Privacy

Privacy Notice: CityPower. Updated October 20, 2026.

This Privacy Notice for CityPower (“we,” “us,” or “our”), operated by CityPower Studio (the CityPower team, also called CityPower Team), describes how we collect, store, use, and share personal information when you use our services (“Services”), including when you:

• visit our website or any page that links to this Privacy Notice;
• open or play the CityPower Telegram Mini App / bot;
• use the CityPower mobile app, including the APK from our website or the Google Play version;
• contact support, make purchases through a supported platform, or use community features.

Telegram is optional for mobile registration with an email address and password. When you use CityPower through Telegram, Telegram’s Mini App Terms, Privacy Policy, and standard bot and mini app privacy policy also apply. We are not affiliated with Telegram Messenger Inc. This Notice is part of our Terms of Use.

Questions or concerns? CityPower Studio is responsible for decisions about data processing in CityPower. For privacy questions and account deletion without Telegram, email citypowerstudio@gmail.com. You can also contact Telegram support or use /developer_info in the bot.

1. What information do we collect?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect information you provide when you register, play, or contact support: email address, nickname, messages, files you send, and complaint or appeal text. Email registration requires a password; we store its hash rather than the plain-text password.

Authentication information. Login and session information is used to protect account access. We do not request your contacts, SMS, microphone, camera, IMEI, or advertising ID for the functions described here.

All personal information you provide must be true, complete, and accurate. Notify us of material changes when relevant.

Information from Telegram

In Short: When you open the Mini App, Telegram may share profile and technical data described in MA Terms §4.

• Telegram user ID;
• public name, @username, profile photo;
• client language (IETF language tag);
• Telegram Premium status;
• theme color parameters;
• IP address;
• if launched from a chat: chat ID, type, title, username, and photo (if any);
• if launched from the attachment menu in a private chat: similar info about the chat partner (per Telegram rules).

After transmission, Telegram does not control our further processing of that data.

Information automatically collected / created by us

In Short: Some information such as IP address, device/browser characteristics, and gameplay logs is collected or created when you use the Services.

• Account: internal account ID, email, password hash where email login is used, language, login platform and session data; a Telegram ID link applies when Telegram is used;
• Game profile: character, level, stats, location, inventory, currencies, reputation, clan, faction, property, vehicles, quests, action history;
• Social data: in-game chats, reports, support tickets, appeals;
• Technical logs: IP, User-Agent, session cookies, UI language (citypower_locale), login times, client errors, anti-cheat signals;
• Referrals: invite code, click fact, bonus status;
• Purchases: item, amount or currency, time, order or transaction ID, purchase verification data and delivery status for the relevant payment platform, without bank card details.

Mobile app information

• Installation and version: installation identifier, Android or iOS platform, app version, build number and update identifier. The installation identifier uses Android ID or the iOS identifier for vendor together with installation time and is kept in secure local storage. Our server stores its hash to associate the installation with your account;
• Device diagnostics: available OS version, model and manufacturer, battery level, charging and power-saving status, network type, internet availability and an available VPN indicator. The VPN indicator may be unknown; we do not receive VPN traffic contents or configuration. Reports are sent when opening or returning to the app and while it is active to diagnose compatibility and connection problems;
• Permissions and push: notification permission status, whether permission can be requested again, notification channel status, a Firebase Cloud Messaging (FCM) push token linked to the device and account, and technical notification delivery results;
• Presence: last signal time and whether the app is open or in the background. A closing signal may not arrive because of OS restrictions or lost connectivity;
• Play Integrity: supported Android builds ask Google to check the app and device environment. Our server processes verdicts about Google Play licensing, package name, signing certificate, build version and device integrity, binds the check to a one-time request, and records the result for service security. Installing our website APK is not itself a violation; UNLICENSED does not mean the account is blocked.

Device diagnostics are associated with your account and available to authorized administrators. Game location means your character’s position in the game, not the phone’s GPS coordinates.

We do not knowingly request full name, passport, or home address to play. If you send them to support yourself, they are processed only to handle your request.

2. How do we process your information?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process information for other purposes with your consent.

We process personal information for reasons including:

• identifying the account through the selected login method, authentication, and saving progress;
• running gameplay, chats, clans, factions, PvP, and economy;
• accepting donations and granting purchases;
• moderating rules, investigating reports, and protecting the game from cheats, bots, RMT, and multi-accounts;
• improving server stability and fixing bugs;
• associating the installation with your account, diagnosing device and network issues, delivering game notifications and app updates;
• responding to support requests;
• measuring landing-page traffic (Yandex Metrika);
• complying with applicable law and Telegram platform rules.

We process necessary account and gameplay information to provide the service under the Terms of Use. Security and legal obligations may rely on other grounds available under applicable law. Where separate consent is required, it must be obtained before the relevant processing; accepting terms does not replace that consent or a device permission. Applicable rules include Russian Federal Law No. 152-FZ where it applies and mandatory rules of your country.

You can allow or deny notifications in your device’s app settings. Disabling notifications does not delete your account.

We do not sell personal data to ad networks and do not use it for third-party advertising outside CityPower.

3. When and with whom do we share your personal information?

In Short: We may share information in specific situations described below and with the following categories of recipients.

• Telegram: Mini App auth, Stars, bot message delivery;
• Google / Firebase: FCM receives the push token and notification contents for delivery. Google Play processes purchases; Play Integrity checks the app and device and returns security verdicts. These services also receive technical information needed for their operation. See Google’s privacy policy;
• Expo (EAS Update): delivers app updates and receives network requests and build compatibility parameters when checking for and downloading updates. CityPower push notifications use Firebase directly, not Expo Push Service. See Expo’s privacy policy;
• Apple: processes App Store purchases when supported iOS purchase functions are used. Current CityPower push-token registration is for Android. See Apple’s privacy policy;
• Hosting / infrastructure: servers, databases, backups, CDN used to run the project;
• Analytics: Yandex Metrika on the public landing page only;
• Law / safety: when required by competent authorities or to protect users from serious threats;
• Business transfers: if CityPower Team transfers operation of the project (for example sale or reorganization of the service), information may move with the service under equivalent protections.

We do not share data with others without your explicit consent, except as above. Only what is needed for the specific purpose is shared with authorized recipients.

4. Do we use cookies and other tracking technologies?

In Short: We may use cookies and similar technologies to collect and store information needed for the Services.

We use:

• session cookies for login and CSRF protection;
• cookie / local storage for interface language;
• technical cookies required for stable site and Mini App operation;
• session and persistent-login cookies in the mobile WebView, and an installation identifier in secure app storage.

The landing page may set analytics cookies (Yandex Metrika). You can refuse or clear cookies in browser settings, but some features may stop working (for example you may need to sign in more often).

5. How do we handle Telegram / social logins?

In Short: If you register or log in using Telegram, we receive certain profile information from that provider.

Mobile users can register and sign in with email and password without Telegram. When you choose Telegram login, profile information may include your name, username, profile picture and Telegram ID, plus other data Telegram shares under its Mini App rules (see section 1).

We use that information only for the purposes in this Privacy Notice. We do not control and are not responsible for other uses of your personal information by Telegram. Review Telegram’s privacy notices and set preferences in the Telegram client.

6. Payments, Telegram Stars and mobile purchases

Telegram purchases use Telegram Stars. Where available, mobile purchases use Google Play Billing or Apple App Store. Our server verifies the purchase confirmation and credits the item. We process the product ID, purchase token or receipt, transaction ID, status and link to the game account; obfuscated account and character identifiers may be sent to the store to verify the purchase. We do not receive bank card numbers or CVV from these stores. Payment and refund processing is also subject to the relevant platform’s rules.

7. Is your information transferred internationally?

In Short: Your information may be transferred, stored, and processed in countries other than your own.

Regardless of your location, information may be processed on infrastructure of CityPower Team and of third parties listed in section 3 (including Telegram and hosting providers), which may be outside your country. If you are in the EEA, UK, Switzerland, or another region with strong data-protection laws, those countries may not always have equivalent rules. We take measures consistent with this Notice and applicable law to protect personal information.

8. How long do we keep your information?

In Short: We keep information as long as needed for the purposes in this Notice unless a longer period is required or permitted by law.

• account data is kept while the account is active;
• after a deletion request we delete or anonymize data within a reasonable time, usually within 30 days;
• some information may be kept in anonymized / aggregated form for up to 1 year after account deletion for security, anti-fraud, and dispute handling;
• technical logs, payment records, and moderation materials may be kept as required by law or to protect the service;
• public chat messages may remain with other players as screenshots or quotes that we do not control.

When we no longer have an ongoing need to process personal information, we delete or anonymize it, or securely isolate backups until deletion is possible.

Installation associations, push tokens and the latest diagnostic snapshot may remain until the account is deleted or anonymized, or the device record is removed. The snapshot does not disappear merely because the app closes. Security and notification delivery results may also remain in technical logs. Uninstalling the app does not automatically delete server-side account data.

9. Do we collect information from minors?

In Short: We do not knowingly collect data from or market to anyone under 18.

The Services are 18+ only. By using them you represent that you are at least 18. If we learn that personal information from a user under 18 has been collected, we will deactivate the account and take reasonable steps to delete such data. If you become aware of such data, contact support.

10. What are your privacy rights?

In Short: Depending on where you live, you may review, change, or terminate your account and exercise data-subject rights.

Subject to privacy-tpa, 152-FZ (where applicable), and other applicable law, you may:

• request information about your data and a copy of data linked to your account;
• request correction, blocking, or destruction of data processed unlawfully or incorrectly;
• request deletion of your account and related data (except what we may or must retain);
• withdraw consent by contacting us (this does not affect lawful processing before withdrawal);
• lodge a complaint with a data protection authority if you believe your rights are violated.

Account information

To review, change or delete account data, email citypowerstudio@gmail.com or contact Telegram support. Telegram is not required. Deactivation alone does not constitute deletion; the request concerns deleting or anonymizing account data, subject to the retention exceptions in section 8.

11. Confidentiality of correspondence

Support requests and any communication with the administration are treated as confidential unless you clearly state otherwise. We will not disclose such correspondence to third parties except as required by law. Do not publish private correspondence with CityPower Team representatives without their consent.

12. Security

We use organizational and technical safeguards: role-based access, HTTPS, password hashing, limited admin access and logging of suspicious activity. Absolute security does not exist. If your account is compromised, contact support immediately and secure the email or Telegram account you use.

13. How can you review, update, or delete the data we collect from you?

Based on the applicable laws of your country, you may have the right to request access, correction, or deletion of personal information, or to withdraw consent. Rights may be limited in some circumstances by law.

Request account deletion without Telegram

Email citypowerstudio@gmail.com with the subject “CityPower account deletion”. You do not need Telegram or the installed app to send a request. Include the account email, nickname or character ID and server, if known. For email login, send the request from the linked address; support may ask for further ownership verification. Do not send passwords, login codes or bank card details.

After verification, we delete or anonymize account data and related installation and push identifiers, except information retained for the reasons in section 8. Removing only the Telegram link does not delete the whole account. We respond within 30 days or another legally required period.

14. Controls for Do-Not-Track features

Most browsers include a Do-Not-Track (“DNT”) setting. No uniform standard for recognizing DNT signals has been finalized. We do not currently respond to DNT browser signals. If a standard we must follow is adopted, we will update this Notice.

15. Public information

Nicknames, clan emblems, messages in public chats, public profiles, and similar data are visible to other players. Information you choose to make public is not protected as secret by this Notice.

16. Do we make updates to this notice?

In Short: Yes, we update this notice as needed to stay compliant and accurate.

The current version is always here: https://citypower-mmo.com/privacy. Material changes may be announced in the channel or in-game when practical. Publishing an updated notice does not replace separate consent where new processing requires it.

17. How can you contact us about this notice?

• Developer: CityPower Studio (the CityPower team).
• Privacy and account deletion without Telegram: citypowerstudio@gmail.com.
• Support: https://t.me/CityPower_Support
• Channel: https://t.me/City_Power
• In bot: /developer_info
• Related docs: Terms · Game rules