Privacy Policy

Last updated: July 2026

1. Introduction

Mystigo ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Mystigo mobile application and related services.

This policy complies with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Data Controller

The data controller responsible for your personal data is Mystigo. For privacy-related inquiries, contact us at privacy@mystigo.world.

3. Information We Collect

3.1 Information You Provide

• Account data: username, email address, and password when you register
• Profile data: optional display name and avatar
• User-generated content: photos and information you submit for points of interest

3.2 Information Collected Automatically

• Location data: precise GPS coordinates while you use the App, and approximate location in the background (with your explicit permission) to detect nearby heritage sites
• Usage data: itineraries browsed and completed, enigmas attempted, scores, and leaderboard activity
• Device data: device type, operating system version, and app version for diagnostics

4. How We Use Your Information

We use your information to:

• Provide and operate the App and its features
• Maintain and display the global leaderboard
• Calculate scores and track your progress
• Send notifications about nearby heritage sites (background location, opt-in)
• Moderate user-submitted points of interest
• Improve the App through aggregated, anonymized analytics
• Respond to your support requests
• Comply with legal obligations

5. Legal Basis for Processing (GDPR)

• Contract performance: processing necessary to provide the App's core services
• Legitimate interests: improving the App and preventing fraud
• Consent: background location access and marketing communications
• Legal obligation: compliance with applicable laws

6. Location Data

Location data is core to Mystigo's functionality. We collect:

• Foreground location: to display your position on the map, detect when you reach geofence triggers, and validate POI visits — collected only while the App is in use
• Background location: to detect nearby heritage sites passively — collected only with your explicit permission and only when this feature is enabled in settings

You can revoke location permissions at any time in your device settings. Background location can be disabled independently in the App settings without affecting other features.

Your precise location coordinates are never sold to third parties and are not used for advertising purposes.

7. Data Sharing

We do not sell your personal data. We may share your information with:

• Service providers: cloud hosting and image storage (Cloudinary) who process data on our behalf under strict data processing agreements
• Other users: your username and leaderboard rank are publicly visible within the App
• Legal authorities: when required by law or to protect our rights

8. AI-Assisted Features

Some optional features use artificial intelligence to generate or process content — for example AI-assisted itinerary creation, and the generation or translation of heritage and point-of-interest descriptions. These AI features run entirely on Mystigo's own servers; the text you submit is not shared with any third-party AI provider and is not used to train external models or for advertising.

Only the text required to fulfil the request is processed — we do not use your account identifiers, email address, or precise location coordinates for these features. They are optional: if you do not use AI-assisted creation, no such content is processed on your behalf.

9. Data Retention

We retain your personal data for as long as your account is active. You may delete your account at any time — see how to delete your account. After account deletion:

• Account and profile data are deleted within 30 days
• Location history is deleted immediately upon account deletion
• Anonymized usage statistics may be retained indefinitely
• User-submitted POI content that has been approved may remain in the App in anonymized form

10. Your Rights (GDPR)

Under the GDPR, you have the right to:

• Access: request a copy of the personal data we hold about you
• Rectification: correct inaccurate or incomplete data
• Erasure: request deletion of your personal data ("right to be forgotten")
• Portability: receive your data in a machine-readable format
• Restriction: request that we limit processing of your data
• Objection: object to processing based on legitimate interests
• Withdraw consent: withdraw previously given consent at any time

To exercise these rights, contact us at privacy@mystigo.world. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.

11. Security

We implement industry-standard security measures including encrypted data transmission (HTTPS/TLS), bcrypt password hashing, JWT-based authentication, and regular security reviews. However, no method of transmission over the internet is 100% secure.

12. Children's Privacy

The App is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us to have it deleted.

13. International Transfers

Your data may be processed in countries outside the European Economic Area. When such transfers occur, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the App or by email. The "last updated" date at the top of this page indicates when it was last revised.

15. Contact

For privacy-related questions or to exercise your rights, contact us at privacy@mystigo.world.