Back to rules

Privacy Policy

Last updated: September 21, 2026

1. Introduction

City Mission ("we", "our", or the "App") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and process your information when you use our mobile application.

2. What data we collect

2.1. Location data

For geo missions, we use your device's GPS. Location data is used only during the game and is not stored on our servers at any time.

2.2. Game progress

We store your game progress (completed missions, points, team name) on your device. This information may be synced with our servers for statistics.

2.3. Photos and camera permission (Android.permission.CAMERA)

The app uses your device's camera (Android.permission.CAMERA) during photo tasks so you can take pictures of task subjects. Camera permission is required for these features to work.

Camera permission is used only for:

  • taking photos of task subjects during the game;
  • uploading photos to our servers for validation and, where applicable, AI transformation;
  • providing game functionality.

Use of data: Photos you take are sent to our servers. They may be processed using artificial intelligence (for example, to verify whether a task was completed correctly) and, where the mission specifies this, transformed. Photos and related outputs are kept for a limited time (by default up to 7 days, unless stated otherwise) and are then removed. We do not have access to your camera when it is not in use within the app. Photos are stored on secure servers.

Your control: You may refuse to grant camera permission, but this will limit the app's functionality, as photo tasks cannot be completed.

2.4. Team-based races and photos visible to other participants

If you play in team-based races (competitions with a shared race code), photos taken during photo tasks—both the original image and, where applicable, its AI-generated transformation—may be shown in the app to other participants in the same race (for example in the race photo gallery), together with game-related information such as your team name. This supports sharing the experience within the race; by joining a race, you understand that other participants may see these photos for as long as they are stored in our systems under the retention rules described above.

Outside of the race context, photo viewing is limited to that game or your account, as provided in the app.

2.5. Subscription and payment data

If you purchase a subscription, payment processing is handled entirely by Apple (App Store) or Google (Google Play). We do not collect or store your payment information (credit card numbers, billing addresses, etc.).

We may receive from Apple or Google: subscription status (active/expired), subscription type, and transaction identifiers for customer support purposes.

2.6. Error reports

We collect technical data about app errors (error reports, device and app version) so that we can fix them. This uses the Sentry service. For usage analytics, see section 2.8.

2.7. Over-the-air updates

The app may check for software updates when you open it (over-the-air updates). This uses a service provided by Expo (EAS Update). Only technical data needed for updates is sent (e.g. app version, update channel); no personal data is collected for this purpose.

2.8. Analytics in the app

We use the PostHog analytics service in the app to understand how the app is used and to improve it.

Data collected:

  • usage events (opening a mission, starting it, completing tasks, opening the app) and related game information;
  • a device identifier that allows us to distinguish users between sessions;
  • the account identifier of a signed-in user (without the email address);
  • approximate location – city and country, derived from GPS coordinates when you have granted location permission. It is used only for segmentation by city; precise coordinates are not stored in analytics;
  • technical information about the device (model, operating system version, language, app version).

Legal basis: legitimate interest in improving the service (GDPR Art. 6(1)(f)). This data is not used for advertising and we do not track you across other apps or websites.

This data is used solely to improve the app. If you have questions about how usage data is processed, contact us via the contact page.

3. How we use data

We use your data only for:

  • providing game functionality;
  • location checks in geo missions;
  • checking and transforming photos in photo tasks;
  • showing photos (including transformations) to other race participants when you play in a race;
  • saving game progress;
  • improving the app and fixing errors;
  • usage analytics in the app (see 2.8).

4. Data storage

Your data is stored on secure servers. Photos and related outputs are kept for a limited time (by default up to 7 days). Game statistics may be stored for a longer period in anonymised form.

5. Your rights

You have the right to:

  • Receive information about stored data
  • Request correction of inaccurate data
  • Request deletion of your data
  • Opt out of data collection (for example, by uninstalling the app)

6. Third parties

We use the following third-party services:

  • Google Cloud Storage – for storing photos
  • OpenAI – for photo checks and (when enabled in configuration) analysis
  • Google Vertex AI (Gemini) – for photo transformation and (when enabled in configuration) checks
  • Sentry – for error monitoring
  • Expo (EAS Update) – for delivering app updates over the air
  • RevenueCat – for subscription management. RevenueCat may process anonymised user identifiers and purchase receipts to sync subscription status across your devices and provide customer support features.
  • Apple App Store and Google Play – for payment processing
  • Google Analytics 4 (Google Ireland Ltd.) – for anonymous website (citymission.lt) usage analytics, only with your consent (see section 9)
  • PostHog (PostHog Inc., EU data centre – eu.i.posthog.com) – for website (citymission.lt) and mobile app usage analytics (see sections 2.8 and 9)
  • Apple (iOS) and Google (Android) – for converting coordinates into a city name (reverse geocoding) when deriving approximate location for app analytics (see 2.8)

7. Contact Us

If you have questions about this privacy policy, please contact us via the contact page.

8. Changes

We may update this privacy policy. We will notify you of significant changes within the app.

9. Cookies and website analytics

This section applies to the website citymission.lt. For analytics in the mobile app see section 2.8 – cookies are not used in the app, so there is no consent banner there. The website uses two analytics services: Google Analytics 4, provided by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland), and PostHog, provided by PostHog Inc. using an EU data centre (eu.i.posthog.com), to measure traffic and improve content.

9.1. Data collected

  • anonymised IP address (last octet truncated on Google's EU servers);
  • URLs of pages visited and in-site navigation events;
  • referrer and UTM parameters;
  • device / browser type, language, approximate geographic location (country / city);
  • session identifier in cookies (_ga, _ga_*), stored for up to 13 months.

We do not collect precise location, names, email addresses or other directly identifying data via Google Analytics.

9.1.1. PostHog analytics

We use PostHog at two tiers, depending on your consent:

  • Before consent (anonymous mode): we collect only anonymous pageview events and their source (referrer, UTM parameters). This data is not stored on your device (no cookies or localStorage), and no persistent identifier is created, so you cannot be tracked across visits or linked into a single person. No IP address is collected.
  • With consent: a persistent identifier is additionally used in a cookie / localStorage, enabling measurement of returning visits, usage flow (funnels) and first-touch source attribution.

9.2. Legal basis and consent

Analytics that rely on persistent tracking (Google Analytics, PostHog with an identifier) are activated only after your explicit consent(GDPR Art. 6(1)(a)), given by clicking "Sutinku" ("I agree") in the consent banner shown at the bottom of the site. Until consent is given, Google Analytics uses Google Consent Mode v2 (all analytics, advertising and functional storage denied by default), and PostHog runs in anonymous mode without an identifier (9.1.1), relying on legitimate interest to measure aggregate traffic (GDPR Art. 6(1)(f)).

9.3. Storage and transfers

Google Analytics data is retained for 14 months and then deleted automatically. The processor is Google Ireland Ltd. (EU); during technical processing data may be transferred to Google LLC (USA) under the EU–US Data Privacy Framework and Google's Standard Contractual Clauses.

PostHog data is processed in an EU data centre (eu.i.posthog.com) and retained according to PostHog's configured retention period.

9.4. Withdrawing consent

You can withdraw consent at any time by:

  • clearing your browser storage for this site (localStorage key citymission-consent-v1) – the banner will reappear;
  • using your browser's "Do Not Track" or cookie-blocking extensions;
  • installing the Google Analytics Opt-out Browser Add-on.

9.5. Necessary and analytics storage in the browser

Your consent choice is stored in the browser's localStorage key citymission-consent-v1. This entry is technically necessary so that the banner does not appear on every visit and is therefore used without separate consent (GDPR Art. 6(1)(f) – legitimate interest).

After consent is given, first-touch source attribution data is stored in the localStorage key citymission_attribution_v1, and Google Analytics (_ga, _ga_*) and PostHog identifier cookies / entries are used. These entries only appear after your consent and are removed when you withdraw it (9.4).

9.6. Your rights

Regarding data processed by Google Analytics and PostHog, you may exercise your GDPR rights (access, rectification, erasure, restriction, objection, portability) by contacting us via the contact page. You also have the right to lodge a complaint with the Lithuanian State Data Protection Inspectorate (VDAI, vdai.lrv.lt).

Privacy policy in Lithuanian