Privacy
Last updated October 22, 2026. Version 2026-10-22.
InTown turns a company's numbers into a small town you can leave on a TV. It is made by Symph in Cebu, Philippines. This page says what we keep from each tool you connect, for how long, and how to delete it.
Who we are
InTown is run by Symph, in Cebu, Philippines. For anything about your data, write to dataprotection@symph.co.
When you sign in with Google
We get your name, email address, Google account ID and, for a Google Workspace account, your company's Workspace domain. We use them to sign you in and to decide who can open a town. We don't send you marketing email. We also note which version of this page you saw when you signed in.
What we keep from the tools you connect
The rule is the same for every tool below. We read what the town needs, work out the numbers it shows, like revenue this month or how many tickets are late, and keep those numbers and their labels. We don't keep the rows or records behind them, or the names of your customers. InTown can only read your tools, never change them.
Google Sheets and Google Drive
- You pick the sheet in Google's own file picker. That lets us open the files you pick and nothing else in your Drive.
- If the picker does not open, you can paste a sheet's link instead. Then we read whatever that link opens, so only paste a link to a sheet the town should read.
- To read the sheet again while nobody has the town open, we keep the refresh token Google gives us, encrypted. Delete your account and we tell Google to cancel the token, then delete it.
Xero
From the one Xero organization you pick, we read invoices, payments, bank transactions, contacts, organization settings and the bank summary, aged and profit and loss reports. We keep the refresh token Xero gives us, encrypted, and the numbers the town shows.
HubSpot
We read deals, contacts, companies and deal owners to count things like open pipeline and new leads. We keep the refresh token HubSpot gives us, encrypted, and the counts. Contact names and emails are never saved.
Jira
On the Jira sites you tick, we read issues and who they are assigned to, to count open, blocked and late work per project. We keep the refresh token Atlassian gives us, encrypted, and the counts.
Stripe
You paste a restricted key that can only read. We use it to work out your balance, charges, subscriptions and paid invoices. We keep the key, encrypted, and the totals. Customer details and card details are never saved.
PostHog
You paste a personal API key that can only run queries. We ask PostHog for counts only: people seen, errors today and signups this week. We keep the key, encrypted, and the counts. No single person or event is ever read.
A file you upload, or a town sent from your computer
From an uploaded file we keep the numbers and column names, not the rows. Some towns are built on the owner's computer and sent to us. Then we keep the numbers and labels the town shows, plus any logos sent with it. Email addresses are removed before anything is saved.
Your town's usual day
To tell you when today is quieter or busier than normal, each town keeps one number a day for each part of the town, plus that number as it stood each hour. These are totals the town already shows. We keep 13 months of them, then delete the older days.
Anonymous averages
Off for every town until its owner turns it on in the town's settings. When it is on, your town adds to averages for towns in the same trade and team size, and reads those averages back. What is shared is the count of towns, the average and the spread. Nothing is published until 5 or more towns take part, and never your town's name or any single number of yours. Turn it off any time and your share comes out on the next nightly update. We keep who turned it on and when.
People in your town
When an owner adds people, we keep their email addresses to let them in. If the owner sends an invite, it goes out by email through our mail provider, Resend.
TV links
Anyone who has a town's TV link can see that town until the owner makes a new link or turns it off.
TV captions
When a town plays on a TV, a one-line caption sits under each view. To write those lines we send the town's totals, like revenue this month or how many tickets are late, to Claude, an AI model made by Anthropic. We never send the rows of your sheets or tools, names of your customers, or anything you didn't already see on the town. Anthropic doesn't use what we send to train its models. If the call fails, the captions are written by fixed rules instead.
When you ask us to set it up
The "Talk to us" form sends your work email, the kind of business you picked and, if you add them, the tools you use. We keep them so we can get in touch about setting up your town, and we note which version of this page the form linked to. Nothing is sent to you automatically. We keep these until you ask us to delete them.
When you send the lab an idea
The idea form on the lab page sends the idea you write and, if you add one, your email so we can reply. We keep them so the lab crew and Symph staff can read them. Ideas are never published as you sent them. If one turns into a piece, the piece is written fresh and Jarrhey approves it before it goes up. We keep ideas until you ask us to delete them.
When you do the blind picks
The blind-pick page needs no sign-in. Each tap saves which scene you picked and how long it took, with random IDs for you and your round that the page makes and keeps in your browser. A scrambled form of your IP address stops floods of taps, and we wipe it after a day. We keep the taps two years, then delete them.
Counting where people stop
To see where people get stuck between this site and a town on a TV, we count steps like opening a sample town, signing in or making a TV link. Each count keeps the step, the time, the kind of business and whether it was a phone or a laptop. Before you sign in it carries a random ID kept in a cookie for 30 days. After you sign in it carries a scrambled ID for the town instead. It never carries your name, your email, the sheet you picked or anything in it, and it is never sent to anyone else. With Do Not Track or Global Privacy Control on, your browser sends none of these counts. We keep them 13 months, then delete them.
Logs and security
- Your IP address is stored only as a salted hash, to slow down repeated tries. Those rows are deleted after a day.
- Cloudflare keeps request logs for up to 7 days so we can fix errors.
- We keep a record of security changes to each town, like people added or removed, links made or turned off, and the town deleted, plus every time Symph staff look into a town. It holds account IDs, not email addresses or your numbers. The town's owner sees the last 30 days in settings. We keep it for 400 days, and it stays after a town is deleted, since it is the record of what happened.
When Symph staff look into your town
Symph staff can't open your town by default. To help you, a staff member has to give a reason, and then gets read-only access to that one town for an hour. Your settings page shows when that happened and the reason they gave.
What we never do
- Sell your data, or share it with advertisers.
- Send the rows of your sheets or tools to an AI model. Only the TV captions use AI, and they only get totals.
- Use your data, or data from Google, to train any model.
Google user data
InTown's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to sign you in and to draw your town, and people at Symph read it only when you ask us to help with your town or the law requires it.
Where it is processed
InTown runs on Cloudflare's network, which has servers in many countries, so your data may be processed outside the Philippines. Data is encrypted in transit and at rest. The tools you connect, Google, Resend and Anthropic each handle only the part described above.
How long we keep it
| Sign-in sessions | 30 days after you last use InTown |
|---|---|
| Hashed IP rows for rate limits | 1 day |
| A town's daily totals | 13 months |
| Counts of the steps people take | 13 months |
| Towns and their numbers | Until you delete the town |
| Keys and tokens for your tools | Until you remove the tool or delete the town |
| Your account | Until you delete it |
| "Talk to us" requests | Until you ask us to delete them |
| Lab ideas | Until you ask us to delete them |
| Blind-pick taps | 2 years, the scrambled IP 1 day |
| Security record | 400 days |
| Cloudflare request logs | Up to 7 days |
| Database backups | 30 days |
Deleting your data and taking access back
- Delete a town from its settings page. Its numbers, daily history and sources go with it, and so do the keys and tokens for every tool connected to it. Where the tool lets us, like Xero and HubSpot, we also cancel the sign-in at their end.
- Remove a tool from the town to stop us reading it, and its key or token is deleted. You can also take access back at the tool itself: the third-party access page of your Google account, the connected apps page in Xero, HubSpot or Atlassian, or by deleting the key you gave us in Stripe or PostHog.
- Delete your account from Your towns, then Delete account. That deletes every town you own, your place in other towns, your Google token (we tell Google to cancel it first), your sign-ins and the account itself. You can sign up again with the same email afterwards. If you can't sign in, email dataprotection@symph.co and we will do it within 30 days.
- Database backups roll off after 30 days, so a deleted record is fully gone by then.
Your rights
Under the Philippine Data Privacy Act you can ask what we hold about you, have it corrected, have it deleted, object to how we use it, and get a copy to take elsewhere. Write to dataprotection@symph.co. If you are not happy with our answer, you can complain to the National Privacy Commission.
Changes
When this page changes, the date and version at the top change too. Sign-in, the "Talk to us" form and the lab idea form link here, and we keep which version you saw.
Questions
Email dataprotection@symph.co.