Your data

Privacy Policy

Effective date: September 6, 2026 · OppsCity ("the Service") is operated by Cultural Intelligence Agency LLC.

The short version. We collect the minimum needed to run a rivalry: your email to sign you in, a display name and handle so your opps know who you are, your date of birth once to check you're old enough, and — if you link one — the public achievement data from your gaming profile. We never see your Xbox or PlayStation password or your card number. We don't sell your data, and we don't run ad networks. You can delete everything from Settings.

What we collect

Account. Your email address (used to send one-time sign-in codes and important account email), your display name and handle, and your date of birth. We use your date of birth only to enforce our minimum age and age-based restrictions; we don't display it and we don't use it for anything else.

Linked gaming profiles. If you link an Xbox gamertag or PlayStation online ID, we store the gamertag or online ID, the platform's public account identifier, the verification code we asked you to put in your bio and whether verification succeeded, and the time of your last sync. We read only information the platform makes publicly available — profile name, avatar, and achievement or trophy lists with unlock times — through third-party data services. We never ask for, receive, or store your platform password or session tokens.

Activity in the app. Your manual check-offs (which are marked as self-reported), your rivalries and call-outs, the preset taunts you send, radar and feed events, receipts you generate, users you block, and your Pro status. Most of this is the product: it is visible to your opps and, when you share a receipt, to whoever you share it with.

Payments. If you buy OppsCity Pro on the web, Stripe processes the payment. We receive a confirmation that you paid, the amount, and a Stripe customer reference — never your card number. If you buy through Apple or Google in the future, they process the payment under their own privacy terms and we receive only a purchase confirmation.

Waitlist. If you join the waitlist on oppscity.com, we store the email you gave us so we can tell you when the app launches. Unsubscribe from any email we send, or write to us, and we'll remove it.

Diagnostics. Standard server logs (IP address, browser type, timestamps, the request that was made) kept briefly to keep the Service running and secure, and error reports when something breaks. On oppscity.com we may use Cloudflare Web Analytics, which is cookie-less and doesn't build profiles of individuals.

Cookies. The app uses cookies only to keep you signed in and to protect against forgery. There are no advertising or cross-site tracking cookies.

What we use it for

Who sees it

Other users. Your display name, handle, avatar, linked-profile name, completion progress, rivalry results, and taunts are visible to your opps and can appear in feeds and receipts. Your email, date of birth, and payment information are never shown to other users.

Service providers who process data on our behalf, under contracts that limit them to that purpose: Supabase (database and authentication), Vercel (application hosting), Cloudflare (website hosting, DNS, and security), Stripe (payments), Resend (transactional email), and OpenXBL (reading public Xbox achievement data from Microsoft's services). These providers may store data in the United States.

Legal. We may disclose information if the law requires it, to protect the rights and safety of users or the public, or as part of a merger or acquisition (in which case this policy continues to apply to your data).

We do not sell your personal information, and we do not share it with advertisers or data brokers.

Keeping and deleting it

We keep your data while your account is active. You can delete your account from Settings inside the app, or email hello@oppscity.com from your account address; we remove your account, linked profiles, and activity within 30 days. Receipts you already shared may continue to exist wherever you posted them. We keep payment records for as long as tax and accounting law requires, and short-lived server logs are deleted on a rolling basis. Unlinking a gaming profile deletes the stored account identifier and synced achievement data for that profile.

Security

Data is encrypted in transit and at rest, access is restricted to what each system needs, and sign-in uses one-time codes instead of stored passwords. No system is perfectly secure; if we learn of a breach affecting your data we will tell you as the law requires.

Children

OppsCity is not for children under 13, and we don't knowingly collect data from them. If you believe a child under 13 has an account, contact us and we'll delete it.

Your rights

Wherever you live, you can ask us for a copy of your data, correct it, or delete it — from Settings or by email. If you're in the EU, UK, California, or another place with specific privacy laws, you may have additional rights (such as objecting to certain processing or lodging a complaint with your regulator); we honor those requests and won't treat you differently for making them. We don't respond to browser "Do Not Track" signals because we don't track you across sites in the first place.

Changes

We may update this policy as the product evolves. Material changes will be announced in the app or by email before they take effect, and the effective date above will change.

Contact

hello@oppscity.com · OppsCity · oppscity.com · Cultural Intelligence Agency LLC