Last updated: 2026-07-29
“Žvėryno paslaptys” collects only the data needed for the game to work, to verify finds, manage your account, keep the service secure and improve the app.
Data controller
Data controller: MB “VersloVertinimas”
Privacy contact:
info@vilniauspaslaptys.lt
What data we collect
Account data
- nickname;
- sign-in identifier;
- sign-in method: Google, Apple or a guest account;
- avatar choice;
- account settings, for example whether you appear on the leaderboard.
Game data
- found objects;
- points, rank, badges and achievements;
- hints you have used;
- the history of your find-verification attempts;
- technical verification results, for example whether a find matched the location and the photo.
Photos
- photos you take in the app to verify a find;
- downscaled / optimised find photos stored in your album;
- photos you submit when suggesting a new secret.
Location data
- GPS coordinates are stored only when you confirm a find, suggest a new secret or submit a problem report;
- on the map your location is only shown on screen while the map is open — so you can see where you are; it is never sent anywhere or stored;
- the app never tracks your location in the background;
- the app does not collect a continuous movement history.
Community and support data
- secrets you suggest;
- feedback, bug reports and problem reports;
- a problem report may include the location where you tried to verify a find, if you choose to submit such a report.
Statistics and diagnostics
- anonymous or pseudonymous usage statistics;
- crash and technical error reports;
- app version, device and performance diagnostics.
This data is collected only if you consent to statistics and diagnostics. You can withdraw your consent at any time in the app profile.
How we use the data
We use the data so that:
- you can sign in and use your account;
- we can verify whether you really found a secret;
- we can award points and badges and show your progress;
- we can show your album;
- we can show the leaderboard, unless you chose to hide yourself from it;
- we can accept and moderate suggested secrets;
- we can investigate errors, inaccurate finds and abuse;
- we can improve the app’s stability, usability and content.
Find verification is automatic: the server compares your photo with the secret’s reference photos and checks that the photo was taken close enough to the object. If a find is not verified, you can try again or report a problem.
Legal basis
Processing of your account, game progress, finds and photos is necessary to provide the service.
Security, fraud-prevention, error-investigation and service-stability data is processed on the basis of our legitimate interest in keeping the app working and secure.
Statistics and crash reports are collected only with your consent.
Where we are required to keep data for legal reasons, it may be processed to comply with a legal obligation.
Where data is stored and who receives it
The main data is stored on Google Firebase / Google Cloud infrastructure in the European Union, region europe-west1.
At the moment a find is verified, your photo may be briefly processed by a Google Cloud image-recognition service in a US data center. This processing is used solely to verify the find. By the app’s design, the service does not remember the photo as a separate user profile and does not use it for advertising.
Sign-in uses Google and, in the iOS version, Apple sign-in providers. They process sign-in data under their own privacy terms.
We use the following service providers:
- Google Firebase Authentication;
- Google Firestore;
- Google Cloud Storage;
- Google Cloud Functions;
- Google Firebase App Check;
- Google Firebase Crashlytics and Analytics, only with your consent;
- Google Cloud / Vertex AI for image comparison;
- Google Firebase Cloud Messaging — for app (push) notifications about news such as a new secret or a contest. Notifications are sent over a shared channel to all devices; the device notification token is handled by Google, is not stored on our servers and is not linked to your account. You can turn notifications off in your phone settings at any time;
- OpenAI (USA) — only for administrator-initiated content preparation: drafting and translating secret descriptions. For this purpose the secret text and a photo of the place (including a photo from an approved suggestion) may be processed, but never your account data;
- Gmail (Google) — for administrator alerts about new entries (feedback, problem reports, suggestions). These e-mails contain no personal data — only the entry type and a link to the admin panel;
- Apple Sign in with Apple, if you use the iOS version.
We never sell or rent your data, and we do not use it for advertising profiling.
Who can see the data
Your album finds and photos are visible to you.
The leaderboard may show your nickname, points, rank, avatar and achievements. In your profile you can choose not to appear on the leaderboard.
The administrator can see the data needed to moderate content, investigate errors, check find quality, review suggestions and stop abuse.
If you suggest a new secret, the photos and information you submit may be reviewed by the administrator. If the suggestion is approved, part of the submitted material may become app content. When you delete your account, your identity is removed from such suggestions, but approved or moderated content may remain in the app once it is no longer linked to you.
How long we keep the data
We keep your account, finds, points, album and game progress for as long as you have an account.
Photos are stored in a downscaled / optimised form so that the album and find history work.
Find-verification attempt records and technical diagnostic data may be kept for error, quality and security purposes for as long as you have an account, unless they are no longer needed earlier.
Feedback, bug reports and problem reports are kept for as long as they are needed to resolve issues, or until you delete your account.
When you delete your account, your active account data, finds, attempt records, feedback, problem reports and uploaded photos are deleted. Data may persist in backups for a limited time according to the technical backup retention period, currently up to 14 days.
Your rights
You can:
- receive information about your data;
- ask us to correct inaccurate data;
- delete your account and the data linked to it;
- withdraw your consent to statistics and crash reports;
- object to certain processing where the law allows it;
- request a copy of your data;
- lodge a complaint with a supervisory authority.
You can delete your account in the app: Album → Delete account (on iOS: Profile → Delete account).
If you no longer have the app or cannot sign in, you can request account and data deletion on the Account deletion page.
For privacy questions, write to: info@vilniauspaslaptys.lt.
Camera and location
The camera is needed only so that you can photograph a secret you have found.
Location is needed when you verify a find, suggest a new secret and when you submit a problem report — only then are the coordinates stored. When you open the map, your location is additionally shown on the screen itself (a blue dot with a heading arrow) so you can see where you are; that location is never sent anywhere or stored. The app does not request or use location in the background.
If you do not grant the camera or location permissions, you can still browse part of the app’s content, but you will not be able to verify finds.
Remember when taking photos
Photograph only objects visible from public space. Do not photograph people, licence plates, private courtyards, apartments, stairwells or other private spaces. Such photos may be removed.
Children
The app is not intended for children. We do not create separate children’s accounts. If you believe a child has provided personal data without proper permission, contact us: info@vilniauspaslaptys.lt.
Security
Data is transmitted over an encrypted connection. Access to data is restricted by Firebase security rules, server-side checks and administrator permissions. Finds and points are confirmed on the server side, not merely on the user’s device.
Changes to this policy
This privacy policy may be updated. The latest version is always shown in the app or on the official privacy policy page.