?" button sends your note, the figure you were disputing, and the settings behind it: bedrooms, household size, filing status. That context is the point, because "Berlin housing is too high" is unanswerable without knowing you were looking at a two-bedroom. Your salary is never sent. On the salary and tax rows we drop the disputed figure as well, since that number would invert straight back into your salary. Flags land in the same private review queue as the contact form.

The form also has an optional email box. Blank means the report stays anonymous. Fill it in and that address does one job: replying about this report, whether that is a follow-up question or word that the number changed. It never joins the updates list, which is a separate opt-in you confirm by email.

If you subscribe to updates

There is one optional email list. It carries occasional news about cityparity itself: new cities, refreshed numbers, new guides, and corrections we have shipped. Every signup box on the site joins that same list, wherever you found it. A second list existed while the Decision Pack was in development; it closed to new signups when the Pack went on sale, and nothing on the site can add an address to it.

It uses double opt-in. Enter your email, tick the consent box, and you'll get one confirmation email you have to click before you're added. Until you confirm, you're not on the list. Your email is stored by our email provider and is never sold, rented, or shared with anyone else. Every email has a one-click unsubscribe, and you can ask us to delete your address at any time.

Two things we will not do with it. We will not send you someone else's marketing, because we do not sell or share the list. And we never tie your email to the anonymous usage data described above; those stay separate by design, so signing up does not turn the anonymous counter into a record of what you personally looked at.

Decision Pack data and recovery

The Decision Pack is not on sale yet. This section is published ahead of it so the terms are readable before anyone can pay, and none of the processing below happens until checkout opens.

The free calculator keeps your salary and household inputs in your browser. When you choose to buy a Decision Pack, the purchase request creates a pending record with your scenario encrypted. That pending record can remain for up to 15 days to cover delayed payments, and we delete it as soon as fulfilment succeeds.

Checkout runs through Stripe Managed Payments, with Link as the merchant of record. Stripe and Link keep the payment record under their own privacy terms. Resend is our delivery provider. It receives your email address and the generic fulfilment message containing your encrypted report link.

After delivery, your scenario sits inside the buyer link in encrypted form. Opening that link sends the encrypted scenario to our Cloudflare Worker, which decrypts it long enough to compute and render the report. We do not add the scenario to the order record or keep another copy after delivery. If you later ask us to recover a lost link, you send a new scenario through the temporary support process below.

The report is rendered when you open it using the data available that day, and it prints its build date. A source correction can therefore improve the figures on a link you already have. The response is private, excluded from search indexing, and kept out of shared caches.

What we keep is a pseudonymous schema-v3 order record: our order reference, Stripe identifiers, the cities purchased, payment status, purchase and fulfilment dates, a one-way hash of the report token, and the link's expiry date. The record and its lookup indexes share one absolute three-year expiry measured from the original purchase. Later opens, edits, refunds, or support work do not extend it.

Your email address, salary, household settings, and readable report token are absent from that order record. Stripe and Link already hold the payment email, so we do not keep another copy in our order store.

Lost the link? Email support@cityparity.com from the payment email and include a fresh calculator share link. We need that fresh link because the original scenario inputs are no longer retained after delivery. Once we verify the purchase, we help you replace the pack at no charge through a fresh checkout. If restoration is unavailable, we refund the whole purchase.

During recovery, the fresh calculator share link is temporarily readable in our support mailbox. We delete the source recovery message or thread as soon as replacement fulfilment succeeds, or when the recovery case closes if there is no replacement. We retain only sanitized opaque case metadata, such as the case reference and resolution, with no share link, salary, household settings, or report token.

One honest limit. That order record still says somebody bought a Seattle to Oslo report, and Stripe can attach a name to it. We hold no name ourselves, and we never join it to the anonymous counters above. Pseudonymous is the accurate word, and three years is a long time to hold anything.

If you click a partner link

Some outbound links to partners are affiliate links, marked where they appear. Clicking one takes you to the partner's own site, and from that point their privacy policy applies, not ours. The partner can tell the visit came from cityparity and pays us a commission if you sign up. Your price is the same either way.

What that means for your data here: we set nothing on you to make it work. The referral is carried in the link itself, and the partner's site typically sets its own cookies on its own domain to remember where you came from. We record only that a link of that type was clicked, in the same anonymous counter described above, with no identifier attached. No partner is ever told anything about you as an individual, because we do not have anything to tell them.

Full detail, including which categories carry partner links and how placement is decided, is on the affiliate disclosure page.

That's it. Less to say is usually a good sign.

Last updated: 2026-08-20