Skip to content
Districts
Get the game

Districts privacy policy

for the Districts mobile app and the Districts websites

This is an English translation provided for convenience. In case of any discrepancy, the Polish version available at districts.pl/privacy prevails.

Effective date: 12 October 2026

Minimum user age: 16

This Privacy policy explains how we process the personal data of people who use the Districts mobile app on iOS or Android devices and the Districts websites.

Districts is a location based mobile game. The core game mechanic relies on the player physically moving around and on recording the GPS route during a session started by the player. For that reason we pay particular attention to location data, activity data, the visibility of information inside the game and the safety of gameplay.

This Policy is the information provided under Regulation (EU) 2016/679 of the European Parliament and of the Council, referred to below as the “GDPR”. It supplements the Districts Terms with regard to the protection of personal data and privacy.

1. Key information

  • Controller: the person indicated in section 2.
  • Scope of the service: the Districts app, the player account, location sessions, the map, territories, leaderboards, social features, messages, support and the Districts websites.
  • Key data: email address, account identifier, nickname and profile, precise location during a session, activity and motion data, voluntarily provided weight, technical, diagnostic and anti-cheat data, and content submitted by the user.
  • Location: the route trace is recorded only during a session started by the user. Outside an active session Districts does not record a continuous route.
  • Visibility in the game: other players can see the nickname, avatar, colour and shape of a captured territory, leaderboard position, level, achievements and selected profile elements. We do not share with them the raw GPS trace or the precise current position of the user.
  • Fitness and health data: Districts processes voluntarily provided weight and, once the relevant permission is granted on iOS, the step count and motion data related to a session. The current Android version does not access Health Connect or Google Fit.
  • Diagnostics: Sentry is used to detect crashes and errors. Screenshots and the default sending of user identifying data are switched off.
  • Ads and purchases: the app contains no ads and no paid purchases.
  • Age: the app is intended for people aged 16 and over.
  • Account deletion: the account can be deleted in the app or the deletion can be initiated at https://districts.pl/delete-account.
  • Contact: contact@districts.pl.

2. Data controller and contact

The controller of the personal data of Districts users is Adrian Kominek, a natural person not conducting business activity, running the service under the Districts brand, with the correspondence address ul. Radlińska 31, 44-286 Wodzisław Śląski, Poland, referred to below as the “Controller”.

For matters concerning privacy and personal data you can write to contact@districts.pl or send a letter to the Controller's address marked “Personal data”.

No data protection officer has been appointed. People who develop and maintain Districts are given access to data only to the extent necessary to perform their tasks and on the basis of an appropriate authorisation or agreement.

If the Controller changes, we will update this Policy before the new controller starts processing and we will provide their full details and the date of the change.

3. Definitions

  • App: the Districts mobile app available on iOS and Android.
  • Personal data: information about an identified or identifiable natural person.
  • Player or user: a person who uses the App, the Website or other Districts services.
  • Account: an individual user account in the App.
  • GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
  • Session: a period of activity recording started by the user with the START button and finished with the STOP button, or closed technically under the rules of the App.
  • Website: the Districts websites, including https://districts.pl.
  • Territory: an area calculated from the user's route and used in the game mechanics.

4. What data we process

The scope of data depends on how you use the App, the Website and the features available to you. We do not require data that is not needed for a given feature to work.

4.1. Account and profile data

We may process:

  • the internal Account identifier;
  • the email address provided at registration or by Apple or Google;
  • the sign-in method and the identifier of the authentication provider;
  • the nickname, avatar, colour, settings and other profile elements;
  • information needed to maintain and restore the sign-in session;
  • the creation date, Account status and information about any applied restrictions;
  • the version of the accepted Terms and Policy and the time of acceptance, where it is recorded;
  • the push notification token, platform and notification settings.

The email address is not publicly visible. The nickname and selected profile elements may be visible to other players in line with section 4.6.

4.2. Age data

The App is intended for people aged 16 and over. The current version of the App does not require a date of birth and does not store a separate age declaration. The 16+ requirement is a condition of access to Districts and must be stated consistently in the target audience information provided in the app stores.

4.3. Location, route and activity data

During an active Session we may process precise geographic coordinates, time, accuracy, speed and heading of a sample, the sequence of points that forms the route, the start and end point, distance, duration, the declared or recognised activity type and the technical status of the Session.

On Android the recording of a started Session can run with the screen off as a foreground service with a visible system notification. The current Android build does not request the ACCESS_BACKGROUND_LOCATION permission. On iOS the App may use the “Always” location permission to continue a started Session with the screen off or after the App moves to the background.

Outside an active Session Districts does not record a continuous route trace. Precise location is essential for the core territory capture mechanic. Without the location permission a user can use part of the App, but cannot run a valid Session.

Based on a Session we also create and store the geometry of the route and the Territory, the validation result, captured Territories, points, level, achievements, leaderboards, statistics and the gameplay history needed for the shared map to work.

4.4. Fitness, health and motion data

Districts may process:

  • the weight in kilograms entered voluntarily by the user, used to estimate energy expenditure;
  • the number of steps attributable to a Session and the step frequency;
  • the recognised type of motion, including walking, running, cycling, vehicle motion, being stationary or an unrecognised result;
  • aggregated signals from the accelerometer and motion sensors and indicators of how the motion matches the GPS route;
  • estimated calories and activity statistics calculated from distance, motion type, step count and the voluntarily provided weight.

On iOS the step count may be read from Apple HealthKit once the user grants the system permission. The App also uses iOS mechanisms related to motion and the pedometer, including CMPedometer and Core Motion, once the required permissions are granted. Data from HealthKit may include steps recorded by Apple devices linked to the user's account, but Districts does not connect directly to a smartwatch or a band.

The current Android version of the App does not request permissions for Health Connect or Google Fit. It may, however, use aggregated motion signals available on the device during a Session, provided they do not require access to a health data repository.

Providing your weight is voluntary. Data is read from HealthKit only after the user knowingly grants permission. Where the data constitutes health data, the basis for processing is consent under Article 6(1)(a) GDPR and explicit consent under Article 9(2)(a) GDPR. Consent can be withdrawn in the iOS settings and by contacting the Controller. After consent is withdrawn we stop new readings, and data processed solely on that basis is deleted or irreversibly anonymised without undue delay. Withdrawing consent does not affect the lawfulness of earlier processing. A limited scope of data may be kept only where a separate basis under Article 9 GDPR applies, in particular where it is necessary for the establishment, exercise or defence of legal claims under Article 9(2)(f) GDPR.

Refusing to provide your weight or to share HealthKit data does not block Account creation or basic use of the App. It may reduce the accuracy of fitness statistics and the ability to use an additional signal when assessing a Session.

4.5. Technical and diagnostic data

We may process the device model, platform, system and App version, language, locale, time zone, IP address, basic network request data, the Account identifier or a pseudonymous device or installation identifier, the status of selected permissions, data about the features used, crash reports, stack traces, error type, performance data and the push notification token.

Sentry receives error reports and the technical data needed for diagnostics, in particular the error type, stack trace, App and system version, device model, performance data and the technical context of the event. Sending screenshots and the default sending of user identifying data are switched off. A report may contain a pseudonymous user or device identifier. We do not add the full GPS trace, message content, authentication tokens, weight or HealthKit data to reports as separate fields. A technical error description created by the system or by an external library may, however, contain information related to the operation during which the error occurred.

The App may download font files provided by Google Fonts. With such a request Google may receive the IP address, the time of the request and basic technical connection data needed to deliver the font file and store it in the device cache. We do not use this mechanism for advertising or for tracking user activity in other apps.

4.6. Anti-cheat data and gameplay safety

To detect cheating, protect Accounts and maintain fair gameplay we may analyse:

  • GPS samples and their consistency in time and space;
  • the declared and the recognised activity type;
  • steps, step frequency, aggregated motion signals and sensor consistency;
  • unusual jumps in position, speed or time;
  • information about root or jailbreak detection and a VPN usage signal, where available;
  • the device model, system, App version and other technical parameters;
  • a pseudonymous hash of selected technical device parameters;
  • anomaly flags, the classification result, the validation history and reports concerning fair play.

The pseudonymous device identifier serves security, incident correlation and abuse prevention only. We do not use it for advertising or for tracking the user in other apps.

The system may automatically flag a Session for review, withhold the award of a result or reject a Session that does not meet the technical rules. A permanent block or Account deletion for abuse is not imposed solely on the basis of automated classification. The user can ask for a review at contact@districts.pl. We do not disclose exact detection thresholds where that would weaken our safeguards.

4.7. Data visible to other players

Depending on the features available, other players may see the nickname, avatar, colour, selected profile elements, level, achievements, statistics, leaderboard position, the geometry of captured Territories, part of the gameplay history, social relations and content published publicly or sent to a specific recipient.

We do not share with other players the raw sequence of GPS points, the precise current position, the email address, weight, HealthKit data or anti-cheat signals. The shape of a Territory, the approximate date of activity and results may nevertheless allow conclusions about the area where a user spends time. Please consider this risk before starting a Session near your home, school or another sensitive place.

4.8. Messages, user content and support

Within social features, private messages and support we may process the identifiers and nicknames of the sender and the recipient, the message content, the time and status of the message, information about following, blocking, reporting and moderation, the category and description of a problem, the platform, App version, an optional Session identifier, email correspondence and an existing photo or video file voluntarily chosen by the user and attached to a report. In this feature Districts does not record audio, photos or video and does not access the microphone or the camera.

Attachments to reports are optional. They are stored in a private Supabase Storage bucket. With the report we store an internal reference to the object, not a public file address. Access is available to the owner of the attachment and to an authorised support administrator under the Storage access rules. When a file is opened, a signed URL is created that expires after 10 minutes. Attachments are not published in the App and are not indexed as part of a profile. When an Account is deleted, the App first removes all attachments belonging to the user; if Storage does not confirm the deletion, the Account deletion is not finalised. Please do not send identity documents, financial data, health data, nude images or unnecessary third party data.

4.9. Website data

When you use the Website we may process the IP address, the date and time of the request, browser type, operating system, the requested subpage, the referring page, basic security logs and error information.

The Website is delivered by Cloudflare Pages. The legal subpages use system fonts or files served from the same domain and do not download fonts from Google Fonts. Without consent the Website does not use optional analytics or advertising cookies. After consent given in the banner on the Website, the Meta pixel described in section 8 is active.

5. What we do not collect and what we do not do with data

As of the effective date of this Policy:

  • we do not require the user's first name and surname, home address, phone number, gender, nationality, education or professional information;
  • we do not access the address book, calendar, microphone, camera or advertising identifier;
  • we do not access Health Connect or Google Fit on Android;
  • we do not capture photos or recordings without action by the user;
  • we include no paid purchases and no ads;
  • we do not sell data and do not share it with data brokers; we do not use App data for behavioural advertising, and we pass Website data for advertising on Meta services only with consent (section 8);
  • in the App we do not use Google Analytics, Firebase Analytics, ad networks, AppsFlyer or Adjust, and Firebase Cloud Messaging is used solely to deliver notifications on Android; on the Website the Meta pixel runs only with consent (section 8).

We may use effectively anonymised and aggregated data for statistics, security, research and product development. Anonymous data does not allow the identification of a specific person and is not personal data.

6. Purposes and legal bases

We process data for the following purposes and on the following bases:

  • creating and running an Account, signing in, providing the game, recording Sessions, calculating Territories and results, leaderboards, the profile, messages and support: Article 6(1)(b) GDPR, that is performance of a contract or steps taken at the user's request before entering into it;
  • voluntarily provided weight, HealthKit data and motion data that constitutes health data: Article 6(1)(a) and Article 9(2)(a) GDPR, that is consent and explicit consent of the user; if, after withdrawal, limited retention is necessary for the establishment, exercise or defence of legal claims, the basis is Article 6(1)(f) and Article 9(2)(f) GDPR;
  • anti-cheat, Account security, fraud prevention, moderation, investigation of breaches and protection of infrastructure: Article 6(1)(f) GDPR, that is the legitimate interest of the Controller and of fair players;
  • Sentry diagnostics, security and improving the stability of the App: Article 6(1)(f) GDPR, that is the legitimate interest in detecting crashes, fixing errors and protecting the service;
  • delivery of the fonts used in the App by Google Fonts: Article 6(1)(f) GDPR, that is the legitimate interest in ensuring the correct and consistent display of the interface;
  • notifications related to the Account and gameplay: Article 6(1)(b) GDPR; the technical ability to deliver them depends on the user's system permission;
  • handling requests, complaints, disputes and the defence of claims: Article 6(1)(b), (c) or (f) GDPR, depending on the nature of the matter;
  • compliance with legal obligations and requests from authorised bodies: Article 6(1)(c) GDPR;
  • measuring the effectiveness of Districts ads on Meta services (Facebook, Instagram) and showing ads to people who visited the Website, using the Meta pixel: Article 6(1)(a) GDPR, that is consent given in the banner on the Website; storing information in the browser and accessing it take place with consent, in line with the Polish Electronic Communications Law;
  • delivering and protecting the Website: Article 6(1)(f) GDPR, that is the legitimate interest in providing information and protecting against abuse.

Where the law requires consent for a given operation, processing on that basis starts after a knowing action by the user. Consent can be withdrawn at any time without affecting the lawfulness of earlier processing.

7. Device permissions

The App may ask for the following permissions:

  • precise location: needed to record a Session and to calculate the route and the Territory;
  • location with the screen off on iOS: needed to continue a started Session after the App moves to the background;
  • foreground service on Android: keeps a started Session running with the screen off and shows a persistent notification; this is not the ACCESS_BACKGROUND_LOCATION permission;
  • motion and fitness on iOS: needed for the system pedometer and motion type recognition;
  • Apple HealthKit on iOS: optional reading of the step count for the period of a Session;
  • notifications: optional information about the Account and game events;
  • system photo and video picker: used only after an action by the user in order to attach an existing photo or video file to a report; in this feature Districts does not record new material and does not access the microphone or the camera.

Permissions can be managed in the device settings. Withdrawing a permission stops future access to the extent controlled by the system, but it does not delete data previously sent to Districts. Uninstalling the App does not delete the Account.

8. Cookies, local storage and similar technologies

The App uses the device's local storage and the secure system store in order to maintain the sign-in session and to remember settings, technical consents and feature state. Data stored solely on the device is not transferred to the Controller until the App sends it in connection with a given feature.

Sentry uses SDK technology for diagnostics and security to the extent described in this Policy. The App may also use a local cache of fonts downloaded from Google Fonts. We do not use these technologies for advertising or for tracking activity outside Districts.

The Website stores in the browser information needed for features the user uses: the districts_jezyk cookie with the selected Website language (up to 12 months) and, after opening an invitation link, the districts_polecenie cookie with the invitation code (up to 30 days), needed to assign the invitation after the App is installed. The choice about the Meta pixel is saved in the browser’s local storage under the districts_zgoda key for 12 months. These technologies do not require consent.

We use the Meta pixel on the Website only with consent. On the first visit the Website shows a banner with two equal buttons, “Accept” and “Reject”. Until a choice is made and after a refusal, the pixel is not loaded and the Website does not connect to Meta. After consent the browser downloads the Meta script, which stores the _fbp cookie (up to 90 days) and passes to Meta Platforms Ireland Limited information about the visit: the address of the visited subpage, the referring page, the IP address, browser and device data, and Meta cookie identifiers. If the user is signed in to Facebook or Instagram in that browser, Meta may link the visit to the user’s account on those services. This information is used to measure the effectiveness of Districts ads and to show ads to people who visited the Website.

For the collection of data on the Website and its transmission to Meta, the Controller and Meta Platforms Ireland Limited are joint controllers within the meaning of Article 26 GDPR, under the controller addendum that is part of the Meta Business Tools terms. Further processing is carried out by Meta as a separate controller under its privacy policy, available at https://www.facebook.com/privacy/policy. The rights described in section 14 can be exercised against the Controller or directly against Meta.

Consent can be changed or withdrawn at any time with the “Cookie settings” button in the Website footer. After consent is withdrawn the pixel stops working and Meta cookies stored on the Website’s domain are deleted. Withdrawal does not affect the lawfulness of processing carried out before it.

9. Where we get data from

We receive data directly from the user, automatically from the device and the App, from Apple HealthKit on iOS once permission is granted, from Apple or Google in relation to signing in, from other users in connection with messages or reports, and from technical providers in the form of delivery statuses, error reports and security information.

If a user provides data about another person, they should have an appropriate basis for doing so and should not provide more data than necessary.

10. Data recipients

Access to data is limited to authorised people and to providers needed to deliver, secure and develop Districts. In the current version these are in particular:

  • Supabase Inc.: authentication, database, backend functions and Supabase Storage; the primary production data region is eu-central-1 in Frankfurt, Germany, in the European Union;
  • Mapbox Inc.: the map, map tiles, place search or description, routing, and the technical and location data necessary for these features;
  • Apple Inc.: Sign in with Apple, HealthKit, motion services, the Apple Push Notification service and distribution of the App on iOS;
  • Google LLC: Sign in with Google, Firebase Cloud Messaging, Google Play and delivery of some of the fonts used in the App through Google Fonts; the current version of the App does not send data to Health Connect or Google Fit, and the legal subpages do not download fonts from Google Fonts;
  • Functional Software Inc., the operator of Sentry: diagnostics of errors and stability in the European environment;
  • Resend Inc.: sending emails and limited alerts about new support reports; an alert may contain the user and report identifier, the category, platform, App version, Session identifier, date and up to 200 characters of the description, but it does not contain attachments, full diagnostics or the GPS route;
  • Cloudflare Inc.: DNS, traffic protection, content delivery network and hosting of the static Websites on Cloudflare Pages;
  • Meta Platforms Ireland Limited, Ireland: the Meta pixel on the Website, activated only with consent (section 8); for this purpose Meta is a joint controller, and for further processing a separate controller;
  • legal advisers, auditors and other professional advisers, where access is needed to handle a specific matter and is covered by a duty of confidentiality;
  • public authorities and other entities, where disclosure follows from the law or is necessary for the establishment, exercise or defence of legal claims.

Depending on the service, a provider acts as a processor on the Controller's instructions or as a separate controller under its own terms and policy.

11. Transfers of data outside the European Economic Area

The primary Districts database and authentication are maintained in the European Union. Some providers have their seat, infrastructure or subprocessors outside the European Economic Area, so in certain situations data may be accessible outside the EEA.

Where a transfer outside the EEA takes place, the appropriate basis from Chapter V of the GDPR is applied, depending on the recipient: an adequacy decision of the European Commission, the recipient's participation in the EU to US Data Privacy Framework, standard contractual clauses or another legally permitted safeguard. Information about the safeguards is available at contact@districts.pl.

Data collected by the Meta pixel with consent may be transferred to Meta Platforms, Inc. in the United States, which participates in the EU to US Data Privacy Framework.

12. How long we keep data

We apply the following retention periods or criteria:

  • Account and profile: for as long as the Account exists, and afterwards only to the limited extent required by law, needed to document the deletion or needed for the establishment, exercise or defence of legal claims;
  • raw GPS samples: samples relating to finished, rejected or expired Sessions are deleted after 30 days in the next run of the cleanup job; samples of Sessions that require recovery, manual assessment or a technical decision, and orphaned samples, are deleted no later than after 60 days;
  • Territories, results, achievements and game state: for the lifetime of the Account; after its deletion they are deleted or irreversibly anonymised to the extent needed to preserve the integrity of the shared map, the leaderboards and the game history;
  • weight, step count, calories and motion data: until the user deletes the data, withdraws consent or deletes the Account. After consent is withdrawn we stop new readings. Health data processed solely on the basis of consent is deleted or irreversibly anonymised without undue delay. Anti-cheat records may retain, for the period indicated below, only technical signals that do not constitute health data, irreversibly anonymised data, or limited data whose retention is necessary for the establishment, exercise or defence of legal claims under Article 9(2)(f) GDPR;
  • anti-cheat records: detailed fields containing location samples, device parameters and additional control data are anonymised after 90 days, and the whole record is deleted after 365 days; data relating to a specific dispute or a serious abuse may be kept longer until the matter is resolved and the relevant limitation period for claims expires;
  • push tokens: until notifications are switched off, the token is invalidated or the Account is deleted;
  • messages and social relations: for as long as the feature is used or the Account exists; reported content may be kept until moderation is complete and for the period needed to protect users or claims;
  • support reports and attachments: for the time needed to handle the matter, and afterwards for the period needed to handle a repeat report, for security and for the defence of claims; when an Account is deleted, the attachments belonging to the user are removed from Storage before the operation is finalised;
  • Sentry: for the period configured with the provider and no longer than is needed for diagnostics, security and incident handling;
  • Website data and infrastructure logs: for the period needed to deliver the Website, to protect against abuse and for diagnostics, in line with the provider's retention cycle;
  • Meta pixel: the banner choice for 12 months in the browser’s local storage; the _fbp cookie for up to 90 days; data passed to Meta for the period stated in Meta’s privacy policy;
  • legal and complaint correspondence: for the time needed to handle the matter and until the relevant limitation period for claims expires;
  • backups: until the technical backup rotation cycle ends; access to them is restricted, and data deleted from the production system is not restored to ordinary use.

Once the purpose and the basis for processing cease, data is deleted or effectively anonymised.

13. Deleting the Account and data

The Account can be deleted:

  1. in the App through Profile, then Danger zone, then Delete account;
  2. outside the App through https://districts.pl/en/delete-account, which lets you initiate the request by email;
  3. directly by a message to contact@districts.pl sent from the address linked to the Account or containing information sufficient to verify the request safely.

Deletion covers the authentication Account, active sign-in sessions, the profile, push tokens, raw routes, private attachments to reports and other data for which no further basis exists. Part of the gameplay history, the shared map or a conversation may be irreversibly anonymised instead of being physically deleted, if that is needed to preserve the integrity of the service or the rights of other people.

Reported content, evidence of abuse, correspondence and minimal information about the completion of a request may be retained where required by law, by the protection of other people or by the defence of claims. Data in backups disappears according to the rotation cycle and is not restored to ordinary use.

An operation performed in the App removes the basic Account data from the active system and signs the user out. Requests made outside the App are handled without undue delay, as a rule within one month of receipt and successful verification, with the possibility of an extension in the cases provided for by the GDPR.

14. User rights

Within the limits set by the GDPR, the user has the right of access and to a copy, to rectification, to erasure, to restriction of processing, to data portability, to object, to withdraw consent, to human intervention in the cases set out in Article 22 GDPR, and to lodge a complaint with the President of the Personal Data Protection Office (UODO).

Requests can be sent to contact@districts.pl. We may ask for information needed to confirm identity, but we will not require more data than necessary. We reply without undue delay, as a rule within one month, with the possibility of an extension in the cases set out in the GDPR.

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych): ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland, https://uodo.gov.pl.

15. Right to object

Where data is processed on the basis of a legitimate interest, the user may object at any time on grounds relating to their particular situation. This applies in particular to Sentry diagnostics, anti-cheat, security, moderation and the defence of claims.

After receiving an objection we will stop processing the data for that purpose, unless we demonstrate compelling legitimate grounds which override the rights and freedoms of the user, or the data is needed for the establishment, exercise or defence of legal claims. An objection can be sent to contact@districts.pl.

16. Automated decision making

Districts automatically calculates Territories, points, leaderboards, Session results and risk signals. It may automatically reject a Session that does not meet the technical rules or withhold a result for verification. These operations are part of delivering the service and protecting fair play; they do not produce legal effects or similarly significant effects within the meaning of Article 22 GDPR.

A serious sanction concerning an Account, in particular a permanent block or deletion for abuse, is not imposed solely on the basis of automated classification. The user can ask for a review and present their position at contact@districts.pl.

17. People under 16

Districts is intended solely for people aged 16 and over. We do not intend to knowingly process the data of younger people.

People aged 16 and 17 have limited legal capacity in Poland. If the applicable law requires the consent of a legal guardian in order to conclude or perform a specific contract, the user should obtain it before accepting the Terms.

If we learn that an Account belongs to a person under 16, we may suspend it, ask for an explanation or delete the Account and the data, unless there is a basis for temporarily keeping a minimum scope. A parent or guardian can report such a situation at contact@districts.pl.

18. Data security

We apply measures matched to the risk, in particular encryption of transmission, access control, separation of public and private data, row level access rules in the database, limitation of administrative privileges, pseudonymisation of selected identifiers, logging of security events, data retention and an Account deletion procedure.

No system guarantees complete security. Users should protect their device and Account and should not share passwords, codes, tokens or temporary attachment links with other people.

19. External services and separate privacy rules

Apple, Google, Mapbox and other providers may process certain data as separate controllers, in particular when the user uses external sign-in, an app store, system settings, HealthKit, maps or notifications. Such processing is also subject to the terms and policies of that provider.

Districts is not responsible for independent websites or services that the user opens outside the App, but we select providers with security and the scope of data needed for a feature in mind.

20. Changes to the Policy

The current version of the Policy is available in the App and on the Website at https://districts.pl/privacy. We will give appropriate advance notice of changes that are material to user rights or to the way data is processed, in the App, by email or through another effective channel.

If a change requires new consent, we will ask for it before starting the processing covered by that consent. The effective date is given at the beginning of the document.

The change of 12 October 2026 concerns the Website: the Meta pixel activated only with consent and a description of the necessary cookies (sections 4.9, 5, 6, 8, 10, 11 and 12).

21. Contact

Questions, requests, objections, withdrawal of consent and appeals concerning personal data should be sent to contact@districts.pl or to the Controller's correspondence address given in section 2.

Back to the home page