Privacy notice

Last updated: 20 September 2026.

1. Controller

The controller for the processing of personal data in connection with Citily is:

Citily GbR

Im Sonnenland 14
65760 Eschborn
Germany

Represented by:

Mahir Akin Capillo
Sabit Kale

E-mail: support@citily.de

Phone: +49 152 34740868

For questions about data protection and for exercising your data protection rights, you can contact us in particular by e-mail at support@citily.de.

The competent data protection supervisory authority is in particular:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI)

Wilhelmstraße 7
65185 Wiesbaden
Germany

2. Scope

This privacy notice explains how personal data is processed when Citily is used.

It applies in particular to:

• the Citily app for mobile devices,
• the citily.de website,
• the backend, hosting and infrastructure services used to provide Citily.

This privacy notice describes the functions and processing operations actually used in live operation.

If additional functions are introduced later that require further processing of personal data, this privacy notice will be adapted accordingly.

A. Use of the Citily app

3. User account and sign-in

Certain functions of Citily require a user account.

In doing so, we process in particular:

• your e-mail address,
• your user name or display name, in so far as one is provided,
• internal user and profile identifiers,
• authentication and session information,
• identifiers of the devices on which you are currently playing content, together with the time of their most recent status report, in order to limit the number of simultaneous playbacks,
• technical information about account-related operations.

The processing serves in particular to create, administer and secure your user account and to provide account-related functions.

Passwords are not stored in plain text.

Authentication runs through backend components operated by Citily itself on our server infrastructure.

If you sign in with a Google or Apple account, we receive your e-mail address from that provider and, where transmitted, your name.

Authentication and session information may be stored on your device so that you can stay signed in. Security-relevant session information is protected, as far as this is technically possible, by the security mechanisms of the operating system provided for that purpose.

Legal basis: Art. 6(1)(b) GDPR.

Providing the data marked as required for registration is necessary in order to create and use a user account. Without this data, the corresponding account-related functions cannot be provided.

Use without your legal name

As a rule, using Citily does not require you to give your legal name.

Where a display name can be used, you may also choose a name for it that does not allow any direct conclusion to be drawn about your identity.

For account-related functions we need a valid e-mail address. Citily does not require it to contain your legal name.

Towards Citily, purchases are as a rule attributed by means of technical store and transaction identifiers. In this process, Citily does not receive complete credit card or bank details.

4. Location data

At your request, Citily uses your device's location in order to provide location-based functions.

These include in particular:

• showing your current position on the map,
• calculating and showing your distance to sights and other locations,
• location-based functions while you use audio guides,
• automatically triggering certain content during location-dependent playback that is running.

For certain functions, location access may also be necessary while the app is not actively displayed in the foreground. This concerns in particular a location-dependent guide function that you have started.

Local processing of your GPS position

Your GPS position is processed within the Citily app on your device.

Citily does not transmit your current GPS position to its own servers.

To show you places nearby, the app requests the content for the map section currently displayed. What is transmitted are the corner points of that section, not your position. If the map is centred on your location, approximate spatial information may indirectly follow from it.

Citily does not create server-side movement profiles and does not store a permanent history of your location movements.

Before accessing your location for the first time, Citily informs you about the intended use. The corresponding location permission is then requested through your device's operating system.

Legal basis: Art. 6(1)(a) GDPR.

You can withdraw your consent at any time with effect for the future, in particular by revoking Citily's location permission in your device settings.

After a withdrawal, certain location-dependent functions may be unavailable or available only to a limited extent.

5. Opening external map and navigation services

Citily allows you to open a location shown in the app in a map or navigation application installed on your device.

The map application set as the default on your device may be used for this, for example:

• Apple Maps,
• Google Maps,
• or another map or navigation application that you have installed or selected.

When you use this function, Citily passes the information required for the selected destination, in particular the coordinates of the destination, to the external map application.

In doing so, Citily does not transmit your current GPS position to the external map service.

Once the external map application has been opened, all further processing is carried out by the respective provider under its own data protection responsibility.

That provider may in particular process technical connection information as well as – depending on your settings, permissions and use of the respective map application – your current position and other information available there.

That processing is governed by the data protection terms of the respective map or navigation provider.

When you trigger the function, it is made recognisable to you that an external map or navigation application is being opened.

6. Favourites

When you save locations as favourites, the information required for this is linked to your Citily user account.

This includes in particular:

• the internal identifier of the saved location,
• the link to your user account.

The processing serves to make your favourites permanently available within your account.

Legal basis: Art. 6(1)(b) GDPR.

Favourites are stored until you remove the respective favourite or your user account is permanently deleted.

7. Playback progress and local settings

Certain information is stored exclusively locally on your device.

This may include in particular:

• playback progress,
• language settings,
• sorting settings,
• notices already shown,
• local operating and display settings,
• content that you have expressly downloaded for offline use, such as audio files, images and map sections.

Under the current technical setup, playback progress is not synchronised with our servers.

Local data may remain on your device until it is deleted by the app, until a corresponding reset, until the respective function is deactivated or until the app is uninstalled.

Where local storage is strictly necessary for a function you have expressly requested, it takes place in accordance with Section 25(2) no. 2 TDDDG.

Where local storage does not fall under a statutory exception and consent is required for it, it takes place only after the corresponding consent has been given.

B. Purchases and paid content

8. In-app purchases

Paid content and, where applicable, subscriptions within the Citily app are handled through the respective app store.

These are in particular:

• Google Play on Android devices,
• the Apple App Store on iOS devices.

Citily itself does not process complete credit card numbers or bank account details.

The actual payment processing is carried out by the respective store provider.

We do, however, receive and process information that is necessary in order to recognise a purchase, attribute it to the correct Citily account and provide the content acquired.

This may include in particular:

• the product or content acquired,
• purchase status,
• time of the purchase,
• store and transaction references,
• internal purchase identifiers,
• information about refunds,
• information about existing, expired or revoked entitlements.

For the technical attribution of a purchase, pseudonymous Citily identifiers may be transmitted to the respective store.

With Apple, an account token may be used for this in particular. With Google, corresponding pseudonymous account or purchase identifiers may be used.

The source of this information is the app store used for your purchase, or the store interface provided by it.

Legal basis: Art. 6(1)(b) GDPR.

Where certain information has to be retained on the basis of tax or commercial law provisions, the further processing takes place on the basis of Art. 6(1)(c) GDPR.

Technical note on a stalled unlock

If a paid purchase is not unlocked within the intended time, Citily stores a technical note about it on its own server. That note consists of the type of event, the type of product, the time and the link to your user account.

Its sole purpose is to detect unlocks that have got stuck and to be able to provide you with the access you paid for. The note contains no location data, no free text entries and no advertising identifiers; it is not evaluated in order to analyse your usage behaviour.

When your user account is permanently deleted, the link between the note and your account is removed.

Legal basis: Art. 6(1)(b) GDPR.

9. Apple and Google

Apple and Google process personal data in connection with the respective app store, the store account and payment processing as a rule under their own data protection responsibility.

For users in the European Economic Area, the companies of the respective European corporate groups are particularly relevant here, including in particular Google Ireland Limited, Ireland, and Apple Distribution International Ltd., Ireland.

This processing may concern in particular:

• payment processing,
• the store account,
• purchase history,
• subscriptions,
• refunds,
• fraud and security checks,
• technical store functions.

Citily receives only the information that is provided through the respective store interface and that is necessary in order to provide and administer the Citily services acquired.

Processing beyond that is governed by the data protection terms of the respective store provider.

During the purchase, the system's own purchase interface makes it recognisable that the further payment processing is carried out by Apple or Google.

C. E-mails and communication

10. Transactional e-mails

Citily uses e-mails in particular for:

• registration and account confirmations,
• password resets,
• changes to the e-mail address,
• security-relevant notifications,
• information in connection with an account deletion,
• other messages directly related to your user account.

For sending them we use a provider of transactional e-mail delivery established in the European Union.

The following are processed in particular:

• your e-mail address,
• information about dispatch and delivery,
• information about delivery errors,
• technical information about the dispatch.

The service provider processes this data on behalf of Citily.

Redirection of links and reach measurement

If an e-mail contains a link, the service provider rewrites it, for technical reasons, to a domain of its own. A click therefore first passes through one of its servers and is forwarded from there to the actual destination address. For transactional e-mails, this rewriting cannot be switched off in the service used.

At Citily, the measurement is set to anonymous. Opens and clicks are therefore not attributed to individual recipients.

Citily does not evaluate opens and clicks. In particular, they are not used to analyse the behaviour of individual recipients, to build usage or marketing profiles, or to measure individual engagement.

Retention at the service provider

The retention period for transactional logs is limited to the period necessary as proof of dispatch.

E-mail previews containing the full content of transactional e-mails sent are not stored for Citily.

Legal basis: Art. 6(1)(b) GDPR, in so far as the message is necessary for the performance and administration of your user account or of a Citily service you use.

For security-related notifications, the processing may additionally be based on Art. 6(1)(f) GDPR. Our legitimate interest lies in securing our user accounts and technical systems.

11. Your messages to us

When you write to us, we process your e-mail address, the content of your message and the technical transmission information in order to deal with your request.

Legal basis: Art. 6(1)(b) GDPR in so far as your enquiry concerns your user account or a service you use, otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in answering enquiries addressed to us.

We keep your message for as long as this is necessary in order to deal with your request and for possible follow-up questions, and delete it afterwards, in so far as no statutory retention obligation exists.

How to reach us and when you can expect an answer is set out on the Contact page.

D. Maps and media files

12. Map data

The map shown in Citily is not provided through Google Maps or Mapbox as a map platform.

Citily uses map data provided by itself, based among other things on OpenStreetMap-based data and Protomaps technologies.

Map files are delivered through our infrastructure and in part through content-delivery services.

When a map section is retrieved, the service provider may technically process in particular the following information:

• your IP address,
• the map section or the file requested,
• the time of the retrieval,
• technical connection information.

The map section requested may indirectly yield approximate spatial information.

In doing so, Citily does not transmit your current GPS position to the service provider.

Legal basis: Art. 6(1)(b) GDPR, in so far as the processing is necessary in order to provide the map function you have called up.

13. Audio, image and other media files

Audio, image and other media files may be delivered through content-delivery infrastructure.

The following may be processed in particular:

• your IP address,
• the media file requested,
• the time of the retrieval,
• technical connection information.

For protected or paid content, Citily may use technical access tokens that are limited in time.

These tokens serve to check entitlement and, given the technical setup, contain no directly readable names or e-mail addresses.

Legal basis: Art. 6(1)(b) GDPR.

E. Error diagnostics and security

14. Error diagnostics

Citily processes technical information about errors and crashes in the app in order to detect and fix them. A service provider for error diagnostics is used for this purpose.

Only technical data is transmitted. This may include in particular:

• the type of technical error,
• a scrubbed error message,
• technical stack information,
• the area of the app affected,
• app version,
• operating system and platform,
• build information.

Within the error diagnostics, the following data in particular is not transmitted:

• names,
• e-mail addresses,
• Citily user identifiers,
• GPS coordinates,
• movement histories.

Session replay and comparable functions for recording complete usage sessions are not used.

A European data region of the service provider is used for Citily. When the connection is technically established, the service provider necessarily receives the IP address of your device.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in detecting and fixing errors and crashes in the app and in safeguarding the stability of the service.

You can object to this processing at any time with effect for the future, in the app.

F. Technical log data

15. Server logs

Access to our backend systems generates technically necessary connection and security data.

This may include in particular:

• IP address,
• the API path called,
• the time of the request,
• HTTP status information,
• technical information about the connection.

The processing serves in particular to

• provide our systems securely,
• detect technical errors,
• ward off attacks and misuse,
• ensure the availability and stability of our services.

Server-side request logs in live operation are stored only for as long as is necessary for the purposes named, and deleted afterwards.

If longer storage is necessary in an individual case because of a specific security incident, the data concerned is kept only for as long as this is necessary in order to investigate and counter the incident.

Legal basis: Art. 6(1)(f) GDPR.

Our legitimate interest lies in the secure and stable operation of our services, protected against misuse.

G. The citily.de website

16. Visiting our website

When you visit our website citily.de, your IP address has to be processed technically so that the website can be transmitted to your device.

The following technical information may be processed in particular:

• IP address,
• date and time of the retrieval,
• the file or page requested,
• browser and operating system information,
• HTTP status information.

Under the current technical setup, Citily does not provide for any permanent storage of personal website access logs for analytics or marketing purposes.

Legal basis: Art. 6(1)(f) GDPR.

Our legitimate interest lies in providing our website securely and without technical faults.

17. Cookies and similar technologies

As things currently stand, no analytics, marketing or advertising cookies are used on the public website citily.de.

Likewise, we use no tracking pixels there for advertising purposes or for personal user analytics.

In so far as technically necessary information is stored on or read from your device, this takes place on the basis of Section 25(2) no. 2 TDDDG, provided that it is strictly necessary in order to provide the digital service you have expressly requested.

If tracking or storage technologies that are not technically necessary are introduced in future, consent will be obtained before they are used, in so far as this is required by law.

H. Hosting and service providers

18. Categories of recipients

To operate the service, Citily engages service providers that process personal data exclusively on our behalf and on our instructions. A data processing agreement is in place with each of them.

The following categories in particular are used:

• Server infrastructure and hosting (Germany) — user accounts, authentication data, profile data, purchase and entitlement information, favourites, and technical operating and security data,
• Network, DNS, content-delivery and object-storage services — IP address, the resource requested, the time of the retrieval and technical connection information, in particular when delivering map and media data,
• Transactional e-mail delivery — e-mail address, dispatch and delivery information (section 10),
• Domain and e-mail services for the mail addressed to us — sender address, content and technical transmission information,
• Error diagnostics — the technical error data described in section 14.

Your data is not passed on to third parties for their own purposes. This does not affect the store providers, which handle purchases on their own responsibility (section 9), or statutory disclosure obligations.

On request, we will tell you which service providers are used for a specific processing operation: support@citily.de.

I. International data transfers

19. Processing outside the European Economic Area

Some of the service providers used by Citily are based outside the European Economic Area or have an internationally distributed technical infrastructure.

This concerns in particular providers of network, content-delivery and error-diagnostics services, as well as, where applicable, international processing by the store providers in connection with their store services.

In so far as Citily transfers personal data to recipients in countries outside the European Economic Area, this takes place only in compliance with Art. 44 et seq. GDPR.

For transfers to the USA, the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework may in particular be used, in so far as the respective recipient is certified accordingly.

In addition or as an alternative, the standard contractual clauses approved by the European Commission pursuant to Art. 46(2)(c) GDPR and, where applicable, additional protective measures may be used.

You can request information about the safeguards used for a specific transfer, and about how you can obtain a copy of those safeguards, at support@citily.de.

J. Retention periods and account deletion

20. General principles

Personal data is stored only for as long as this is necessary for the respective processing purpose or as long as statutory retention obligations exist.

Once the respective purpose no longer applies, the data is deleted, provided that no statutory obligation and no other permissible legal basis for further storage exists.

21. Deletion of a user account

You can request the deletion of your user account through the function provided for this in Citily. How this works in detail is also set out on the Delete account page.

Before you confirm, you are informed that your account will be deactivated immediately and permanently deleted after 30 days.

After you have confirmed the deletion request, your account is deactivated immediately and scheduled for permanent deletion. Permanent deletion takes place automatically after 30 days.

During this restoration period you can cancel the deletion and restore your user account.

Restoration does not take place merely because a sign-in is attempted.

If you sign in during the restoration period, you are informed that your account is scheduled for deletion. Restoration takes place only after your express confirmation.

Once the 30 days have expired, the user account is automatically deleted permanently, in so far as no statutory retention obligations and no other legally permissible grounds prevent the deletion of individual data.

As part of the permanent account deletion, the following are in particular deleted or permanently separated from the user account:

• profile information,
• favourites,
• active sessions,
• authentication information,
• account-related entitlements, in so far as their further storage is not necessary.

We store a technical record of the deletion being carried out. It contains no names and no e-mail addresses, but only internal identifiers and counts, and serves solely as evidence that the deletion was executed. It is removed once it is no longer needed for that evidence.

Information that has to be retained by law is separated from the actively used account data and processed further exclusively for the respective statutory purpose.

Deletion without a restoration period

If you want permanent deletion without the 30-day restoration period, you can contact us at any time at support@citily.de.

Statutory erasure requests, in particular pursuant to Art. 17 GDPR, are dealt with without undue delay in accordance with the statutory requirements.

The restoration period does not limit your statutory data protection rights.

22. Tax and business records

Certain purchase, accounting, payment or tax records may continue to be stored even after your user account has been deleted, on the basis of statutory retention obligations.

The duration follows the retention obligations under commercial and tax law that apply to the record concerned. As a rule, the respective period begins at the end of the calendar year in which the record concerned was created or the relevant transaction was completed.

Where possible, the link between such records and an active Citily user account is removed or restricted after that account has been deleted.

Certain store or transaction references may remain part of records required by law.

Legal basis: Art. 6(1)(c) GDPR.

23. Further retention periods

The following retention periods apply in particular to certain technical data:

K. Your data protection rights

24. Rights of data subjects

Subject to the statutory requirements, you have in particular the right

• to request access to the data processed about you pursuant to Art. 15 GDPR,
• to request the rectification of inaccurate personal data pursuant to Art. 16 GDPR,
• to request the erasure of personal data pursuant to Art. 17 GDPR,
• to request the restriction of processing pursuant to Art. 18 GDPR,
• to receive personal data in a structured, commonly used and machine-readable format pursuant to Art. 20 GDPR,
• to object to processing pursuant to Art. 21 GDPR, in so far as it is based on Art. 6(1)(e) or (f) GDPR,
• to withdraw consent given, pursuant to Art. 7(3) GDPR, at any time with effect for the future.

The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the withdrawal.

There is no decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

To exercise your rights you can contact support@citily.de.

25. Right to lodge a complaint

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.

The authority competent for Citily is in particular:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI)

Wilhelmstraße 7
65185 Wiesbaden
Germany

As a rule, you can also contact another data protection supervisory authority that is competent under the statutory provisions.

L. Data on your device

26. Local storage and access to the device

Citily stores or processes certain information locally on your device.

This may include in particular:

• authentication and session information,
• an encrypted copy of your account profile — display name, e-mail address and internal identifiers — so that the app can show your name without a connection; it is removed when you sign out and when the account is deleted,
• a device identifier assigned separately for each user account, used to limit simultaneous playbacks,
• playback progress,
• language settings,
• local operating and display settings,
• content downloaded for offline use.

In so far as storage or access is strictly necessary in order to provide a digital service you have expressly requested or a function you have expressly selected, this takes place in accordance with Section 25(2) no. 2 TDDDG.

This concerns, for example, technically necessary session information.

In addition, the legal bases under the GDPR stated in each case in this privacy notice apply to personal data.

In so far as storage or access does not fall under a statutory exception and consent is required for it, the corresponding processing takes place only after consent has been given.

M. Minors

27. Use by minors

Citily is not specifically directed at children.

In so far as Citily processes personal data on the basis of consent and the offer is an information society service offered directly to a child, the special requirements of Art. 8 GDPR apply.

In Germany, under those conditions, the consent or authorisation of the holder of parental responsibility is as a rule required for persons under 16 years of age.

N. Changes to this privacy notice

28. Updates

We adapt this privacy notice when the functions offered by Citily, the technologies and service providers used, or the legal requirements change.

The version applicable at any given time is made available in Citily and on our website.

In so far as a change means that consent is required for a new processing operation, the processing concerned is only carried out after the necessary consent has been obtained.