Privacy policy for app

PRIVACY POLICY – “EscapeCity” Application

This privacy policy sets out the rules for the processing of personal data obtained through the website located at www.escapecity.pl (hereinafter referred to as the “Website”) in connection with the purchase of access codes for the game (hereinafter referred to as the “Game”) within the “EscapeCity” application (hereinafter referred to as the “Application”), as well as during the use of the Application.

We collect and store all personal data in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “GDPR”), and the Act of 18 July 2002 on providing services by electronic means.

Personal Data Controller

The administrator of your personal data is EscapeCity Spółka z ograniczoną odpowiedzialnością (Limited Liability Company), with its registered office in Kraków, ul. Kościuszki 74/13, 30-114 Kraków, KRS 0000357047, NIP 9442219177.

  • Contact details:
    • E-mail: hello@escapecity.pl
    • Phone: +48 789 315 401

Personal Data Collected

1. Purchasing an Access Code

Personal data of Website users is collected when they purchase Game access codes through the Website. In this situation, the following data is collected:

  • First name
  • Last name
  • E-mail address

2. Using the Game

Personal data of Application users is collected when they play the Game within the Application. In this situation, the following data is collected:

  • The player’s name or pseudonym provided by the user (with the reservation that fictitious data may be provided).
  • The user’s image captured in a photograph taken as part of completing a task in the Game (provided the user consents).
  • The user’s image or voice captured in a video recording made as part of completing a task in the Game (provided the user consents).
  • The user’s GPS location, for the purpose of displaying it on the map and completing subsequent tasks (the user’s location will not be shared or sent to the server).

Use of Data

Purchasing a Game Access Code

If a user purchases Game access codes on the Website, their personal data will be used to the extent necessary to perform the contract, including delivering the access code. The user provides their personal data voluntarily, but it is primarily necessary for:

  • Concluding, servicing, and executing the contract with the user (legal basis: Art. 6(1)(b) GDPR) – for the duration of the contract and settlements after its termination.
  • Fulfilling legal obligations incumbent upon the Controller (legal basis: Art. 6(1)(c) GDPR), including:
    • Issuing and storing sales documents – for the period during which regulations require us to retain tax documents.
    • Handling and resolving potential complaints – until the end of the warranty period for the goods’ conformity with the contract or the statutory warranty for the services provided.

Using the Game

If a user plays the Game in the Application, their personal data will be processed based on their consent (legal basis: Art. 6(1)(a) GDPR). Providing data is voluntary; however, providing a name or pseudonym is necessary to play the Game (this data may be fictitious). Withholding consent to take photos (processing image data) does not prevent the user from playing the Game, but it may prevent the use of certain functions (e.g., it will not be possible to complete a task requiring a photo). This data will be processed for the duration of the user’s gameplay and for a period of 6 months after its completion.

Note: The data referred to above in sections 1 and 2 will not be subject to profiling.

Application Usage & Analytics

While the user is utilizing the Application, their personal data related to behavior within the app may be processed via Google Analytics for Firebase statistical services.

The following data is collected in this manner:

  • Application events: e.g., opening, installation, first launch, screen views, interaction with notifications, in-app purchases.
  • Device information: device model, operating system, Application version, system language, screen resolution.
  • User data: e.g., demographic data (if available), interests (based on behavior), country/region, frequency of use.
  • User engagement: e.g., time spent in the Application, number of sessions, number of screens viewed, bounce rate.
  • Retention: daily and weekly active users, returning users, churn rate.

Data added independently by the user may also be collected, including custom events (e.g., completing a level, clicking a specific button in the Game) and user properties (e.g., subscription type, Game level).

Firebase does not collect names, e-mail addresses, or other directly identifying personal data. By default, the data is anonymous and aggregated.

Purpose and Legal Basis:

This data is collected to create statistics and internal analyses (e.g., user behavior analysis, audience segmentation, marketing campaign optimization, notification effectiveness analysis, BigQuery integration for advanced analytics) based on the user’s consent (legal basis: Art. 6(1)(a) GDPR). It is processed for the period the Controller uses the statistical or marketing services, but no longer than until the user withdraws their consent.

Note: The analytics data referred to above is subject to profiling.

Data Processor:

The entity processing the data is Google (within the European Union – Google Ireland Limited, address: Gordon House, Barrow Street, Dublin 4, Ireland) and partners cooperating with Google.

Opting Out:

The user can disable Google Analytics for Firebase only if the Application provides an appropriate toggle. If the Application does not provide an option to disable Analytics, the user can:

  • Withdraw consent for Google ad personalization – this limits, among other things, the collection of the advertising identifier (IDFA/GAID). Firebase supports disabling Advertising ID collection.
  • Restrict the Application’s permissions (e.g., disable internet access) → the Application will not send data.

Data Recipients

We may transfer the data of Website or Game users to other companies we cooperate with, namely: payment operators, hosting companies that store data for us on their servers, law firms, accounting firms, and providers/partners supplying services related to the Application or the Game, in particular Locatify ehf based in Borgarnes (Iceland). Locatify’s privacy policy is available at: https://locatify.com/privacy-policy-for-locatifys-treasure-hunt-apps/

The above processing may also result in data being transferred to recipients outside the European Union. We strive to ensure that such data transfers comply with the principles of the Data Privacy Framework (https://www.dataprivacyframework.gov/) or are based on the European Commission’s Standard Contractual Clauses (https://ec.europa.eu/commission/presscorner/detail/en/ip_21_2847).

User Rights

A Website or Game user whose data is being processed has the right to:

  • Access their personal data and receive a copy of it.
  • Rectify their personal data if it is incorrect, and to complete it if it is incomplete.
  • Erase their personal data completely (the right to be forgotten).
  • Restrict the processing of their data.
  • Object to the processing of their data for analytical and statistical purposes.
  • Withdraw consent for personal data processing at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.
  • Lodge a complaint with the President of the Personal Data Protection Office (ul. Stanisława Moniuszki 1A, 00-014 Warsaw) if they believe that the processing of their data violates the provisions of the GDPR or the Personal Data Protection Act.

Changes to the Privacy Policy

We reserve the right to make changes to this privacy policy, about which we will, of course, inform you. Please direct any additional questions regarding the privacy policy to the following e-mail address: hello@escapecity.pl

Website Privacy Policy

The rules for processing personal data obtained by the Website in areas not covered by this Privacy Policy, as well as information regarding cookies, can be found at: https://gramiejskakrakow.pl/polityka-prywatnosci/

Date of last modification: August 3, 2026