Privacy Notice

Version: 1.0
Effective date: 21/09/2026

1. Who we are

City Odyssey is operated by Reka Fasi, a sole trader based in Scotland, United Kingdom, trading as City Odyssey. For data-protection purposes, Reka Fasi is the controller of the personal information described in this Privacy Notice.

This Privacy Notice applies to the City Odyssey mobile application, the City Odyssey website and related support and communication services.

Contact details

Email: info@gocityodyssey.com
Website: https://gocityodyssey.com

2. Information we collect

The information we collect depends on how you use City Odyssey.

Account information

When you create or use an account, we may collect:

Your email address.
Your chosen display name and avatar.
Your unique account identifier.
Your chosen sign-in method, such as email, Google or Apple.
If you sign in with Google and Google provides one, the Google profile-photo URL automatically stored by Firebase Authentication and FlutterFlow. City Odyssey does not display or otherwise use your Google profile photo.
Records of your confirmation that you are aged 18 or over, acceptance of the Terms of Use and acknowledgement of the Privacy Notice, including the applicable version and date and time.
The date your account was created.
Information needed to authenticate and secure your account.

City Odyssey does not receive your Google or Apple password.

Adventure and progress information

We may store:

Adventures you have purchased or are entitled to access.
Your latest chapter and story progress.
Bingo selections.
Eliminated and locked-in rumours.
App preferences, including text size, appearance, story-reminder and marketing choices, and when those choices were last updated.
Information needed to restore your access on another compatible device.

Purchases

When you purchase an adventure, Apple or Google processes the payment. We may receive information such as:

The product purchased.
Purchase status and entitlement.
Store and transaction identifiers.
Purchase, refund, reversal or restoration status.
The account identifier associated with the entitlement.

We do not receive or store your complete payment-card details.

Support and feedback

If you contact us by email, through a City Odyssey app form or through a Wix form on our website, report a problem or suggest an improvement, we may collect:

Your email address.
The topic and contents of your message.
Details of the problem and the steps preceding it.
Your expected result.
Your app version, device platform and latest chapter where supplied.
Any other information you choose to include.

Our forms are designed to collect only information reasonably necessary to respond to your enquiry, provide support or consider your feedback. Please do not provide unnecessary personal information.

Please do not include passwords, payment-card details, health information or other unnecessary sensitive information in these forms.

Technical and usage information

Subject to applicable consent requirements and your settings, we and our service providers may collect:

Device type, operating system and app version.
The screen or app action associated with a crash or technical error, where included in a diagnostic report.
Crash reports and diagnostic information.
Performance information, including loading times and technical errors.
Internet Protocol address, network information and device or installation identifiers.
Push-notification tokens.
General technical location inferred from an IP address.

We use this information to operate, secure, troubleshoot and improve City Odyssey. We do not use it to track you across unrelated companies’ apps or websites for advertising.

Information we do not intentionally collect

City Odyssey does not intentionally collect or access:

Your precise GPS location.
Images or videos captured by your device camera or uploaded from your device. However, Google may provide a profile-photo URL when you use Google Sign-In, as explained above.
City Odyssey does not request access to your device’s camera or photo library.
Microphone recordings.
Contacts or calendar.
Motion, fitness or health information.
Bluetooth information.
Communications between users.

City Odyssey provides written walking directions but does not provide live GPS tracking.

3. How we collect information

We collect information:

Through contact, enquiry and other forms provided on our Wix website or through the City Odyssey app.
Directly from you when you create an account, select an avatar, change a preference or submit a form.
Automatically when you use the app or website, where permitted.
From Google or Apple when you use their sign-in services.
From Apple, Google and RevenueCat in connection with purchases and entitlements.
From technical providers when they report app performance, errors or security events.
Through cookies and similar technologies used on our Wix website.

4. Why we use your information and our lawful bases

We use personal information only where we have a lawful basis for doing so. The basis depends on the information involved and why we need to use it.

To provide City Odyssey and perform our contract with you

We use account, purchase, entitlement, progress and preference information where necessary to:

Create and authenticate your account.
Record your age confirmation, acceptance of the Terms of Use and the version of the legal information presented to you.
Provide access to purchased adventures.
Save and synchronise your story progress.
Restore purchases and entitlements.
Remember your app settings.
Provide service and account communications.
Respond to requests concerning your account, purchases or use of the service.

This processing is necessary to perform our contract with you or to take steps at your request before entering into that contract.

Some account and purchase information is required to provide City Odyssey. If you do not provide it, you may be unable to create an account, access purchased adventures, restore purchases or save your progress. Display names, avatars and optional preferences are not required unless the app tells you otherwise.

Our legitimate interests

We may use account, technical, diagnostic, support and transaction information where necessary for our legitimate interests in operating, protecting and improving City Odyssey. These interests include:

Providing customer support.
Investigating and resolving technical problems.
Protecting City Odyssey, its users and its systems.
Detecting and preventing fraud, misuse and security incidents.
Identifying crashes, diagnosing technical faults and measuring app performance using Firebase Crashlytics and Firebase Performance Monitoring, so that we can maintain and improve the reliability of City Odyssey.
Improving accessibility, features, stories and user experience.
Establishing, exercising or defending legal claims.

When we rely on legitimate interests, we consider whether the processing is necessary and balance our interests against your rights and interests. We give particular weight to the rights and interests of children.

Consent

We rely on your consent for:

Marketing emails that you have agreed to receive.
Story-reminder notifications that you choose to enable.
Promotional push notifications, if separately offered and enabled.
Non-essential website cookies and similar technologies where consent is required.
Wix Analytics, which helps us understand visits to and use of the City Odyssey website.
Other optional processing presented to you at the relevant time.

Consent is optional and is not a condition of creating an account or purchasing an adventure. You may withdraw consent by switching off Story Reminders in the app, changing notification permissions through your device settings, unsubscribing from marketing emails, changing your website cookie preferences or contacting us. Withdrawal does not affect processing that was lawful before consent was withdrawn.

Legal obligations

We use or retain personal information where necessary to:

Comply with tax, accounting and consumer-protection requirements.
Respond to binding legal, court or regulatory requirements.
Meet applicable data-protection and security obligations.
Maintain business records required by law.

In these circumstances, the lawful basis is compliance with a legal obligation.

5. Analytics and diagnostics

City Odyssey uses Firebase Crashlytics and Firebase Performance Monitoring to identify crashes, diagnose technical faults, measure app performance and improve reliability. We process this information on the basis of our legitimate interests in maintaining a secure, reliable and effective service. We do not use it for targeted advertising.

6. Notifications and marketing

Service communications

We may send necessary messages concerning:

Your account.
Purchases and entitlements.
Security.
Material service changes.
Support requests.
Changes requiring your attention.

These are not promotional messages.

Optional notifications

If you enable Story Reminders, we may send notifications relating to your progress through an adventure. Story Reminders are off by default. When you enable or disable them, we record your current choice and when it was last updated. Enabling Story Reminders also requires notification permission through your device.

You can switch Story Reminders off through the app or change City Odyssey’s notification permission through your device settings.

Enabling Story Reminders does not subscribe you to marketing emails or promotional offers. If we introduce promotional push notifications, we will provide a separate choice where required.

Marketing email

We will send marketing emails only with your specific consent.

Marketing consent is optional and is not a condition of creating an account or making a purchase. Every marketing email will identify City Odyssey and provide a way to unsubscribe.

We may retain limited suppression information after you unsubscribe so that we can honour your request not to receive further marketing.

7. Website cookies and similar technologies

The City Odyssey website is built and hosted using Wix. Wix uses essential cookies and similar technologies required to operate, secure and maintain the website. These technologies may support security, fraud prevention, network management, consent management, session stability and core website functions. Because they are necessary for the website to operate, they cannot normally be disabled through our cookie controls.

The technologies used may change if we add new website features, integrations or third-party services. We will update this Privacy Notice and request consent before activating non-essential cookies where required.

Current information is available through the Privacy Settings link displayed on the website.

8. Who receives your information

We disclose personal information to organisations that help provide City Odyssey. The information disclosed depends on which features you use.

Our service providers include:

Google Cloud and Firebase, which provide authentication, database hosting, performance monitoring, diagnostics, crash reporting and push notifications.
RevenueCat, which receives purchase, transaction, account and entitlement identifiers to validate purchases and manage access to purchased adventures.
Wix, which hosts the City Odyssey website and provides forms, cookie-management, analytics, communication and other connected website services.

These providers process personal information on our behalf where they provide services under our instructions and appropriate contractual obligations.

Apple and Google Play separately process information when they provide app-store accounts, app distribution, payment and purchase services. They may act as independent controllers for those activities, and their use of information is governed by their own privacy notices and terms.

Google and Apple also process information when you choose to use their sign-in services. The information provided to City Odyssey depends on your sign-in choice and the settings of the relevant provider. If you use Google Sign-In, Google may provide Firebase Authentication with basic profile information associated with your Google account, including your email address, display name and profile-photo URL. FlutterFlow may also write this information into the City Odyssey Firestore user record automatically. City Odyssey does not display or otherwise use the Google profile photo.

We also use FlutterFlow as the development and administration platform used to build City Odyssey and manage information held in Firebase. Through the connected Firestore Content Manager, authorised City Odyssey administrators can view and manage relevant account, progress and support information. The information remains stored in Firebase.

We may also disclose information:

To professional advisers or contractors who are subject to appropriate confidentiality obligations.
Where required by law, court order or a competent authority.
To investigate fraud, security incidents or unlawful activity.
In connection with a future sale, restructuring or transfer of the business, subject to appropriate safeguards.

At present, support requests are accessed by Reka Fasi through authorised administrative systems. They are not publicly visible or available for other users to read.

We do not sell your personal information or share it for third-party targeted advertising.

9. International processing

Some providers operate internationally. Personal information may therefore be stored or processed outside the United Kingdom or European Economic Area, including in countries whose data-protection laws may differ.

When personal information is transferred outside the United Kingdom, we use a transfer mechanism recognised under UK data-protection law. Depending on the provider and destination, this may include:

A UK adequacy regulation, where the destination is recognised as providing adequate protection.
The UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses.
Another legally permitted mechanism where applicable.

Where European Economic Area data-protection law applies, transfers may rely on an adequacy decision, approved standard contractual clauses or another transfer mechanism permitted by that law.

The principal international arrangements relevant to City Odyssey are:

Google and Firebase: Firebase Authentication is processed in the United States, and services including Firebase Crashlytics, Performance Monitoring and Cloud Messaging may process information using Google’s global infrastructure. Where information is transferred outside the United Kingdom, Google’s applicable data-processing terms provide safeguards including adequacy arrangements where available and approved standard contractual clauses incorporating the UK International Data Transfer Addendum.
RevenueCat: RevenueCat processes and stores customer data using infrastructure in the United States. Transfers are covered by RevenueCat’s Data Processing Addendum, which incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum for transfers subject to UK data-protection law.
Wix: Information processed through the City Odyssey website is initially processed by Wix.com Ltd in Israel, which is recognised by the United Kingdom as providing adequate data protection. Wix may transfer information to its affiliated companies and service providers in other countries, including the United States, countries in the European Economic Area and other locations where it operates. Wix states that it uses intra-company safeguards, standard contractual clauses and additional protective measures where required.

You may contact info@gocityodyssey.com for further information about the safeguards used and, where available, to request a copy.

Primary Firestore database region: europe-west2 (London, United Kingdom)

10. Retention

We retain personal information only for as long as reasonably necessary for the purposes described above.

Our intended retention periods are:

Active account, profile, progress, preference and legal-acknowledgement information: while your account remains active.
Account deletion: In-app deletion removes your Firebase Authentication account and active Firestore user record when the deletion process completes. Deletion requests submitted by email are normally completed within 30 days after we receive and verify the request.
Support requests, website enquiries and technical reports: normally 12 months after resolution or our last substantive communication, unless a longer period is reasonably required for a dispute, legal obligation or ongoing relationship.
Improvement suggestions: normally 24 months, after which they may be deleted or anonymised.
Marketing-consent and suppression records: for as long as needed to demonstrate consent and honour opt-out requests.
Purchase, tax and accounting records: for the legally required period, which for a UK sole trader will commonly be at least five years after the relevant tax-return deadline.
Fraud, security, dispute and legal records: for as long as reasonably necessary to investigate the issue, protect the service or establish, exercise or defend legal claims.
Provider backups: until securely overwritten or deleted according to the relevant provider’s backup cycle.

We may retain anonymised information that can no longer identify you.

11. Account deletion

You can request deletion using the Delete Account feature in the app or by contacting info@gocityodyssey.com.

Deleting your account removes:

Your Firebase Authentication account.
Your active City Odyssey user record held in Firestore, including account details, the Google profile-photo URL where present, story progress, legal acknowledgements and preferences stored in that record.

Deletion may not immediately remove:

Records Apple, Google or payment providers must retain.
Purchase, tax or accounting records we are legally required to retain.
Information required for fraud prevention, disputes or legal claims.
Information held temporarily in secure backups.
Previously submitted support or improvement records that must be reviewed, deleted or anonymised separately.
Aggregated or anonymised analytics that no longer identifies you.

Deleting a City Odyssey account does not automatically delete your Apple, Google or other third-party account.

If you have purchased an adventure, deleting the City Odyssey account may affect our ability to associate or restore that entitlement. Store purchase rights remain subject to the applicable store’s rules.

12. Security

We use technical and organisational measures intended to protect personal information, including:

Authenticated accounts.
Database access rules restricting user-profile access.
Restricted access to support submissions.
Encryption provided by our service providers in transit and, for relevant Firebase services, at rest.
Administrative account security and multifactor authentication.
Limiting administrative access to people who require it.

No internet service can guarantee absolute security.

If you believe your account or information has been compromised, change your password where applicable and contact info@gocityodyssey.com immediately.

13. Children and family participation

City Odyssey accounts are available only to people aged 18 and over. We do not knowingly permit anyone under 18 to create or hold an account.

Young people aged 16–17 may participate in a City Odyssey adventure as part of a family or other group, provided they are accompanied and appropriately supervised by an adult account holder throughout the experience. Young participants must not create their own City Odyssey account, make purchases or provide their own personal information through the app. Account, purchase and progress information is associated with the adult account holder. If an adult contacts us about a young participant, we ask them not to provide the young person’s name or other personal information unless it is reasonably necessary.

We recognise that young people may see or interact with the app while participating with an adult. We therefore seek to:

Collect only the personal information needed to provide and protect the service.
Use privacy-protective settings by default.
Explain our use of personal information clearly.
Avoid using children’s information for targeted advertising.
Avoid encouraging young participants to provide personal information.

If we learn that a person under 18 has created an account, or that personal information about a child has been provided contrary to this section, we will investigate and take appropriate steps to delete or restrict that information.

City Odyssey adventures are not recommended for children under 16. Individual adventures may have a higher recommended age. Adult account holders should review the relevant content, accessibility and route information and decide whether an adventure is suitable for everyone in their group.

14. Your data-protection rights

Depending on applicable law and the circumstances, you may have rights to:

Be informed about how your information is used.
Request access to your personal information.
Correct inaccurate or incomplete information.
Request deletion.
Request restriction of processing.
Receive certain information in a portable format.
Withdraw consent at any time.
Complain to a data-protection regulator.
Your right to object

You have the right to object at any time to our use of your personal information for direct marketing. If you object, we will stop using your information for that purpose. You may also object where we use your personal information on the basis of our legitimate interests. We will consider your objection and stop the processing unless we have compelling legitimate grounds to continue or the processing is necessary to establish, exercise or defend legal claims. To object, contact info@gocityodyssey.com. You can also unsubscribe from marketing emails using the link in each email and disable optional push notifications through the app or your device settings.

Some rights are subject to legal conditions and exemptions. We may need to verify your identity before acting on a request. To exercise a right, contact info@gocityodyssey.com. We will respond within the period required by applicable law.

Complaints

Please contact us first so that we can try to resolve your concern. You may also complain to the UK Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/

If you are in Ireland or another EEA country, you may also have the right to complain to your local supervisory authority. Ireland’s Data Protection Commission can be found at: https://www.dataprotection.ie/

15. Automated decision-making

City Odyssey does not currently use personal information to make solely automated decisions that produce legal or similarly significant effects about you.

If this changes, this Privacy Notice will be updated and any protections required by law will be provided.

16. Third-party services and links

City Odyssey may contain links to third-party websites, venues or services. Their handling of personal information is governed by their own privacy notices. We are not responsible for the privacy practices of independent third parties.

17. Changes to this Privacy Notice

We may update this Privacy Notice to reflect changes to City Odyssey, our providers or applicable law.

The latest version will be published on this page. The effective date and version will be updated whenever the notice changes. Where a change is material, we will provide additional notice through the app, email or another appropriate method. We will request fresh consent where legally required.

18. Contact us

For privacy questions, requests or complaints, contact:

Email: info@gocityodyssey.com

Address: 3F1 Third floor, 3 Hill Street, Edinburgh EH2 3JP
Website: https://gocityodyssey.com