Privacy Policy

1. What we collect and why

• Sign-in: your email address, and if you use Google, the basic details Google shares (your name, email address and, if you have one, a link to your Google profile picture). Used to create your account and sign you in.
• Profile: display name, date of birth, gender, country and home city (from a fixed list). Your date of birth is used to check you are 18 or over; other players only ever see your age, not the date. Optional: a short bio, an avatar or a profile photo you upload, and who you would like to Meet. Photos are resized and the hidden photo data (such as location) is removed before they are stored.
• Rides and results: each ride’s city, ride, distance, districts reached, coins collected and times, and your Whot and Race games. Used to run the game, credit coins, stop cheating and build the leaderboards.
• Leaderboards and City Timeline: your display name, km explored and coins earned appear on the leaderboards. A City Tour of 2 km or more is posted automatically to that city’s Timeline, which other players can see.
• Coins and Wallet: a record of every coin earned and spent (for example refills, fines, join fees, prizes and the Social pass) and your balance. Kept so your balance is right and can be checked.
• Social features: Meet taps and matches, friend requests and friends, notifications, chat messages, the players you block and the reports you make or that are made about you (a report keeps a copy of the reported message). Used to run these features and keep players safe.
• Profiles seen by others: players with a Social pass can see your display name, photo or avatar, gender, age, country, home city and bio.
• Settings: whether Music and Sounds are on, saved with your account.
• Shop Ads: which ad was on screen or tapped during a ride, with the ride, city and district. Used to count views for ad reports, which show totals only.
• Admin records: if our team suspends an account, changes a role, removes a photo or handles a report, we keep a record of what was done, by whom and when.
• Error reports (Sentry): when something breaks, the error, the page, and your browser and device type. We have turned off the setting that sends personal data, and session recording.
• Usage (PostHog): anonymous taps on buttons and links and the screens opened, to see which parts of the game are used. PostHog sets no cookies, stores nothing on your device and does not link these events to your account.

We use your data to provide CityLife under our terms with you, for our legitimate interests in keeping the game fair, safe and working, to meet legal duties, and, where the law requires it, with your consent.

2. Cookies and your device

We use only the cookies needed to keep you signed in. The app also keeps a few small settings on your device (for example Music and Sounds, and whether you dismissed the install bar), and files so it can open offline. We use no advertising or tracking cookies.

3. Where your data is kept

• Supabase (database, sign-in and photo storage): EU region.
• Vercel (hosting): the app’s server runs in London. Vercel handles each request to the website, including your IP address.
• Sentry (error reports): EU.
• PostHog (usage): EU.
• Google: only if you choose to sign in with Google, under Google’s own privacy policy.

These providers process data for us under their terms. Some of our providers store or process data outside Nigeria (for example in the European Union). We only use providers that protect personal data with appropriate safeguards, such as standard contractual clauses, as required by the Nigeria Data Protection Act 2023.

4. How long we keep it

We keep your account data for as long as your account is open. When you ask us to delete your account, we delete your account and personal data, except records we must keep for a legal reason, to prevent fraud or to deal with a report or a claim, which we keep only as long as that needs. If you are under 18, your date of birth is never stored.

5. Sharing

We do not sell your personal data, and we do not share it with advertisers. We share it only with the providers in section 3, with other players as described in section 1, and where the law requires it.

6. Your rights

Under the Nigeria Data Protection Act 2023 and the UK GDPR you have the right to:

• access the personal data we hold about you and get a copy;
• have it corrected if it is wrong;
• have it deleted;
• object to, or ask us to limit, how we use it;
• withdraw consent where we rely on it;
• complain to a regulator: in Nigeria, the Nigeria Data Protection Commission (NDPC); in the UK, the Information Commissioner’s Office (ICO).

You can change your bio, photo, avatar and Meet preference in Profile. For anything else, email us at contact@cloud23soft.com from the email address you sign in with. We may need to check it is you, and we will reply within the time the law sets.

7. Children

CityLife is for adults only. Nobody under 18 may use it. If the date of birth given shows someone is under 18, the account is blocked and the date of birth is not stored. If you think a child is using CityLife, tell us.

8. Security

Data travels over encrypted connections. Each player can only read their own private data, profile photos are kept in private storage, coin balances can only be changed by our server, and admin tools are open only to our team and record what they do. No system is perfectly secure: if we learn of a breach that affects you, we will tell you and the regulator as the law requires.

9. Changes to this policy

We may update this policy. The date at the top shows the latest version. If a change is important we will tell you in the app.

10. Contact

You can reach Games366 Studios Ltd at contact@cloud23soft.com.