Privacy Notice
Vida Ventures Β· 02/10/2026
Vida Ventures ("we", "us"), a company registered in the Netherlands, operates CityWalkGems. We are the data controller for the personal data we process about you. This Notice explains what we collect, why, how long we keep it, who we share it with, and your rights.
1. Data We Collect
β’ Account data: email address, password hash, display name, sign-in provider (e.g. Google) and timestamps. β’ Location data: GPS coordinates while a tour is active, used to unlock location-based stops and to display your position on the map. β’ Progress and gameplay data: tours started/completed, badges, points, photos you choose to upload, feedback you submit. β’ Device and technical data: device type, browser, language, IP address, app version, crash logs, and basic usage telemetry. β’ Payment metadata: order ID, product purchased, amount, currency and country. On the website these are collected by Paddle and shared with us; in the iOS and Android app purchases go through the Apple App Store or Google Play and we receive these details via RevenueCat. We never receive full card details.
2. Why We Use Your Data (Purposes and Legal Basis)
β’ To provide the service (account, tours, location features, progress tracking) β performance of our contract with you. β’ To process payments and prevent fraud β performance of contract and legitimate interest. β’ To improve route quality and app performance using aggregated/anonymized usage data β legitimate interest. β’ To send essential service emails (purchase confirmations, account changes) β performance of contract. β’ To send marketing emails β only with your consent, which you can withdraw at any time. β’ To comply with legal obligations (tax, accounting, responses to lawful requests) β legal obligation.
3. Who We Share Data With
β’ Paddle.com Market Limited and Paddle.com Inc. β our Merchant of Record. Paddle processes payments, subscription billing, tax compliance and invoicing. See Paddle's Privacy Notice: https://www.paddle.com/legal/privacy. β’ Hosting and infrastructure: Supabase / Cloudflare for application hosting, database storage and global content delivery. β’ Email delivery: our transactional email provider for purchase receipts and account notifications. β’ PostHog (PostHog Inc., data stored in the EU) β product analytics and error reports: which screens and buttons you use, your progress in a tour, app version, platform (web, iOS or Android), device type, language and a pseudonymous user ID. No name and no email address. Purpose: improving the app and fixing errors. Without your consent it runs without cookies or local storage; only with your consent does it use cookies or local storage. β’ Our own statistics β we record ourselves which tour steps and screens are used, without cookies, with a pseudonymous visitor ID on your device, based on legitimate interest; not shared with third parties and not used for profiling. The data is stored in our own database in the EU. β’ RevenueCat (RevenueCat Inc.) β manages purchases and subscriptions in the iOS and Android app: a pseudonymous user ID, the products bought, Apple or Google transaction IDs, country and currency. Purpose: linking your purchase to your account and restoring it on another device. β’ Apple and Google β when you buy in the app through the App Store or Google Play, or sign in with Apple or Google. See their own privacy notices. β’ Authentication: Google or Apple, when you choose to sign in with Google or with Apple. β’ Professional advisers (legal, accounting) and authorities where required by law. We do not sell your personal data.
4. International Data Transfers
Data is primarily processed within the EEA. Where transfers outside the EEA take place (e.g. via Paddle's US entity or other sub-processors), we rely on adequacy decisions or the EU Standard Contractual Clauses to provide appropriate safeguards. PostHog and RevenueCat are (part of) US companies. Where data is transferred outside the EEA, this is based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses.
5. Data Retention
β’ Account data: kept while your account is active and up to 24 months after deletion for fraud prevention and legal claims. β’ Gameplay data: kept while your account is active; anonymized analytics may be retained indefinitely. β’ Payment records: retained by Paddle and by us for 7 years to meet Dutch tax and accounting obligations. β’ Support correspondence: up to 24 months. We delete or anonymize personal data when it is no longer needed.
6. Security
We apply appropriate technical and organizational measures including encryption in transit (HTTPS), encryption at rest, role-based access controls, row-level security on our database, secure password hashing, and regular security reviews.
7. Your Rights (GDPR)
If you are in the EEA or UK, you have the right to: access your personal data; request correction or deletion; restrict or object to processing; data portability; withdraw consent at any time; and lodge a complaint with your local supervisory authority (in the Netherlands: the Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl). To exercise your rights, email hello@citywalkgems.com. We will respond within one month.
8. Cookies and Similar Technologies
We use strictly necessary cookies and local storage to keep you signed in, remember your language preference, and protect against abuse. We may use analytics cookies to understand usage; these are loaded only with your consent where required. You can manage cookies in your browser settings. In the iOS and Android app we do not use an advertising identifier (IDFA/AAID) and we do not track you across other companies' apps or websites.
9. Children
CityWalkGems is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.
10. Changes
We may update this Notice. Material changes will be communicated in-app or by email. The "updated" date below reflects the latest revision.
11. Contact
Vida Ventures, the Netherlands. Email: hello@citywalkgems.com
Email address with feedback or a bug report
When you report a problem or send feedback, you may optionally leave an email address. We use it for one purpose only: to get back to you about that specific report. It is never added to our newsletter or any marketing list, is not shared with third parties, and you can leave the field empty or clear a pre-filled address at any time. We keep it with the report for up to 24 months and then delete it.
Email address to save your progress
You can optionally link an email address to your (otherwise anonymous) player identity so your progress and badges survive a browser that clears its storage. We use it for two things only: sending the confirmation link and letting you sign back in with a magic link. It is never added to our newsletter or any marketing list and is not shared with third parties. You can remove it by deleting your account in Settings.
Tour photos
Photos you take during a tour are kept for a maximum of 30 days, after which they are automatically deleted. If you have your certificate and photos sent to you by email, we keep that copy for 12 months so the links in your email keep working; after that it is deleted too. The copy in your email itself stays yours. We never use your photos for anything else and do not share them with third parties.