<aside>

Table of Contents

</aside>

Effective Date: January 14, 2026

Last Updated: January 14, 2026

Welcome to CITRIS Quest (the “App”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the App. Please read this Privacy Policy carefully. By accessing or using the App, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the App.

1. Information We Collect

We collect information that you provide directly to us, information that is collected automatically when you use the App, and information processed by third-party services that support our functionality.

1.1 Account Information

When you create and use an account, we collect:

• Email address – Required for account creation, authentication, and account-related communication.
• Username – Display name shown to other users in the App (for example, in leaderboards and the community feed).
• Password – Stored securely using hashing through Supabase Auth. We do not store your raw password.
• User ID (UUID) – A unique internal identifier associated with your account.

1.2 Game Progress and Profile Data

To enable core gameplay and personalization, we collect and store:

• Experience Points (XP) – Game progression points earned through scans and activities.
• Bits – In-app currency earned through gameplay.
• Scan count – Total number of scans you have completed.
• Profile picture color – Hex color code used for your avatar.
• Equipped cosmetics – Items and achievements you choose to display on your profile.
• Owned cosmetics – Items you have unlocked or purchased.
• Rank – Your position on leaderboards.
• Achievement data – Achievement progress, completion status, timestamps, and bonus XP flags.
• Tag collection data – IDs of artworks/tags you have scanned and collection timestamps.

1.3 Location Data

CITRIS Quest uses location data to power game mechanics such as tagging your scans and showing nearby quest sites.

When you take a scan, we may collect:

• GPS coordinates (latitude/longitude) – Captured at the time of the scan.
• City name – Derived from your GPS coordinates via reverse-geocoding.
• Location timestamp – When the location was captured.
• Last known location – Used as a fallback (up to 2 minutes old) when precise location is temporarily unavailable.

Important:

• We collect location data only when you are actively using scanning features.
• We do not continuously track your location in the background.

1.4 Photos and Image Data

When you use the camera in the App:

• Captured photos – Images taken through the in-app camera for identifying artworks/tags.
• Image metadata, which may include:
  • Capture timestamp.
  • GPS coordinates (if available).
  • City name (if available).
  • Artwork/tag identification results.
  • File name (which may embed your user ID and timestamp).

Before upload, images may be cropped to a square format and compressed to reduce file size. Images are stored in cloud storage and associated with your user ID and scan records.

1.5 Scan Records

Each scan you perform may create a record containing:

• Username (publicly visible to other authenticated users).
• Capture timestamp.
• GPS coordinates and city name.
• Public image URL (for the scan photo stored in Supabase Storage).
• Artwork/tag name identified by the classifier.
• XP and Bits earned from the scan.
• Favorite status (if you mark a scan as a favorite).

These records power features like the community feed, tag collections, and leaderboards.

1.6 Feedback and Support Data (Optional)

If you choose to submit feedback or support requests, we may collect:

• Star rating (e.g., 1–5).
• Feedback type (e.g., bug, feature request).
• Feedback message (free-text).
• App version (e.g., “1.0.0+1”).
• Device information (operating system name and version).
• User email and username (if you are logged in when submitting feedback).

Feedback may be visible to others depending on how access controls are configured.

1.7 Device and Technical Information

When you use the App, we may automatically collect technical information such as:

• Operating system (iOS or Android).
• OS version.
• App version and build number.
• Onboarding completion status (whether you have completed onboarding, stored locally on your device).

This information helps us ensure compatibility, troubleshoot issues, and improve the App.

1.8 Offline Data

The App supports offline usage. When offline, we may store:

• Offline scans in a local SQLite database (including image paths, timestamps, location data, and city names).
• Images in the App’s documents directory.
• Onboarding and device-specific settings in local preferences (SharedPreferences or platform equivalent).

Offline data is synced to our servers when an internet connection is restored. XP/Bits are typically awarded once data is successfully synced.

2. Permissions We Request

To enable the App’s core features, we request the following permissions. You can manage these permissions in your device settings.

2.1 iOS Permissions

• Camera (NSCameraUsageDescription) – Used to scan quests and capture photos.
• Location – When In Use (NSLocationWhenInUseUsageDescription) – Used to tag your scans with location and show nearby quest sites while you are using the App.
• Location – Always (NSLocationAlwaysAndWhenInUseUsageDescription) – May be requested to improve tagging of scans and nearby quest sites even if the App is active in the background (we do not perform continuous background tracking; collection is tied to gameplay events).
• Notifications (PERMISSION_NOTIFICATIONS) – Used for sending push notifications, such as updates about quests, features, or account-related messages (may be partially or not yet fully implemented).
• Media Library (PERMISSION_MEDIA_LIBRARY) – Used to access photos saved on your device, for example to allow you to select images if this feature is available.

2.2 Android Permissions

• Camera (android.permission.CAMERA) – Required for scanning tags and capturing photos.
• Fine Location (android.permission.ACCESS_FINE_LOCATION) – Used to obtain precise GPS coordinates for scans and nearby quest sites.
• Coarse Location (android.permission.ACCESS_COARSE_LOCATION) – Used to obtain approximate location when fine location is unavailable.
• Notifications (android.permission.POST_NOTIFICATIONS) – Required on Android 13+ to deliver notifications about quests, events, and account-related updates.

If you choose not to grant certain permissions, some features (such as scanning or location-based functionality) may not work as intended.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and operate the App – To create and manage accounts, process scans, grant XP/Bits, and maintain game features such as quests, leaderboards, and achievements.
• Enable location-based gameplay – To associate scans with locations, validate interactions with specific tags/artworks, and display city-level information.
• Display community content – To power the community feed, leaderboards, and user profiles that are visible to other authenticated users.
• Improve and personalize the experience – To track progress, customize your profile and cosmetics, and enhance gameplay.
• Communicate with you – To send account-related communications, respond to support/feedback, and (if implemented) send optional push notifications.
• Ensure security and integrity – To authenticate users, enforce access controls, monitor for abuse or misuse, and protect our systems.
• Debug and development – To log technical issues and app behavior (via debug logging) in order to improve stability. We currently do not use third-party analytics services.

We may combine information collected across these categories to support these purposes.

4. Data Storage and Retention

4.1 Cloud Storage (Supabase)

We use Supabase as our backend infrastructure for database, authentication, and file storage.