The Undercity (“we”, “the game”) is a free, fictional browser-based crime strategy game. This policy explains what data we collect, why, and the control you have over it. The game is intended only for adults aged 18 or older.
Data we collect
- Account & identity. When you sign in with Google, Apple, or email + password, we receive your email address and an account identifier to create and authenticate your account.
- Age confirmation.You confirm once that you are 18 or older. We do not collect or store your date of birth — only the yes/no confirmation flag.
- Avatar.You pick one of the game’s built-in avatars. We no longer accept photo uploads, so no new image of you is collected. Photos uploaded before September 2026 are no longer displayed and can no longer be opened by anyone through the game.
- Who you looked at.When you open another player’s profile we record that you opened it, once per player, so the game can award achievements and show them that someone looked. Both accounts are named in that record.
- Gameplay data. Your in-game character, progress, virtual currency, items, businesses, messages you send in chat, and related activity.
- Preferences. Your chosen language.
- Device push token. On the iOS and Android apps, if you enable notifications we store a device push token (Apple APNs or Google FCM registration token) to deliver notifications to that device. It is not used for advertising or cross-app tracking.
- Page views. Each page you open inside the game is recorded against your account, so we can see which parts of the game people actually use. We store the address of the page only: query strings are stripped, and the pages that name another player (profiles and whispers) are recorded as the feature you used, not who you looked at. Repeat views of the same page within 30 seconds are dropped, and there is a daily limit per account. It is not sold, is not shared beyond the providers listed below, and is not used for advertising or cross-app tracking.
How we use it
- To run your account and the game’s features.
- To confirm you meet the 18+ age requirement.
- To keep the game fair and safe (anti-cheat, moderation of reported content).
- To see which parts of the game get used, and improve it.
Service providers
We share data only with the infrastructure and payment providers needed to run the game:
- Supabase — database, authentication, and hosting of your account and game data.
- Google and Apple — sign-in (OAuth). We never see your password.
- Apple Push Notification service (APNs) — delivery of iOS push notifications when you enable them.
- Firebase Cloud Messaging (Google) — delivery of Android push notifications when you enable them.
- Vercel — application hosting and anonymous, cookieless usage analytics.
- Stripe — payments for Gold bought on the website. Stripe takes your card or Pix details on its own checkout page; we never see them, and we receive only a record that the purchase happened.
- Apple and Google — payments for Gold bought inside the iOS and Android apps. The store takes the payment and tells us the purchase happened; we never see your payment details.
We do not sell your personal data, and we do not use it for third-party advertising or cross-app tracking.
Data retention & deletion
We keep your data while your account is active. Three things are cleared out on a schedule: chat messages after 7 days, and page views and in-game notifications after 30 days. The rest of your history — crimes, fights, casino hands, trades and cash transactions — is kept for as long as the account exists.
You can permanently delete your account from Profile → Danger Zone → Delete accountinside the game; if you lead a gang with other members, hand leadership over first. Deletion immediately and permanently removes your account record, your character and your game data, and it cannot be undone. Records that involve another player — market sales, raids, and gang log entries — are kept without your account id, so the other player’s history stays intact.
Your rights
You may access, correct, or delete your data. The in-app deletion tool handles erasure directly; for any other request, contact us at rafaelrmlv@gmail.com.
Children
The game is restricted to users 18 and older and is not directed at children. We do not knowingly collect data from anyone under 18.
Changes
We may update this policy; material changes will be reflected by the “Last updated” date above.
Contact
Questions about this policy: rafaelrmlv@gmail.com.