Privacy policy

We consider your privacy very important and handle your personal data carefully and in line with the General Data Protection Regulation (GDPR). Where we process data based on your consent, we ask for it first. You can withdraw your consent at any time; processing before the withdrawal remains lawful.

Because you use our services or give them to us yourself:

• First and last name
• Company name and VAT number (if you ask for an invoice in a company name)
• Billing address and country
• E-mail address
• Phone number (optional), see "Your phone number"
• Payment details (handled by our payment provider; we do not see or store card details)
• IP address, browser and device type
• Information about your use of our website: cookieless signals from every visit, everything else only with your consent (see "Cookies")
• While you play: your progress, score and answers. Your location is used in the game to show where you are; we only store it while you choose to share it with our support team, and for at most 24 hours.
• Team photos you take in the game
• Your City Game account, see "Your City Game account"
• Your birthday (day and month only, never the year), if you give it in your account or when you sign up for our newsletter
• Your choices about our e-mails (newsletter, offers, new games in your cities, review requests) and, if you use one, the discount code
• Only if you choose to use it: the address of your digital wallet (see "Collectibles on the blockchain")
• Other personal data you give us in writing or by phone, including in our chat

Every booking comes with a free City Game account (app.citygame.com/account) for the e-mail address of the booking, also when you booked through a travel site or booking platform. You sign in with a link we e-mail you, or with Google or Apple; we never store a password.

In your account we keep your name and e-mail address, the games you booked and played, your team name, points, gold, badges, the items in your collection, your level, your city passport, your friend code and trades, your achievements, the status of your City Game Pass and, if you had them on our previous platform, your coins and collectibles from there.

Booked through a travel site? Those sites often give us an e-mail address of their own that stops working after a few days. We only replace it with your own e-mail address when you give it to us yourself (in the start e-mail or on the first screen of the game); then your rewards and photos move with it.

A phone number is optional. We only use it to reach you about a game you booked, never for advertising. When a booking comes with a phone number, your account suggests it; we only save it in your account when you confirm it.

• Processing your booking, sending your play link and invoice, and handling payments (performance of the contract)
• Keeping your City Game account: what you win in our games, your gold, levels, collection and passport, your photos, and the perks that come with them (performance of the contract)
• Contacting you by e-mail or phone when needed to provide our service (performance of the contract)
• Informing you about changes to our services (legitimate interest)
• Sending our newsletter with news and offers, only if you signed up and confirmed your address by clicking the link in our e-mail (consent). If you give your birthday, we send you a birthday greeting with a small gift.
• E-mails about new games in your cities and early access to new games, only if you switch them on in your account (consent)
• One reminder e-mail when you entered your e-mail address at checkout but did not finish the booking, with a link back to it (legitimate interest). We send it only once and only about that booking; you can object at hello@citygame.com.
• Sending customers offers for games similar to the one they booked (legitimate interest; art. 11.7 Dutch Telecommunications Act). You can say no when you book ("No offers, please"), in your account and in every e-mail.
• Asking players who booked and played for a review of the game (legitimate interest). Every request has a link to stop them.
• Applying and recording discount codes, including codes we give to partners (performance of the contract and legitimate interest)
• Protecting your account and our games against abuse and fraud (legitimate interest)
• Analysing how our website is used and measuring our ads and partner links: with cookies only with your consent (consent); before you choose, only cookieless measurement through Google Consent Mode (legitimate interest) — except reporting a booking through a partner link to Awin (legitimate interest, see "Partner links")
• Meeting legal obligations, such as our tax administration (legal obligation)

• Details of paying customers, bookings and invoices: 7 years (legal retention period for our administration)
• Your City Game account: as long as you have it. You can delete it at any time on your account page ("Delete my data"); we then delete your account data within 30 days, except what we must keep for our administration.
• Team photos: as long as the account they belong to
• Chat and e-mail conversations: as long as needed to help you, at most 2 years
• Newsletter and offers: until you unsubscribe. After that we keep only your e-mail address and the date you unsubscribed, so we never mail you again by mistake, and proof of your consent for as long as we may need to show it (at most 2 years).
• Your cookie choice: 12 months
• Analytics data with cookies (only with consent): 14 months
• Marketing cookies (only with consent): up to 12 months
• The Google ad click id with a booking (only with consent): up to 90 days after the click
• Entries on the blockchain: permanently (see "Collectibles on the blockchain")

We never sell personal data. We only share it when needed to carry out your booking, to run your account or to meet a legal obligation. Companies that process data on our behalf do so under a data processing agreement, with the same level of security and confidentiality. We remain responsible. These are:

• Google Cloud and Firebase (Google Ireland Ltd.) — hosting of our website and app, database, sign-in, and protection of your account against abuse (App Check with reCAPTCHA Enterprise)
• Google Workspace and Brevo (Sendinblue SAS, France, EU) — sending our e-mails
• Stripe — payments
• Bókun and the booking platforms you booked through — bookings
• Loquiz — the team login for games that are still played in the Loquiz app
• Anthropic — AI that translates texts and helps our chat and support answer you; for translations no personal data is needed
• Coinbase — only when you choose to create a smart wallet, see "Collectibles on the blockchain"

Some of these companies may process data outside the EU; we then rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

You never need a wallet to play. Only if you choose "Keep it forever" for a collectible or souvenir, we put it as a token in your own wallet on the Base blockchain: a smart wallet secured with a passkey (made through Coinbase), your own wallet, or a wallet address you paste. City Game pays the network fee.

What goes on the blockchain is public and cannot be removed by anyone, including us: your wallet address and the token (its picture, the game and the date). We never put your name or e-mail address on the blockchain; where a token refers to your account (such as the Traveller's Pass), it uses a coded reference that cannot be traced back to you. If you delete your account, tokens already in your wallet stay there, but we remove the link between your account and your wallet address.

Necessary (always on). Our website remembers a few settings in your browser so it works the way you chose: your currency, your cookie choice and, while you book a gift card, the gift details until you have paid. These stay on your own device and are not used to follow you. Payments are handled by Stripe on its own payment page, which uses its own necessary cookies to process your payment safely and prevent fraud. The chat button loads our own chat. When you sign in to your account on app.citygame.com, your browser remembers that you are signed in.

Analytics (cookies only with your consent). We use Google Analytics 4 to see how our website is used: which pages are visited, how visitors find us and whether a booking was completed (booking number, amount and currency — no name or e-mail address). Google Analytics loads on every page, but without cookies and with every consent setting off until you choose (Google Consent Mode). Until then Google only receives cookieless signals, such as your IP address and browser, to estimate visits and bookings; nothing is stored on your device and Google Analytics does not store your IP address. Only when you choose "Statistics" does Google Analytics set its cookies; only when you choose "Marketing" does Google use advertising signals (Google Ads).

Marketing (only with your consent).

• Meta pixel and Conversions API (Facebook, Instagram) — measures visits and bookings that come from our ads on Facebook and Instagram, so we can see which ads work and show relevant ads. When you book, we also send that booking from our own server to Meta (booking number, amount, your e-mail address in hashed form, IP address, browser and Meta's own cookie), so the measurement still works when a browser blocks the pixel.
• Google Ads — when you came through one of our Google ads, we keep the click id of that ad (up to 90 days) with your booking, to measure which ads lead to bookings.
• Awin — affiliate network: Awin's own tags measure which partner website sent you to us.

Partner links (Awin). When you come to us through a partner website, the link contains a reference of that click. We keep this reference in your browser and with your booking, only to tell our affiliate network Awin that this booking came through that partner, so the partner gets its commission. We then send Awin your booking number, the amount, any discount code and the games you booked — not your name, e-mail address or IP address — and whether you accepted marketing cookies. We do this also when you chose "Only necessary", based on our legitimate interest in paying our partners correctly. You can object at hello@citygame.com. Awin's own cookies and tags are only loaded with your consent for marketing.

Google, Meta and Awin may process data on servers outside the EU (Google LLC and Meta Platforms Inc. are certified under the EU–US Data Privacy Framework). You choose in the cookie bar: "Only necessary", "Choose" (analytics and/or marketing) or "Accept all". Nothing from Google, Meta or Awin is loaded before you choose. You can change your choice at any time with "Cookie settings" at the bottom of every page.

Every e-mail from us has an unsubscribe link and a link to your e-mail preferences. One click is enough. You can also switch each kind of e-mail on or off in your account, or e-mail hello@citygame.com.

You have the right to view, correct or delete your personal data, to withdraw consent, to object to processing and to receive your data in a file (data portability). Much of this you can do yourself on your account page. You can also send your request to hello@citygame.com. We answer within one month. To make sure the request is yours, we may ask you to confirm it from the e-mail address of your booking; we never ask for a copy of your passport.

If you are not satisfied with how we handle your data, please contact us first. You may also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We take appropriate technical and organisational measures to protect your data against misuse, loss and unauthorised access. If you think your data is not secure, contact us at hello@citygame.com.

Last updated: 9 October 2026.