Privacy Policy

Last updated: April 6, 2026

Summary: CityVibe is a city guide app. We collect only what's necessary to provide our service. We don't sell your data. You have full control over your information.

1. Who We Are

CityVibe is operated by Berat Yasa, based in the Netherlands ("we", "us", "our"). We are the data controller responsible for your personal data under the General Data Protection Regulation (GDPR) and the Dutch implementation act (Uitvoeringswet AVG, UAVG).

Contact:
Email: privacy@cityvibe.app
Country: The Netherlands

2. What Data We Collect

Data Category	Details	Purpose
Account Data	Email address, display name	Account creation, communication
Authentication Data	Apple ID token or email/password credentials	Secure sign-in
Location Data	Device location (only when you grant permission)	Show nearby places, distance calculations
User Content	Saved favorites, custom lists, preferences	Personalization, saving your selections
Subscription Data	Subscription status, plan type	Provide premium features
Usage Data	App interactions, screens viewed, crash reports	Improve app quality and performance
Device Data	Device type, OS version, app version, language	Technical compatibility, bug fixing

What We Do NOT Collect

We do not collect your precise location history or track your movements
We do not collect contacts, photos, or messages
We do not create advertising profiles
We do not use your data for targeted advertising

3. Legal Basis for Processing (GDPR Art. 6)

We process your personal data based on the following legal grounds:

Contract performance (Art. 6(1)(b)): Processing necessary to provide you with the CityVibe service, including account management, content delivery, and subscription services.
Consent (Art. 6(1)(a)): Location data is only processed with your explicit consent via the iOS permission prompt. You can withdraw consent at any time in your device settings.
Legitimate interest (Art. 6(1)(f)): Analytics and crash reporting to improve app stability and user experience. Our interest in maintaining a quality service is balanced against your privacy rights.

4. Third-Party Services

We use the following third-party services to operate CityVibe:

Google Firebase (Google LLC)

Firebase Authentication: Manages user sign-in securely
Cloud Firestore: Stores your account data, favorites, and lists
Firebase Analytics: Anonymous usage statistics
Firebase Crashlytics: Crash reports for bug fixing

Google processes data under the Firebase Data Processing Terms and is certified under the EU-US Data Privacy Framework.

Apple Inc.

Sign in with Apple: Authentication service
App Store / StoreKit: Subscription payment processing

Apple processes payment data directly. We do not receive or store your payment information (credit card, bank details). Apple's privacy practices are governed by their Privacy Policy.

Apple MapKit

Map display and search functionality
Apple does not associate map data with your Apple ID

5. International Data Transfers

Your data may be transferred to and processed in the United States by Google (Firebase) and Apple. These transfers are protected by:

EU-US Data Privacy Framework (DPF): Both Google and Apple are certified under the DPF, which provides an adequate level of protection as recognized by the European Commission.
Standard Contractual Clauses (SCCs): As a supplementary safeguard where applicable.

6. Data Retention

Account data: Retained until you delete your account
User content (favorites, lists): Retained until you delete them or delete your account
Analytics data: Automatically anonymized and aggregated after 14 months (Firebase default)
Crash reports: Retained for 90 days

When you delete your account, all personal data is permanently removed from our systems within 30 days. Anonymized, aggregated data may be retained for statistical purposes.

7. Your Rights (GDPR Art. 15-22)

As an EU/EEA resident, you have the following rights regarding your personal data:

Right of access (Art. 15): Request a copy of your personal data
Right to rectification (Art. 16): Correct inaccurate personal data
Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
Right to restriction (Art. 18): Request limitation of processing
Right to data portability (Art. 20): Receive your data in a machine-readable format
Right to object (Art. 21): Object to processing based on legitimate interest
Right to withdraw consent: Withdraw consent at any time (e.g., location permissions)

How to exercise your rights: You can manage most of these directly in the app (Profile > Data & Privacy). For other requests, contact us at privacy@cityvibe.app. We will respond within 30 days as required by GDPR.

Account Deletion

You can delete your account directly in the app under Profile > Data & Privacy > Delete Account. This permanently removes all your personal data including your account, saved favorites, and custom lists.

Data Export

You can export a copy of your data at any time through Profile > Data & Privacy > Export My Data.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

All data in transit is encrypted using TLS/SSL
Data at rest is encrypted in Firebase/Google Cloud infrastructure
Authentication tokens are securely managed by Firebase Authentication
Firestore security rules restrict data access to authorized users only
We do not store passwords in plain text (handled by Firebase Authentication with industry-standard hashing)

9. Children's Privacy

CityVibe is not intended for children. In accordance with Article 8 of the GDPR and the UAVG, we do not knowingly collect personal data from individuals under 16 years of age in the Netherlands, or under the applicable minimum age in other EU member states.

If you believe a child has provided us with personal data, please contact us at privacy@cityvibe.app and we will promptly delete the data.

10. Cookies and Tracking

CityVibe is a native iOS application and does not use cookies. We use Firebase Analytics for basic usage statistics which does not track you across other apps or websites. We do not use any advertising SDKs or tracking pixels.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you through the app or via email. The "Last updated" date at the top indicates the latest revision.

Continued use of CityVibe after changes constitutes acceptance of the updated policy. If you disagree with any changes, you may delete your account at any time.

12. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens
Website: autoriteitpersoonsgegevens.nl
Phone: +31 (0)70 888 8500

We encourage you to contact us first at privacy@cityvibe.app so we can try to resolve your concern directly.

13. Contact Us

For any questions about this Privacy Policy or our data practices:

Email: privacy@cityvibe.app