Privacy policy

English

Updated 9 September 2026. Includes the changes in version 2.0.

Phone backups and your own files

If you enable your phone's backup, game data and precise GPS routes may be included in Apple iCloud or Google backups. You control these services in your phone settings. The providers process this data under their own terms and privacy policies. Katujahti does not send GPS routes to its own servers.

A full backup file you save also includes GPS routes still stored on your phone. The file goes to the location you choose. If you select a cloud storage service, the file is transferred to that service. A route image or GPX file you share may also reveal your movements.

The previous processing description applies to online backups made before version 2.0 until those copies are deleted. Do not assume that updating the app alone deletes a copy already stored on the server. You can request deletion of old data from the controller.

Controller and contact details

1. Data processed only on the device

When you start an outing, Katujahti uses device location to identify streets you walk. If you grant the operating-system permission, location can also be used while the app is in the background or the screen is locked. Background location is used only for an outing you explicitly start.

• precise GPS location and the raw route,
• route geometry and movement timestamps,
• local street coverage and other game state stored on the device,
• local outings, achievements and settings.

GPS coordinates, raw routes and movement timestamps are not sent to Katujahti servers. The server interface is also designed to reject coordinate and route data.

2. Account and sign-in

You can use Katujahti's local core features without an account. If you choose Google or Sign in with Apple, Katujahti processes the information required to provide the account: verified email address, name/display name, provider identifier, Katujahti user ID and, for Apple, the token/identifier required to revoke authorisation at account deletion.

The information comes from you and the sign-in provider you choose. Apple and Google process their own sign-in service under their privacy practices. Signing in does not send your GPS route or street coverage to the sign-in provider. The phone's own backup is a separate feature described at the start of this policy.

From version 2.0, the sign-in screen also explains participation in Shared Finland. If you have not yet made a participation choice, signing in enables participation. If you previously declined, it remains off. You can change your choice under Settings → Community → Shared Finland. Participation sends your street IDs and progress to Katujahti’s server, without your exact GPS route or outing times. Nickname visibility and sharing in Groups are separate choices.

3. Optional cloud and community features

• Online backup before version 2.0: game-state backup including street coverage and progress, settings and outing summaries such as duration and distance. It does not contain the raw route or GPS coordinates.
• Finland statistics: your chosen nickname and aggregate game statistics.
• Groups: group name, display name and street/area states you choose to share. Groups are invitation-only.
• Shared Finland/community features: shared street identifiers and municipality-level aggregates, not raw location data.
• Street/name reports: the target identifier, selected reason and optional free-text details.

A Finland-statistics nickname may be visible to other participating players. Group names and member display names are visible to the relevant group members. Katujahti does not share raw routes or GPS coordinates with other players.

4. Purposes and legal bases

Local GPS processing, account services and online backups made before version 2.0 are processed to provide a service you request (GDPR Art. 6(1)(b)). Optional publishing/community sharing you choose through the controls described above is based on your voluntary opt-in/consent where applicable (Art. 6(1)(a)). Reports, moderation and security are processed on the controller's legitimate interests in protecting users and the service and preventing abuse (Art. 6(1)(f)). Where required, data may also be processed to comply with legal obligations (Art. 6(1)(c)).

5. Recipients and service providers

Personal data is processed by Radiant Bytes Oy and technical processors acting on its behalf only as needed to provide the service. Katujahti's own server environment is in the EU/EEA. Access is restricted and protected by technical and contractual safeguards.

You can choose Apple or Google for sign-in. Your phone may also use their backup services, depending on your phone settings. Their own processing and any international transfers related to their sign-in services are governed by their own privacy arrangements. Katujahti does not sell personal data or disclose it for advertising, profiling or marketing.

6. Security

Server traffic is protected with TLS. Server-side permissions are restricted by role. Raw GPS routes are neither required by nor sent to the server. Technical security/error logs may be used for service protection and troubleshooting and are rotated and retained only as long as necessary for operations and security.

7. Retention and deletion

From version 2.0, exact GPS points for completed outings are removed from the phone once more than 90 days have passed since the outing ended. Progress, outing history, statistics and achievements remain. This rule does not remove points from unfinished outings. Backup and GPX files you previously saved yourself are not deleted when the phone’s route data is removed.

Account information is retained while the account is active. Optional cloud data is retained while the relevant feature is used or until you delete it. You can delete your online account from the app. You can also ask the controller to delete older online backups. The Delete account action removes your online account and its data stored on Katujahti servers. The game and your progress remain on this device. If deletion partially fails, it is not reported as successful.

If limited information must be retained for legal claims, legal obligations, security or abuse investigations, only what is necessary is retained and only for the required period.

Account and data deletion instructions

8. Your rights

Where applicable, you have rights of access, rectification, erasure, restriction, data portability, objection to legitimate-interest processing and withdrawal of consent. Requests can be sent to jussi.kallioniemi@radiant.fi. Requests are handled without undue delay and normally within one month. You may lodge a complaint with the competent data-protection authority.

9. Age and minors

Katujahti is intended for users aged 13 or older and is not designed for children under 13. Local law may set a higher digital-consent age or require parental authorisation for account or community features used by a 13-17-year-old. Such online features should only be used where the user may validly provide the required consent or the required parental authorisation has been obtained.

If we have a justified reason to believe that personal data of a child under 13, or of another minor using an online feature without authorisation required by local law, has reached Katujahti cloud services, we will delete or restrict that processing as required by applicable law. A parent or guardian may contact jussi.kallioniemi@radiant.fi.

10. Required information, automated decisions and cookies

An account is not required for Katujahti's local core use. Account identity data is required only if you choose account/cloud features. GPS is needed for GPS gameplay on the device but is not collected by Katujahti servers.

Katujahti does not make solely automated decisions about users that produce legal or similarly significant effects within GDPR Article 22.

Katujahti.fi uses no cookies, analytics or third-party tracking. No external advertising/analytics scripts or external fonts are loaded. Ordinary web-server security logs may process an IP address for operational security; they are not used for profiling or marketing analytics.