Explore with privacy in view.

Last updated: 4 October 2026
App: CityTrace
Publisher: MobiSprig Apps
Privacy contact: privacy@mobisprig.com

Who operates CityTrace

CityTrace is operated by MobiSprig Apps. Privacy questions and data requests can be sent to privacy@mobisprig.com.

Information CityTrace handles

• Account information: if you choose to sign in, CityTrace uses your email address and a Supabase Auth user ID for passwordless authentication, account sync, export and deletion. You may also choose a short travel display name; the app does not need to show your email address as your public-facing profile label.
• Saved and verified travel activity: saved places, verified-visit records, derived city progress and the state needed to synchronize those features across devices.
• Approximate location for discovery: Nearby, Guide outing planning and Live Trace planning use approximate foreground location only when you request those features. This planning location is processed on the device and is not intentionally retained as a server location history.
• Private Live Trace continuity: to resume an unfinished outing after an app restart, CityTrace may keep the selected place sequence, progress count, public place details, and normalized Trace-artwork coordinates on the device. The raw traveller origin coordinate and a continuous movement trail are not stored for this feature.
• Precise location for verified check-in: when you explicitly choose to verify that you are at a place, CityTrace requests a fresh precise foreground location sample and sends it to the trusted verification service. Raw check-in coordinates are evaluated and are not intentionally stored as durable location history. The service may retain the verification result, timestamp, reported accuracy, measured distance, verification method and integrity/risk metadata.
• Internal invitations: if you use in-app invitations, CityTrace creates an opaque CityTrace ID for your signed-in account and stores the sender and recipient account IDs, selected city and public place IDs, invitation status and timestamps. The invitation does not include either traveller's email address, GPS position or visit history.
• Place Pulse contributions: your worth-it response, selected tags and optional short note after a verified visit. CityTrace links a contribution to your account and verified visit internally. Notes are reviewed before publication; public responses do not show your account or visit identifiers.
• Place Pulse safety actions: if you report a published response, CityTrace stores the reported response and your selected reason, linked to your account so the report can be reviewed. If you hide a contributor, CityTrace stores a private link between your account and that contributor so their published responses are hidden for you. Other visitors do not see your reports or hide list.
• Guide activity: Guide accepts text you deliberately type into the app. Account-scoped command/action metadata is used for reliability and audit, while CityTrace does not intentionally retain your raw Guide text in the private Guide audit record. When the optional AI interpretation provider is enabled, the text you submit to Guide, the selected city, catalog place names/IDs and limited active-outing context are sent to OpenAI to interpret a whitelisted CityTrace command. Raw location coordinates, email address and account identifiers are not included in that AI request.

How information is used

Information is used only for CityTrace functionality, account management, syncing, user-requested invitations, verified physical-presence checks, Place Pulse moderation, fraud/security controls, support, and maintaining a reliable service. CityTrace does not use personal data for advertising and does not sell personal or sensitive information.

Service providers and external handoffs

• Supabase: hosts authentication, database, storage and server functions used by CityTrace.
• Transactional email provider: Resend processes the email address only as needed to deliver CityTrace sign-in codes and related account messages on behalf of MobiSprig Apps.
• Google Play / Play Integrity: when production integrity protection is enabled, Google Play processes app, license and device-integrity information to help protect high-value check-in requests from tampering and abuse.
• External Maps app: when you choose turn-by-turn directions, CityTrace hands the selected destination to the Maps app you open. That app then handles the request under its own policy.
• Editorial image hosts: controlled remote photography may be loaded from CityTrace storage or approved Wikimedia Commons hosts. Those hosts receive ordinary network request metadata needed to deliver the image.
• OpenAI: when AI Guide interpretation is enabled, OpenAI processes the Guide text and limited travel context needed to choose a safe, whitelisted app command. CityTrace requests non-persistent Responses API processing (store=false) and keeps physical check-in verification outside the model.

Security

CityTrace uses HTTPS for network traffic, a publishable client key rather than a privileged service-role credential, server-side authorization controls, row-level security for user-owned data, and server-owned verification for visits. The Android app does not request background location.

Retention and deletion

Account-linked data is retained while your account remains active and for as long as it is needed to provide the requested feature, subject to limited retention that may be required for security, fraud prevention, legal obligations or dispute resolution. CityTrace does not intentionally retain a continuous GPS trail or durable raw check-in coordinate history. Device-local Live Trace plans and private recap metadata can be cleared at any time from Me → Privacy & location, and are also cleared with the active account scope when the account is deleted. Account-linked internal invitation profiles and invitation records, Place Pulse contributions, reports and hidden-contributor choices are deleted with the account.

You can permanently delete your account and associated CityTrace data from Me → Your data → Delete account. Type DELETE and choose Permanently delete account to confirm. If you cannot access the app, use the external deletion resource at mobisprig.com/citytrace/delete-account/ or email privacy@mobisprig.com.

Your choices

You may use CityTrace as a guest for discovery. You control whether to sign in, save places, send or respond to an internal invitation, submit Place Pulse content, report a published response, hide a contributor, type a Guide request, grant approximate location for discovery, or grant precise location for a specific verified check-in. Android system settings can be used to change permissions at any time.

Data export

Signed-in users can export the server data associated with their CityTrace account as portable JSON from Me → Your data → Export my data. The export includes saved places, verified visits, your CityTrace invitation profile and sent/received invitation history, Place Pulse contributions and their review status, reports, hidden-contributor choices and account-linked Guide action metadata. It contains no retained raw check-in coordinate history.

Changes to this policy

If CityTrace materially changes its data practices, this policy will be updated before those new practices are relied on for production use. The effective date above identifies the current version.

Contact

MobiSprig Apps · privacy@mobisprig.com