Privacy Policy
Last updated: 22 October 2026
1. Introduction
This privacy policy explains how personal data is handled when you use Citinerary, the city-trip planner for Android and iOS. Citinerary builds day-by-day walking plans from bundled city packs, shows city guides, keeps saved places and offers a one-time Pro purchase. In the app stores the app may appear under a longer listing name; this policy covers it under every name.
In short:
- Your trip choices, saved places, route progress and reminder settings are stored on your device and are not uploaded to our servers.
- The app creates a random anonymous identifier for your install; it is not tied to your name or email address.
- We collect usage analytics and crash diagnostics through Google (Firebase).
- The free version shows app-open, interstitial and rewarded video ads served by Google AdMob; Citinerary Pro removes them.
- In Türkiye, ads are always requested as non-personalised ads on Android and iOS.
- You can delete your data in the app under Settings > Your data > Delete my data.
When you first open the app, the welcome screen links this policy and our terms of use (https://citinerary.morrowline.app/en/terms/); tapping "Plan my trip" there means you accept them. Users in Türkiye also receive a separate information notice under Law no. 6698 (KVKK).
2. Who we are
The controller responsible for your personal data is Seyfi Can Zeyrek, an individual developer.
- Address: Esenyalı Mahallesi, 35140, Karabağlar/İzmir, Türkiye
- Email for privacy questions and requests: sczgamesinfo@gmail.com
We have not appointed a data protection officer; write to the email address above.
3. Scope
This policy applies to the Citinerary apps for Android and iOS, including onboarding, the trip planner, city guides, saved places, trip reminders, ads in the free version, the Pro purchase, and the "Your data" (Copy app ID, Delete my data), "Report an ad" and "Ad privacy" options in Settings.
It does not cover services run by others, even when you reach them from the app: map apps that open a walking route, websites of venues or transport operators, the App Store and Google Play, and features of your operating system. Their own privacy policies apply. Some screens in the app may give you a short extra notice at the moment data is used; those notices add to this policy.
4. Data we collect
Some data leaves your device: identifiers, usage analytics, crash reports, purchase status, advertising data and ad reports are processed by Google (Firebase), Google (AdMob) and RevenueCat to run the app, measure use, show ads and handle purchases.
Every request the app sends over the internet (signing in, loading destinations and guides, downloading city photos and packs, loading ads, checking a purchase) carries your device's IP address to the service that answers it.
You give us
| Data | What it includes | Why we use it | Who receives it |
|---|---|---|---|
| Advertising data: ad reports (optional) | When you tap Settings > Report an ad: the ad's response ID from AdMob, your anonymous identifier, the time of the report and the ad format (app-open, interstitial or rewarded) | To review ads you flag as inappropriate | Stored in our Cloud Firestore database, hosted by Google (Firebase) |
| Support and privacy requests (optional) | If you email us: your email address, your message, anything you attach and, if you paste it, the app ID you copied in Settings > Your data | To answer you and to find the records linked to your identifier | Our mailbox |
We collect automatically
| Data | What it includes | Why we use it | Who receives it |
|---|---|---|---|
| Account identifier (user ID) | The random anonymous identifier created by Firebase Authentication when you first open the app (the "app ID" you can copy in Settings > Your data); the same value is used as your RevenueCat customer ID and is attached to analytics and crash reports | To run the app, to keep your purchase status and to link diagnostics to one install | Google (Firebase), RevenueCat |
| Device identifiers and push token | Firebase installation ID and the Google Analytics app-instance ID; the Firebase Cloud Messaging push token (only if you allow notifications); the advertising identifier used by Google AdMob (Android advertising ID, or the iOS IDFA only if you allow tracking). Google Analytics in this app does not collect the Android advertising ID | To run the app, measure use, deliver notifications and show ads | Google (Firebase), Google (AdMob) |
| App usage and interactions (analytics) | App opens, sessions, screens and features used, the anonymous sign-in event, purchase events; for ads, app launches and taps on ads; your answers in Google's consent form | To understand how the app is used, keep it stable and record your ad choices | Google (Firebase), Google (AdMob) |
| Advertising data | Which ads were requested, shown, tapped or watched to the end, and the ad format | To show and measure ads in the free version | Google (AdMob) |
| Approximate location | A region or city derived from your IP address, never from GPS | To decide which consent rules apply, to select and measure ads, and for regional analytics | Google (AdMob), Google (Firebase) |
| Crash reports | Stack traces, device model, operating-system and app version, free memory and disk at the time of the crash, linked to your anonymous identifier | To find and fix crashes | Google (Firebase), Google (AdMob) for crashes inside its ad code |
| Performance diagnostics | Load times and error rates of the ad and consent components | To keep ads and the consent form working | Google (AdMob) |
| Other diagnostics | Firebase App Check attestation results (from Apple App Attest or DeviceCheck on iOS and Google Play Integrity on Android) and diagnostics of the Firebase components | To keep the service secure and prevent abuse | Google (Firebase) |
| Other data: message delivery data | Delivery statistics of the push service, not linked to you | To operate notifications | Google (Firebase) |
We receive from others
| Data | What it includes | Why we use it | Who receives it |
|---|---|---|---|
| Purchase and subscription status | Whether you own Citinerary Pro, the product, purchase date, price and currency, and store transaction IDs, received from Apple or Google when you buy or restore | To unlock Pro and restore it on another device | RevenueCat; Apple (App Store / StoreKit) or Google Play Billing |
Pro is unlocked by a store purchase that RevenueCat checks for the Apple ID or Google account that bought it. Payment details such as your card number are entered in the store's own payment sheet; we never receive them.
Stays on your device
- Your trip choices: destination, trip length, who you travel with and your interests, and the text you type to search for a city.
- Saved places, route progress, the map app you prefer and whether daily reminders are on.
- Scheduled trip reminders, built with your device's time zone.
- The version of the terms and privacy policy you accepted and the time you accepted them.
- The country of your App Store or Google Play account, read through the RevenueCat SDK, used to decide whether the rules for Türkiye apply (section 10).
- Your last analytics consent decision and the choice you made in Google's consent form.
- Counters that limit how often ads appear, and local copies of your anonymous identifier and push token.
These stay on your device until you use Delete my data, remove the app or clear its data. Delete my data keeps only your consent choices, so that the app does not ask again or apply a different setting.
What we do not collect
The app does not ask for location permission and does not read your device's GPS position. It does not access your contacts, photos, camera, microphone or health data, and it does not ask for your name, email address or phone number.
You do not have to give us any data that you type in; the optional items above are used only if you choose to send them. The anonymous identifier, purchase checks and diagnostics are needed for the app to run; without an internet connection the app can still show trip data that is already on your device.
5. How we collect data
- Directly from you: when you send an ad report or email us.
- Automatically: through the app and the components built into it (Firebase Authentication, Cloud Firestore, Cloud Storage, Google Analytics for Firebase, Crashlytics, App Check, Firebase Cloud Messaging, the Google Mobile Ads SDK with Google's consent form, and the RevenueCat SDK), and through the permissions you grant.
- From other sources: Apple and Google tell RevenueCat and us whether a purchase was made or restored and which country your store account belongs to; Apple and Google provide the attestation results used by App Check.
6. How we use data
We use data for these purposes:
- To provide the app: create the anonymous identifier, load destinations, city guides and city photos, and keep the app's content up to date.
- To process purchases: check and restore Citinerary Pro.
- To deliver reminders. When daily reminders are on, the app schedules one local reminder on the morning of each trip day; it does not send marketing notifications.
- To keep the app working: read crash reports and diagnostics and fix errors.
- To understand use: see which features are used, in aggregate, to improve the app.
- To show ads in the free version: select, show, limit and measure ads, and personalise them only as described in section 10.
- To apply the privacy rules of your region: show Google's consent form where it is required, send the matching consent signals, and keep ads non-personalised in Türkiye.
- To keep the service secure: confirm that requests come from a genuine copy of the app and prevent abuse.
- To handle reports and requests: review ad reports, carry out Delete my data, and answer emails and privacy requests.
- To comply with the law: keep records the law requires, including when you accepted our terms, and answer lawful requests from authorities.
We do not use your trip choices or saved places for advertising, and we do not make decisions about you with legal or similarly significant effects by automated means.
7. Legal bases
| Purpose | Data | Legal basis (GDPR and UK GDPR) | KVKK art. 5 (Türkiye) |
|---|---|---|---|
| Provide the app and its content | Account identifier, device identifiers, IP address | Contract: we need this to provide the service you asked for (art. 6(1)(b)) | 5/2-c: necessary for the performance of a contract |
| Process and restore purchases | Purchase status, account identifier | Contract (art. 6(1)(b)); keeping transaction records is a legal obligation (art. 6(1)(c)) | 5/2-c; 5/2-ç: legal obligation |
| Trip reminders | Reminder settings (on your device), push token | Contract (art. 6(1)(b)); notifications appear only after you allow them | 5/2-c |
| Security and abuse prevention | App Check results, diagnostics, IP address | Our legitimate interests in security and abuse prevention (art. 6(1)(f)); you can object | 5/2-f: legitimate interest |
| Stability and analytics | Crash reports, analytics, device identifiers (not the advertising identifier), approximate location | Our legitimate interests in keeping the app stable and understanding aggregate usage (art. 6(1)(f)); you can object. In the EEA, the UK and Switzerland, storing and reading analytics information on your device follows your choice in Google's consent form | 5/2-f; analytics in Türkiye is limited to measuring use of the app and is not linked to advertising |
| Personalised ads and ad measurement with the advertising identifier (not in Türkiye) | Advertising identifier, advertising data, approximate location | Your consent (art. 6(1)(a)), which you can withdraw at any time in Settings > Ad privacy or in your device's tracking or ads settings without affecting earlier processing | Not used: in Türkiye ads are not personalised |
| Non-personalised ads in the free version | Advertising data, approximate location, IP address | Our legitimate interests in funding the free version (art. 6(1)(f)); storing or reading information on your device for ads follows your choice in Google's consent form where that form is shown | 5/2-f |
| Applying the right consent rules | Approximate location, store-account country, your consent choices | Legal obligation (art. 6(1)(c)) | 5/2-ç |
| Recording that you accepted the terms | Accepted version and time (on your device) | Contract (art. 6(1)(b)) | 5/2-c |
| Ad reports, support and privacy requests, Delete my data | Ad report, account identifier, email and message | Our legitimate interests in ad quality and in answering you (art. 6(1)(f)); handling your rights requests is a legal obligation (art. 6(1)(c)) | 5/2-f; 5/2-ç |
The app sends Google's consent-mode signals to Google Analytics; until your choice is known, all of them are set to denied. They tell Google Analytics whether analytics storage, advertising storage, sending user data for advertising and ad personalisation are allowed. After Google's consent form has given a result, the app sets them as follows: in the EEA, the UK and Switzerland they follow the purposes you accepted in that form; elsewhere analytics storage is allowed on the basis of our legitimate interests, and the advertising signals follow your tracking choice on iOS; in Türkiye the three advertising signals are always denied. The app updates the signals each time you return to it, so a change in Settings > Ad privacy or in your device's tracking setting applies straight away. Crash reporting starts when the app opens and relies on our legitimate interests; you can object at any time by emailing us.
8. Device permissions
Notifications (Android notification permission, iOS notification authorisation)
Why we ask: To show daily trip reminders: one morning note on each day of your trip with your first stop and its time. The system prompt appears on the reminder step of onboarding or when you turn on Settings > Notifications > Daily reminders. What we do not do: We do not send marketing notifications, and the planner, guides and saved places work without notifications. Stored or sent: Reminders are scheduled and stored on your device. If you allow notifications, Firebase Cloud Messaging issues a push token that identifies your device to the push service; the app keeps it on your device and does not send it to our database. Delete my data deletes this token. How to turn it off: Switch off Settings > Notifications > Daily reminders in the app, or turn notifications off in your device settings (Android: Settings > Apps > Citinerary > Notifications; iOS: Settings > Citinerary > Notifications).
Tracking (iOS App Tracking Transparency)
Why we ask: To let Google AdMob use your device's advertising identifier (IDFA) to personalise and measure ads. The prompt is shown once, before the first ads load after onboarding, and only to users without Pro; in the EEA, the UK and Switzerland it is shown only if you first agreed to personalised ads in Google's consent form. What we do not do: Our own code never reads or stores the IDFA. Without your permission ads are requested as non-personalised ads, and in Türkiye they stay non-personalised even if you allow tracking. Stored or sent: If you allow tracking, the IDFA is available to the Google Mobile Ads SDK and is sent to Google with ad requests; Google Analytics can read it only where advertising storage is allowed, never in Türkiye. It is not stored on our servers. How to turn it off: Settings > Privacy & Security > Tracking on your iPhone or iPad.
The app does not request location, camera, microphone, photo library, contacts or health permissions.
9. Who receives data
Service providers
| Recipient | What it does for us | Data |
|---|---|---|
| Google (Firebase) | Anonymous sign-in (Firebase Authentication), our database for content and ad reports (Cloud Firestore), city photo and pack hosting (Cloud Storage), Google Analytics for Firebase, Crashlytics, App Check and Firebase Cloud Messaging | Account identifier, device identifiers, push token, analytics, approximate location, crash reports, diagnostics, ad reports, IP address |
| RevenueCat | Checks and restores the Citinerary Pro purchase and tells the app the country of your store account | Account identifier (as RevenueCat customer ID), purchase status, store country, IP address and device type |
Independent services
- Google (AdMob) serves and measures the ads in the free version and runs Google's consent form. Google receives the data listed under advertising in section 4 and uses it under its own privacy policy, including for personalised advertising where you consented or allowed tracking outside Türkiye.
- Apple (App Store / StoreKit) and Google Play Billing process payments and refunds for Citinerary Pro under their own terms and privacy policies. Apple and Google also provide the app attestation used by App Check and deliver notifications to your device.
- Your map app: when you open a day's walking route, the stops of that day are handed to the map app you choose on your device; what it does next is governed by its own policy.
Legal and corporate
We disclose data to authorities when the law requires it, to protect our rights or the safety of others, and to a successor if the app is transferred, in which case this policy continues to apply.
We do not exchange personal information for money. Advertising in the free version involves sharing advertising data with Google (AdMob); see sections 10 and 16.
10. Advertising and tracking
The free version shows app-open, interstitial and rewarded video ads served by Google AdMob; Citinerary Pro removes them. Ads appear at limited moments, such as when you open or return to the app and when you switch between tabs, and a rewarded ad can be watched to switch to another city. Each ad request carries your IP address, device and app information and, where allowed, the advertising identifier.
Where Google requires it, such as in the EEA, the UK and Switzerland, Google's consent form asks for your choice before ads are personalised; on iPhone and iPad, ads are personalised only if you allow tracking, and otherwise they are requested as non-personalised ads. Google's form appears when you first open the app, before onboarding and before any ad is requested. On iOS, personalised ads that use the advertising identifier are shown only if you allow tracking in the App Tracking Transparency prompt.
Outside Türkiye, if you allow tracking on iOS, or consent through Google's consent form, Google AdMob may use your device's advertising identifier together with data from other apps and websites to personalise and measure ads. This is "tracking" in Apple's sense.
Türkiye. In Türkiye, ads are always requested as non-personalised ads on Android and iOS. This applies whatever you answer in the iOS tracking prompt, and the app also tells Google Analytics that advertising storage, sending user data for advertising and ad personalisation are not allowed. The app does not ask for consent to personalised ads in Türkiye because it does not show them there. It treats you as a user in Türkiye when your App Store or Google Play account is registered in Türkiye; when the store country is not available yet, it uses the last store country seen on the device and then the region setting of your device. Non-personalised ads are still selected using the content of the app, your approximate location and the time, and Google can use device information to limit how often an ad is shown, to prevent fraud and to measure ads in aggregate.
Android elsewhere. On Android, where Google's consent form is not shown and you are not in Türkiye (for example in the United States), Google may personalise ads with your advertising ID. You can stop this at any time by deleting or resetting the advertising ID (Settings > Privacy > Ads, or Settings > Google > Ads, depending on the device). Google Analytics in this app does not collect the Android advertising ID.
Your choices:
- In the app: Settings > Ad privacy reopens Google's consent form where it applies to you.
- iOS: Settings > Privacy & Security > Tracking.
- Android: delete or reset your advertising ID in the device settings.
- Report an ad: Settings > Report an ad sends us the report described in section 4.
- Remove ads: buying Citinerary Pro stops all ads and the tracking prompt.
The app is not intended for children under 13 and does not request ads intended for them.
11. International transfers
We are based in Türkiye. Our providers process data outside Türkiye and outside the EEA, in the United States and in other countries where they operate: our Cloud Firestore database is located in the United States (multi-region nam5); Google (Firebase) and Google (AdMob) operate worldwide; RevenueCat processes data in the United States.
For data from the EEA, we rely on the European Commission's standard contractual clauses included in the providers' data processing terms as the safeguards for these transfers. For data from the UK, we rely on the UK addendum to those clauses. For data from Türkiye, transfers abroad are made under article 9 of Law no. 6698: there is no adequacy decision for the United States, so regular transfers needed to run the app do not rely on your explicit consent and are made under the appropriate safeguards that article 9 provides, such as the standard contracts published by the Personal Data Protection Board. You can ask us for information about the safeguards that apply at sczgamesinfo@gmail.com.
12. Retention
| Data | How long | What triggers deletion |
|---|---|---|
| Trip choices, saved places, route progress, preferences, accepted terms version | Stored only on your device | Delete my data; removing the app or clearing its data |
| Trip reminders | Until you turn off Settings > Notifications > Daily reminders or the trip days pass | Turning reminders off; Delete my data; removing the app |
| Account identifier (Firebase Authentication) | Until you delete it; we have set no automatic expiry | Delete my data; your email request |
| Ad reports | Until you delete them; we have set no automatic expiry | Delete my data; your email request |
| RevenueCat customer record | Until we delete it at your request, subject to the transaction records below | Your email request |
| Analytics events | For the period Google sets in the project's Google Analytics retention setting; we have not shortened it. Delete my data resets the analytics data on your device and starts a new app-instance ID | Expiry; your email request |
| Crash reports and diagnostics | For the period Google sets for Crashlytics and Firebase; we have not shortened it | Expiry |
| Advertising data held by Google (AdMob) | For the period Google sets under its own policies | Google's retention; your device's ad settings |
| Push token | Until it is deleted or replaced, and as Google keeps it for the push service | Delete my data; removing the app; turning notifications off |
| Purchase and subscription status | As long as the law requires for transaction records; Apple and Google keep store purchase records under their rules | Legal retention periods |
| Support emails and privacy requests | As long as needed to handle your request and any follow-up | End of the matter |
Deleted data can remain in encrypted backups and logs for a limited time until they are overwritten. Store purchase records stay with Apple or Google under their rules.
13. Account and data deletion
The app creates a random anonymous identifier for your install; it is not tied to your name or email address. You do not register, and there is no password.
You can delete your data in the app under Settings > Your data > Delete my data. After you confirm, the app needs an internet connection and does the following, in this order:
- It deletes every ad report linked to your anonymous identifier from our Cloud Firestore database.
- It deletes your anonymous identifier from Firebase Authentication.
- It removes the identifier from Google Analytics and Crashlytics on your device, resets the analytics data on your device (a new app-instance ID starts) and deletes the push token.
- It cancels your scheduled trip reminders and clears the app's data on your device: trip choices, saved places, route progress, preferences, the accepted terms version and the local copies of your identifier and push token. It keeps only your consent choices.
The app then starts again at the first onboarding screen. The next time it connects, Firebase gives it a new, unrelated anonymous identifier.
If you are offline, or if step 1 or 2 fails, the app tells you so and does not clear anything on your device, so you can try again; nothing that was already deleted comes back. Sometimes Firebase accepts deleting an identifier only after a recent sign-in, which an anonymous identifier cannot provide. In that case the app signs out and never uses that identifier again, and an empty record of it, with no data linked to it, can remain in Firebase Authentication until it is removed by a server-side cleanup or at your request.
What Delete my data does not remove: the RevenueCat customer record linked to your old identifier; analytics events and crash reports already sent to Google, which stay until they expire under the retention in section 12; advertising data that Google (AdMob) holds under its own policies; purchase records kept by Apple or Google and transaction records that RevenueCat or the stores must keep by law; and backups until they are overwritten.
Email route. You can also write to sczgamesinfo@gmail.com with the subject "Delete my data", for example if you no longer have the app or want the remaining records above deleted. Settings > Your data > Copy app ID copies your anonymous identifier; paste it into your email so that we can find your records. Without it, tell us the type of device and, if you reported an ad, the approximate date of the report. When we act on an email request we delete the identifier from Firebase Authentication, delete the ad reports and the RevenueCat customer record linked to it and ask Google to delete the analytics data linked to it. If we cannot link records to you with reasonable certainty, we tell you. We answer within one month (30 days for requests under KVKK).
Removing the app deletes the data stored on your device, but not the data held by our providers; use Delete my data before removing the app, or email us. Deleting your data does not refund or cancel Citinerary Pro: the purchase belongs to your store account and can be restored with Restore purchases.
14. Your rights and choices
Depending on where you live, you can:
- ask whether we hold data about you and get a copy;
- have incorrect data corrected;
- have data deleted, in the app or by email (section 13);
- restrict or object to processing that relies on our legitimate interests;
- withdraw consent at any time (section 10), without affecting earlier processing;
- complain to us and to a data protection authority.
Send requests to sczgamesinfo@gmail.com and include the app ID from Settings > Your data > Copy app ID if you can. We may ask for details to confirm that the data relates to you; we do not ask for more than we need. We answer within one month in the EEA and UK, within 45 days for US state requests and within 30 days under KVKK, and we tell you if we need longer as the law allows. Using your rights never changes the price or features you get. If we refuse a request, you can appeal by replying to our answer; we respond within the period the law sets. An authorised agent may act for you with proof of authority. If the data protection law where you live gives you other rights, such as access, correction, deletion or objection, we honour them; write to us and tell us where you live.
15. Additional information for the EEA and UK
Under the GDPR and, in the UK, the UK GDPR and the Data Protection Act 2018, you have the rights of access (art. 15), rectification (art. 16), erasure (art. 17), restriction (art. 18), data portability (art. 20) and objection (art. 21), where the law gives you these rights, and the right to withdraw consent at any time (art. 7(3)), for example through Settings > Ad privacy. You can object to processing based on legitimate interests; we then stop unless we have compelling grounds or need the data for legal claims. We do not send direct marketing.
You can complain to the data protection supervisory authority where you live or work, or where an alleged infringement took place. In the UK the authority is the Information Commissioner's Office. UK users can also complain to us first: we acknowledge a complaint within 30 days and investigate it without undue delay.
Providing data is not a legal requirement. The anonymous identifier and the purchase check are needed to provide the app and Pro; ad reports and emails are optional. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
16. Additional information for US residents
These rights apply to all US residents, including under the California Consumer Privacy Act as amended.
| Category (California) | What it includes | Source | Purpose | Disclosed to | Sold or shared |
|---|---|---|---|---|---|
| Identifiers | Anonymous identifier, device identifiers, push token, advertising identifier, IP address | Your device and the app | App operation, purchases, analytics, ads, security | Google (Firebase), RevenueCat, Google (AdMob) | Advertising identifier and IP address are shared with Google (AdMob) when ads are personalised |
| Commercial information | Purchase status of Citinerary Pro | Apple, Google, RevenueCat | Unlocking and restoring Pro | RevenueCat | No |
| Internet or other electronic network activity | Analytics, advertising data, ad reports, crash reports and diagnostics | Your device and the app | Analytics, ads, stability, security | Google (Firebase), Google (AdMob) | Advertising data is shared with Google (AdMob) when ads are personalised |
| Geolocation data | Approximate location from your IP address (not GPS) | Your IP address | Consent rules, ads, regional analytics | Google (AdMob), Google (Firebase) | Shared with Google (AdMob) when ads are personalised |
| Other personal information | Support emails | You | Answering you | Our mailbox | No |
We do not exchange personal information for money. When ads are personalised, giving Google (AdMob) your advertising identifier, approximate location and advertising data counts as "sharing" for cross-context behavioural advertising and may count as a "sale" under California law. To opt out of sale or sharing, use any of these: turn off tracking on iOS (Settings > Privacy & Security > Tracking); delete or reset your advertising ID on Android; use Settings > Ad privacy in the app where it is shown; or email sczgamesinfo@gmail.com with the subject "Do Not Sell or Share". The app cannot read browser-based opt-out preference signals, so please use one of these routes. We have no actual knowledge of selling or sharing the personal information of consumers under 16.
We do not collect sensitive personal information as defined by California law. Retention periods are listed in section 12.
You have the right to know, access, delete and correct personal information and to opt out of its sale or sharing, and we will not discriminate against you for using these rights. You can delete the data linked to your identifier in the app (Settings > Your data > Delete my data) and submit any request by email to sczgamesinfo@gmail.com; we verify requests by matching details you give us, such as the app ID, with the records we hold. Authorised agents may submit requests with your signed permission. If we decline a request, you can appeal by replying to our answer. We do not disclose personal information to third parties for their own direct marketing.
17. Additional information for Türkiye
For users in Türkiye, the controller under Law no. 6698 on the Protection of Personal Data (KVKK) is Seyfi Can Zeyrek. We are not required to register with the Data Controllers' Registry (VERBİS) under the exemption criteria set by the Personal Data Protection Board. A separate Turkish information notice under article 10 of the law explains the processing in detail. In Türkiye, ads are always non-personalised, Google Analytics receives no advertising signals and does not collect the advertising ID, and the app does not ask for explicit consent for advertising or analytics. Under article 11 you can learn whether your data is processed, ask for information, learn the purpose, know the recipients in Türkiye and abroad, ask for correction or deletion and for these to be notified to recipients, object to a result against you arising only from automated analysis, and claim compensation for unlawful processing. You can delete your data in the app (section 13) or send applications to sczgamesinfo@gmail.com; we answer within 30 days.
18. Children
Citinerary is for people aged 13 and over. We do not knowingly collect personal data from children under 13. If we learn that a child under 13 has used the app and that we hold data linked to that child's identifier, we delete it. Parents or guardians can use Delete my data on the child's device or write to sczgamesinfo@gmail.com. Users under the age of majority where they live should use the app with a parent's or guardian's permission.
19. Security
We protect data with the measures the app and our providers offer: all connections use encrypted transport (HTTPS); Firebase App Check confirms that requests come from a genuine copy of the app; our database rules let the app create ad reports, let only the identifier that sent a report find and delete it, never let anyone change a report, and deny access to any other user data; on iOS the anonymous sign-in is kept in the device keychain; and Google encrypts the data it stores for us at rest. No system is completely secure, so please keep your device locked and up to date. If a personal data breach occurs, we notify the authorities and affected people as the law requires.
20. Changes to this policy
We update this policy when the app or the law changes. The date at the top shows the latest version; the app stores this date on your device when you accept the policy on the welcome screen. For material changes, such as a new type of data, a new recipient or a new purpose, we show a notice in the app or on our website before the change applies, and we ask for your consent again where the processing relies on consent. Earlier versions are available on request.
21. Contact
Seyfi Can Zeyrek Esenyalı Mahallesi, 35140, Karabağlar/İzmir, Türkiye Email: sczgamesinfo@gmail.com
Trader contact for consumers in the EU: Seyfi Can Zeyrek, Esenyalı Mahallesi, 35140, Karabağlar/İzmir, Türkiye, sczgamesinfo@gmail.com. On Google Play the developer is listed as Morrowline Apps; on the App Store as Seyfi Can Zeyrek.
We aim to answer within five working days and always within the periods in section 14. You can also contact your local data protection authority. Users in Türkiye can apply under the KVKK as described in section 17 and in the Turkish information notice.
