City-wars — Privacy Policy
Last updated: 16 September 2026
City-wars is a game you play by walking around a real map. That means it handles the most sensitive thing an app can handle: where you physically are. This policy says exactly what is collected, who sees it, and how long it is kept — in plain language, because a policy nobody can read protects nobody.
Who is responsible
City-wars is run by Disco Dancing Dog Ltd, contactable at freddie@discodancingdog.com. Under UK and EU data protection law that makes us the data controller for everything described here.
What is collected
Your location — the important one
While the app is open, it reads your device's GPS position and sends it to our game server. This is the core mechanic: control points are real places, and taking one means physically standing near it.
Only while the app is open. The app does not request background location and has no background location capability, so it cannot and does not track you when it is closed or in the background.
Other players never see where you actually are. Before your position is sent to anyone else, it is deliberately displaced:
- a fixed offset of 50 metres in a random direction, generated once for you and never changed, and
- a further random shift of up to 250 metres, different every time.
The offset is fixed on purpose. If it were re-randomised each time, anyone recording your displayed positions could average them together and recover your true position. Because the offset never moves, averaging can only ever converge on a decoy point about 50 metres away from you. We have measured this: after ten thousand samples, an observer is no closer to you than after a hundred.
Your exact position is used only by the game server, and only to decide game outcomes — whether you captured a control point, what your units can see, where a unit you send starts from.
Creating a game or using Quick match also records the position you asked from, with that game's lobby. It is used only to avoid matching the next player onto the same street, and is never shown to anyone. A game you create is named after the station nearest where you created it, and other players in that game see the name.
Your account
Signing in is handled by Auth0. We receive and store:
-
an account identifier from your sign-in provider (a
string like
google-oauth2|1144…), which is opaque and is what your game data is filed under, and - a call sign for each game you are in — a name like "Bold Vole", drawn for you by the game, which you can change. This is what other players see.
We do not request or store your email address, and the name your sign-in
provider has for you is never stored or shown: the app asks Auth0 only
for the openid profile scopes, and the only name anyone in
the game sees is your call sign.
Call signs you choose
If you change your call sign, other players see what you typed. Names are checked against a word filter, and any player can report a name they find offensive; a name reported by several players in the same game is replaced with a new one. Reports record which player reported which name, in which game, and are kept for us to review.
Notifications
If you turn notifications on, your device gives us a push token — an identifier for that installation, issued by Google (Firebase Cloud Messaging) or, on iPhone, by Apple. We store it so we can tell you when something happens in your game. It identifies a device, not you, and it changes if you reinstall.
Game state
Money, points, health, which units you own, which control points you hold, and your last known position so that reconnecting works before your first GPS fix arrives.
What is not collected
- No analytics. There is no analytics SDK in the app. Google Analytics was explicitly disabled when the Firebase project was created.
- No advertising, no ad identifiers, no tracking across other apps or websites.
- No email addresses.
- No contacts, photos, microphone, or camera. The app never asks for them.
- No selling or sharing of your data, with anyone, for anything.
Who your data reaches
| Who | What they get | Why |
|---|---|---|
| Our game server | everything above | running the game |
| Other players in your game | your masked position, call sign, colour, and what you own | it is a multiplayer game |
| Auth0 | your sign-in | authentication |
| Google (Firebase Cloud Messaging) | your push token and the text of notifications | delivering notifications |
| Apple (APNs) | the same, on iPhone | Apple delivers all iOS notifications |
| Cesium ion and OpenStreetMap | your device's IP address and the map area being displayed | drawing the map |
That last row is worth being clear about: to draw a map, the app has to ask a map server for the tiles covering where you are looking. Those services therefore see roughly what part of the world you are viewing. We do not send them your identity or your game data.
Our server runs on Hetzner infrastructure in Germany or Finland, and our Auth0 tenant is in the EU. Your data is stored in the EU.
How long it is kept
- Game state, including your last known position, is kept for as long as the game you are in is running. Games are long-lived — days or weeks — and the server saves its state regularly so a restart does not lose your progress.
- Push tokens are kept until they stop working. If you uninstall the app, Google or Apple tell us the token is dead and we delete it.
- Server logs record game events such as captures and units destroyed, along with account identifiers. They do not record your exact position.
A finished game is kept for a week so its players can look back at it, then moved to an archive.
Deleting your account
In the app: sign in, tap Join, then on the list of your games tap Account & contact → Delete my account → Delete — this can't be undone.
That removes you from every game on our server — your control points, units, position and progress — including finished and archived games. It deletes your push token, and your sign-in account at Auth0. The app then deletes what it kept on your phone about you (the maps you had explored) and signs you out. It cannot be undone.
What stays: other players' in-game event logs may still mention your call sign, until their game's server restarts. A call sign is not linked to you once your account is gone.
Without the app: write to freddie@discodancingdog.com from any address, saying which account (for example, which service you signed in with and roughly when you last played), and we will delete it within one month.
Your rights
You can ask us to show you what we hold about you, correct it, delete it, or give you a copy in a portable format. You can withdraw consent to notifications at any time by turning them off in your device settings, and to location by revoking the permission — the app will still run, but your avatar will not move, which is most of the game.
Write to freddie@discodancingdog.com and we will respond within one month. If you are unhappy with how we have handled it, you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
Children
City-wars is for adults only: you must be 18 or over to play. The app asks when it is first opened, and it is rated 18+ in the app stores. It uses where you really are and puts you in games with people you do not know, which is not something for children.
We do not knowingly collect data from anyone under 18. If you believe someone under 18 is playing, write to freddie@discodancingdog.com and we will delete their account.
Security
Traffic between the app and our server is encrypted (DTLS). Credentials that could be used to send notifications or read game data are stored on the server with restricted permissions and are never included in the app. The administrative interface that can read player data is disabled by default, bound to the server's own loopback interface, and requires a token.
No system is perfectly secure, and this is a game made by one person — but the sensitive parts have been treated as sensitive.
Changes
If this policy changes in a way that affects what is collected or who sees it, the date at the top changes and the change is described here. The current version is always the one at this address.