Privacy Policy

Version 1.0.5 · Effective 8 August 2026 · Updated 10 October 2026

1. About this policy

CityOasis is an independent project based in Switzerland.

This Privacy Policy explains how CityOasis handles personal data when you use the app, website, and related services.

2. Accounts and authentication

CityOasis uses Firebase Authentication. By default, the app creates a guest account with a Firebase user ID (UID). Firebase Authentication may also process technical authentication and security information such as IP address and user-agent information.

Connecting Google is optional. If you connect Google, Firebase Authentication may process your email address, display name, profile image, provider identifier, and Firebase UID. CityOasis does not access the contents of your Gmail or Google Drive. Google profile data is not intentionally copied into Cloud Firestore by CityOasis.

Firebase Authentication is operated from data centers in the United States.

3. Location and map use

If you grant location permission, CityOasis uses your device location to show your position, choose an initial map area, find nearby places, and calculate distance-based ordering. Background location is not used.

Your current device location is not stored in Cloud Firestore. The last map center and zoom may be stored locally on your device. Coordinates of a public Community Place are stored because they are part of that place listing. A private Place Suggestion also contains the location you choose for the suggested place. A report may store a snapshot of the reported place coordinates, but not the reporter’s current location.

When you view the map or search, external map services receive information necessary to provide those functions. OpenStreetMap tile servers receive tile coordinates and request metadata. Overpass receives a map bounding box and query. Place searches for Nominatim are sent through a CityOasis-operated server-side gateway, which may return a cached result before contacting Nominatim. Nominatim receives the search text, interface language and related request metadata only when the gateway needs to contact it; CityOasis does not send your current GPS coordinates directly to Nominatim.

CityOasis may keep up to five recently submitted place searches locally on your device. This recent-search history is not stored in Cloud Firestore and can be cleared from the app.

4. Data stored in Cloud Firestore

The production Cloud Firestore database is located in the Zürich region (europe-west6). Depending on how you use CityOasis, Firestore may store:

• saved places and hidden places;
• amenity votes and verification records;
• private Place Suggestions, including the suggested name, location, place type, optional amenity answers, submitter UID, and review status;
• public Community Places and their public coordinates;
• policy acceptance and acknowledgement records;
• account-deletion requests and processing state;
• temporary account-merge processing state;
• temporary anti-abuse rate-limit state keyed by a SHA-256-derived identifier rather than the raw Firebase UID;
• shared geocoding cache records containing public search results keyed by a hash of canonical query dimensions; these shared cache records do not store the raw search text or Firebase UID;
• reports about places, including an optional free-text description and a snapshot of the reported place;
• moderation and anonymous retained contribution data where required to operate the community dataset.

Favorites, hidden places, Place Suggestions, consent records and deletion requests are treated as private account data. A Place Suggestion is readable in the app only by the submitting account while normal client Security Rules are used; administrative tooling may access it for review. Reports and moderation records are administrator-only. Public Community Place information and public summaries may be visible to other users.

5. Place Suggestions, community contributions and account deletion

Place Suggestions are private submissions to CityOasis for review. They are not published directly by the submitting account. CityOasis may verify, correct, reject, or match a suggestion to an existing place, or may use it as a source to create a CityOasis-managed public Community Place. If a suggestion leads to a public place listing, the submitting account is not presented as the public creator of that listing.

Optional amenity answers included with a Place Suggestion are private review information while the suggestion is under review and are not counted in public community totals before an approved administrative action deliberately incorporates them into the applicable contribution workflow.

You may request account deletion even while a Place Suggestion is still under review. Before the deletion is executed, CityOasis resolves any still-active Place Suggestions so that the review can be completed while the original account identifier is still available for safe contribution deduplication. After the deletion is executed, CityOasis removes the link between retained Place Suggestions and the deleted account by replacing the submitter UID with a common deleted-account marker. The Suggestion itself, its review outcome, and non-account-identifying place information may be retained where reasonably necessary for review history, data quality, duplicate handling, and provenance of CityOasis-managed place records. Other private account data is deleted according to the deletion workflow described in this Policy.

A public Community Place that was published by CityOasis after reviewing a suggestion may remain as an independent public dataset record because it does not need to retain the suggester’s UID as its public creator.

For Community Places created under the earlier direct-creation model, CityOasis may retain the public place after replacing the creator identifier with a common deleted-account marker. Votes may be anonymized and temporarily retained without the original account identifier and may later be converted into anonymous aggregate counts so that useful community information is not lost. Verification contributions may also be represented in anonymous retained aggregate information. Anonymous retained contribution data does not retain the original UID, the original contribution document ID, or the deletion request ID.

Reports may be retained for moderation and audit purposes as described below, with the reporter identifier anonymized when appropriate.

After account deletion is completed, CityOasis may retain limited deletion-processing records for up to 20 days in order to safely complete and verify the deletion workflow. These records may include a technical account identifier and limited request-processing metadata. CityOasis may also retain separate deletion-safety records for up to 20 days to help prevent deleted account data from being accidentally restored from backups. Where used, such safety records are designed to use a protected identifier for matching rather than exposing the original UID. These limited records are deleted after the applicable retention period.

6. Crash and diagnostic data

CityOasis uses Firebase Crashlytics for crash diagnosis. Crashlytics may process stack traces, app version, operating system and device information, crash time, exception information, Crashlytics installation identifiers, and Firebase installation identifiers. CityOasis does not intentionally add your Firebase UID, email address, name, current location, place coordinates, search query, or report free text to Crashlytics custom data.

Firebase states that Crashlytics keeps crash stack traces, extracted minidump data and associated identifiers for 90 days before beginning removal from live and backup systems. Crashlytics operates on global Google infrastructure.

7. External services

CityOasis relies on external providers to provide map, search, hosting and authentication functionality. These providers may process request metadata such as IP address, user-agent, request time and the area or search requested.

• OpenStreetMap tile service: map tiles and request metadata. Use is subject to the OpenStreetMap Foundation policies and privacy policy.
• Nominatim: place-search queries and request metadata are sent through the CityOasis server-side gateway when a shared or local cached result is not sufficient. Successful search results may be cached locally for up to 180 days and may also be stored in a shared server-side cache. Empty results are cached for up to 24 hours. Shared cache records do not store the raw search text or Firebase UID.
• Overpass: map-area queries and request metadata. CityOasis may use more than one Overpass operator. For map areas entirely within Switzerland, requests are sent first to overpass.osm.ch, operated by the Swiss OpenStreetMap Association (SOSM) in Switzerland; other areas, and fallbacks, use overpass-api.de or overpass.private.coffee. Retention may differ by operator; CityOasis does not state an unverified retention period.
• Firebase Hosting: hosts CityOasis web and legal pages on global Google infrastructure. Firebase states that Hosting processes IP addresses for abuse detection and usage analysis and retains IP data for a few months.

A concise overview of CityOasis data sources is available on the Data Sources page.

8. Purposes

CityOasis processes data only as reasonably necessary to provide account functions, display and synchronize places, review Place Suggestions, record community contributions, prevent duplicate or abusive contributions, process reports and deletion requests, maintain service security, diagnose crashes, and improve the reliability of the service.

9. Retention

• Firebase account data: until the account is deleted, subject to provider processing rules.
• Favorites, hidden places and policy records: until removed by the user or deleted with the account.
• Place Suggestions: while reasonably necessary for review, submission-history/status display, duplicate handling, data quality, or place-record provenance. If account deletion is requested while a Suggestion is still under review, the Suggestion is resolved before deletion is executed. After deletion, retained Suggestions are de-identified from the account by replacing the submitter UID with a common deleted-account marker and may be retained while those purposes remain applicable.
• Public Community Places: while active or otherwise needed for the public dataset. New suggestion-based public places are CityOasis-managed records that do not need to retain the suggester UID as creator. Legacy directly created Community Places may instead have their creator identifier anonymized on account deletion.
• Raw votes and verification records: while associated with an active account; on account deletion, votes may be anonymized and temporarily retained before later aggregation, and verification contributions may be represented in anonymous retained aggregate information.
• Limited deletion-processing records: up to 20 days after account deletion is completed.
• Deletion-safety records used to help prevent accidental restoration from backups: up to 20 days after account deletion is completed.
• Anti-abuse rate-limit state: each fixed-window record is marked to expire at the end of its rate-limit window plus 24 hours and is removed by scheduled cleanup.
• Account-merge processing state: completed merge requests are normally retained for 24 hours; action-required or repair states are normally retained for 7 days before scheduled cleanup.
• Shared geocoding cache: empty-result entries expire after 24 hours. Successful shared-cache entries currently have no fixed automatic expiry.
• Recent submitted-search history: up to five entries stored locally until cleared, displaced by newer searches, or removed when app data is cleared.
• Open reports: until resolved. Resolved report metadata: normally up to 24 months. Free-text report details: normally up to 90 days after resolution, and sooner when unnecessary personal information is found. An active retention hold may extend these periods where continued retention is required for an ongoing moderation or audit need.
• Crashlytics data: generally 90 days as described by Firebase.
• Last map position: locally until app data is cleared.

CityOasis operates daily production backups for Cloud Firestore and Firebase Authentication with a 14-day rolling retention. Deleting data from the live service does not necessarily remove that data immediately from backups that already exist; those backup copies age out as the applicable backups expire. CityOasis uses deletion-safety controls to reduce the risk that deleted account data is accidentally restored from backup. If backup retention changes materially, this Policy will be updated where necessary.

10. International processing and transfers

CityOasis is operated from Switzerland. Production Cloud Firestore and the CityOasis server-side gateways run in Google Cloud’s Zürich region (europe-west6). Some services process personal data outside Switzerland:

Data is sent over encrypted connections when you use the related feature.

For transfers to Google LLC in the United States, CityOasis relies on Google LLC’s certification under the Swiss-U.S. and EU-U.S. Data Privacy Framework and on the data processing terms, including Standard Contractual Clauses, that apply to Firebase. You can contact Google about its privacy practices through Google’s privacy contact form at https://support.google.com/policies/contact/general_privacy_form.

The United States does not have a single comprehensive federal data-protection law. Information about the data-protection systems of the countries listed above is published by data-protection authorities, such as the Swiss Federal Data Protection and Information Commissioner (FDPIC) and Japan’s Personal Information Protection Commission.

CityOasis cannot provide its account functions without Firebase Authentication. If you do not agree to these transfers, you can stop using CityOasis and request deletion of your account as described in this Policy. Connecting Google is optional, and you can deny location permission and still use the map.

11. Your choices and rights

You may use most CityOasis features with a guest account and may choose whether to connect a recoverable account. You can deny location permission and continue to use the map manually.

You can view the status of your own Place Suggestions in My Contributions while those records remain available. You may request access to, correction of, or deletion of personal data associated with your CityOasis account. Account deletion is available through the app and through the CityOasis account deletion page. A guest account that has lost its original session may be difficult or impossible to identify reliably; in that case, CityOasis may not be able to delete a specific guest record without sufficient verification.

For privacy requests, use the CityOasis contact page or contact contact.cityoasis@gmail.com.

12. Children

CityOasis is not designed for children under 13 and does not intentionally target users under 13.

13. Security

CityOasis uses Firebase Authentication and Firestore Security Rules, limits access to private and administrator-only data, and avoids intentionally sending account identifiers or location data to Crashlytics custom fields. No online service can guarantee absolute security.

14. Data controller and contact

Data controller: Takehiro Kato
Operating CityOasis as an independent developer in Switzerland.

Contact: contact.cityoasis@gmail.com

15. Changes and language

CityOasis may update this Privacy Policy as the service changes. Material changes may be presented in the app and may require renewed acknowledgement where appropriate. The English version is authoritative; the French version is an official translation. If the versions differ, the English version takes precedence.