SuperCitycon Privacy Policy

Last updated: 7 October 2026

This privacy policy applies to SuperCitycon by Sunapie Games LLC. It does not apply to the earlier mobile game SuperCitycon Free to Play by Ben Willes Games S.L., which has its own privacy policy.

This policy explains what personal data SuperCitycon (“the game”) processes, why, who receives it, and what rights you have. We have tried to write it so that it matches exactly what the game does — no more and no less.

1. Who is responsible

Sunapie Games LLC 30 N Gould St Ste R
Sheridan, WY 82801-6317
USA
Email: privacy@sunapie.com

Please contact us directly with any question about your data.

Because we are not established in the European Union, EU data protection law requires us to name a representative there. You can also reach us through them:

Representative in the EU (Art. 27 GDPR) Ben Willes Games SL
Calle Santa Lucrecia, 6 - Loc 10
28019 Madrid
Spain
Email: privacy@sunapie.com

Requests sent to our representative are forwarded to us, so writing to us directly is usually the quickest way to get an answer.

2. Summary

The game runs on your computer. Your cities, models, settings and log files are stored locally and are not uploaded by us — unless you send us a bug report yourself (see 3.4).
When the game starts, it signs you in to Unity Gaming Services with your Steam account. This gives you a player ID that online features (username, multiplayer) use.
The game checks with our servers whether this version is still supported. The demo needs an internet connection for this (see 3.5).
When the game crashes or hits a serious error, it sends a crash report to Sentry. You can switch this off in the settings.
The demo asks whether it may send anonymous statistics about how the demo is played. It sends them only if you say yes, and nothing in them points to you (see 3.10).
We do not sell your data, do not show advertising, and do not build profiles about you.

3. What we process, and why

3.1 Sign-in with Unity Gaming Services

What happens: Each time the game starts and an internet connection is available, it signs you in to Unity Gaming Services (UGS), a service of Unity Technologies. To do so, it obtains a sign-in ticket from Steam and passes it to Unity. Unity uses it to confirm your Steam account and assigns you a pseudonymous player ID. The sign-in is automatic and is not tied to a separate consent.

Data: your Steam account ID (via the ticket), the Unity player ID, your IP address, and — if you choose one — your username. Unity’s Cloud Save stores two entries for your player ID: whether your account is registered, and your username.

Why: the player ID is the identity that online features rely on: claiming a unique username, multiplayer sessions, and marking the models you build as yours.

Legal basis: Art. 6(1)(b) GDPR (providing the game’s online features) and Art. 6(1)(f) GDPR (our legitimate interest in a stable, secure player identity).

Recipient: Unity Technologies (processor on our behalf). Unity runs these services on Google Cloud and processes the data in several countries, including the United States. Transfers outside the EU are covered by the EU Standard Contractual Clauses in Unity’s Data Processing Addendum.

3.2 Username

On the first start the game asks you to choose a username. As a suggestion it fills in your Steam profile name (adjusted to the username rules) and says so; you can accept it, change it or ask for a different suggestion. Your Steam profile name only becomes your username if you confirm it.

The username is stored by Unity (see 3.1) and is visible to other players: it is saved as the creator name in the models, cities and collections you make, and shown in multiplayer sessions. Other players’ games can look up the username that belongs to a player ID. If you have not chosen one yet, a name generated by Unity (such as “Name#1234”) is used instead.

3.3 Crash reports (Sentry)

The game reports crashes and serious errors to Sentry, a crash-reporting service operated by Functional Software, Inc. (“Sentry”), using Sentry’s data centre in Germany. There are three settings, which you can change at any time under Settings:

Crash reports on (default). This runs from the first start, before you are asked anything, because a crash during start-up would otherwise never be reported. A report contains:

the error message and the program location where it occurred (stack trace), and recent error messages leading up to it;
the game version and build type;
technical information about your computer: operating system and version, device model, processor, memory size, graphics card model and driver, screen resolution, graphics quality level, system language and time zone;
the game screen you were on (for example “in game” or “main menu”).

A report contains no player ID, no name of your computer and no identifier that would link several reports to you. File paths in error messages are shortened so that your operating-system user name is not included; error messages can still contain names you gave to cities or models. Your IP address is needed to deliver the report but is not stored.

Crash reports on, including player ID and log. Only if you agree when asked at first start (or later in the settings). In addition to the above, reports include your Unity player ID and the most recent part of the game’s log file for the current session (at most five log files per session). The log is free text written by the game and can contain file paths and names you gave to cities, models or collections.

Crash reports off. Nothing is sent to Sentry. The change takes effect the next time you start the game.

Why: To find and fix bugs.
Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a working game) for the default setting; Art. 6(1)(a) GDPR (your consent) for the player ID and log. You can withdraw consent at any time in the settings; for the player ID and log this takes effect immediately.
Recipient: Sentry (processor on our behalf). Crash reports are stored in Sentry’s data centre in Germany. Sentry may access them from the United States, for example for support; this is covered by Sentry’s certification under the EU-U.S. Data Privacy Framework and by the EU Standard Contractual Clauses in its Data Processing Addendum.
Retention: Up to 90 days, then deleted automatically.

3.4 Bug reports you send

In the game you can report a problem to us yourself (the “Report a problem” button). You can mark places in your city and add comments. Nothing is sent until you press Send; before that, the game shows you what the report will contain.

A bug report contains:

your comments and the places you marked, each with a screenshot of the game view and the camera position, and the moments you noted (“what I was just trying to do” — these are also written into the game’s log file on your computer the moment you note them);
pictures of the whole game screen including the interface, taken when you open the report and for each moment you note, with the camera position at that time;
the city you had open: its name, its save data, its build history (the list of building steps you made) and the models it uses, together with the player IDs and names of their creators — this can include models made by other players;
the most recent part of the game’s log files from the current and the previous session. The log is free text written by the game and can contain names you gave to cities, models or collections; file paths are shortened so that your operating-system user name is not included;
the game’s settings (for example graphics quality and language), the game version and technical information about your computer: operating system, graphics card class, screen resolution;
your Unity player ID, which is needed to send the report and lets us find it again if you ask us to delete it.

If you send a report without an open city, the city part is left out. After sending, the game shows you a report number.

Why: To reproduce and fix the problem you reported.
Legal basis: Art. 6(1)(a) GDPR — your consent, which you give by sending the report. You can withdraw it at any time by asking us to delete the report (see 6); this does not affect processing before that.
Recipient: Supabase, Inc. (processor on our behalf). Reports are stored in Supabase’s data centre in Germany (Frankfurt). Supabase may access them from the United States, for example for support; this is covered by the EU Standard Contractual Clauses in its Data Processing Addendum.
Retention: A report stays on the server only until we download it, and for at most 90 days. We keep the downloaded copy only as long as we need it to fix the problem, then delete it.

3.5 Service checks

When the game starts and while it is running, it contacts the online services named in this policy (Unity, see 3.1; Supabase, see 3.4) to operate the game: for example to find out whether online features are available, whether this version of the game is still supported (an outdated version asks you to update, and the demo needs this check to start), and to keep those services running.

These checks transmit only technical data: your IP address, the game version and build type (for example demo or full game), and standard technical request data. They contain no player data, whether or not you ever use an online feature.

Legal basis: Art. 6(1)(f) GDPR (operating the game’s online features and making sure only supported versions run).

3.6 Multiplayer

Multiplayer sessions are private: only players who have the session’s join code can take part. The game uses two Unity services for this, Unity Lobby and Unity Relay.

When you host a session, Unity creates a private lobby with a join code and a relay connection. The lobby exists only while the session is open.

Unity processes your Unity player ID and your IP address to connect you through the relay. The other players do not see your IP address; everything between you and them runs through Unity’s relay servers.

The other players in the session receive:

your Unity player ID, your username and the game version;
if you are the host: your city — its name, its save data and the models it uses, with the player IDs and names of their creators;
while you play together: the position and movement of your character in the city.

We do not store any of this. The data goes from player to player for as long as the session lasts.

The relay server is chosen close to the host, so the connection may run through a data centre outside the EU (same safeguards as in 3.1).

Why: to let you play together. Legal basis: Art. 6(1)(b) GDPR. Recipient: Unity Technologies (processor on our behalf) and the other players in the session.

3.7 Steam

The game is distributed through Steam, operated by Valve Corporation, which is responsible for its own processing (see the Steam Privacy Policy). The game reads your Steam ID, profile name and avatar from the Steam client to show them in the game and to suggest a username (see 3.2); this happens on your computer. Your Steam profile name is never written into your files or sent to other players on its own — only if you confirm it as your username. Save games are copied to a folder that Steam Cloud synchronises across your computers; this is governed by Valve’s terms.

3.8 Data that stays on your computer

Cities, models, collections, settings, your crash-reporting and statistics choices, game statistics and log files are stored only on your computer, unless you include them in a bug report yourself (see 3.4). The one exception is the anonymous demo statistics, if you agree to them (see 3.10). Music you add to the game is played from your computer and is not uploaded. Video export runs locally.

3.9 Unity engine

The game is built with the Unity engine. When the game starts, the engine sends technical information about your device to Unity Technologies — such as operating system, processor, graphics card, screen size and a device identifier — together with your IP address. Unity uses this information under its own responsibility, to improve its engine; see Unity’s Game Player and App User Privacy Policy.

3.10 Anonymous demo statistics (demo only, with your consent)

On the first start, the demo asks whether it may send us anonymous statistics about how the demo is played. Nothing is sent unless you say yes. You can change your answer at any time under Settings; nothing in the game depends on it. If you say no, that answer stays on your computer and is not sent either. On your computer the demo stores only your answer and whether a report has already been sent from it.

If you agree, the demo sends one report per session while you play, which it updates as you go (after each scene and every few minutes). A report contains:

which scenes you started, which steps in them you went through, how long each took and how you left it (for example finished, skipped, or closed);
how long you spent in the menu, in the city and in the studio, and how long loading took;
for the time between scenes, what you did, counted as numbers (for example how many roads or buildings you placed, which game modes you used and how many technical errors occurred);
which demo stations you picked and started;
the frame rate during and between scenes, the game version, the operating system type, the game language, a rough screen size (for example “1080p”), the graphics quality level and a rough graphics card class (for example “mid”);
whether it is the first report ever sent from this computer — the only way to count how many players agreed without being able to tell them apart.

A report contains no player ID, no Steam ID, no name, no city or model names and no time of day; our server keeps only the date a report arrived. Each session gets a new random number that is not stored on your computer, so two reports cannot be linked to each other or to you. Your IP address is needed to deliver the report but is not stored with it (Supabase keeps it only briefly in its technical request logs). Because we cannot tell which report is yours, we cannot show or delete a single report on request; all reports are deleted automatically after 12 months.

Why: To see how far players get in the demo and where they stop, so we know what to improve.
Legal basis: Your consent (Art. 6(1)(a) GDPR, and the corresponding rules for accessing information on your device). You can withdraw it at any time in the settings; the next report is then no longer sent.
Recipient: Supabase, Inc. (processor on our behalf), data centre in Germany (Frankfurt); same safeguards as in 3.4.
Retention: 12 months, then deleted automatically.

4. What we do not do

No advertising, no tracking across other apps or websites, no sale of data, no profiling, no automated decisions with legal effect.

5. How long we keep data

Crash reports: up to 90 days, then deleted automatically by Sentry.
Bug reports: on the server until we download them, at most 90 days; our downloaded copy only until the problem is fixed.
Anonymous demo statistics: 12 months.
Unity player ID, registration flag and username: as long as the account exists; deleted when you delete your account (see 6).
Local data: until you delete it or uninstall the game.

6. Your rights

If the GDPR or UK GDPR applies to you, you have the right to access your data, have it corrected or deleted, restrict or object to processing, receive it in a portable format, and withdraw consent at any time.

Deleting your account: under Settings → Account → Delete Account you can delete your account yourself. This immediately deletes your Unity account, all data stored for it, and releases your username. All SuperCitycon data on your computer (cities, models, collections, screenshots, exported cities, settings, log files and the Steam Cloud copies) is removed the next time you start the game, as if it had just been installed. Crash reports that contain your player ID are deleted automatically when their retention period ends (see 5). The same applies to bug reports you sent; if you want one deleted earlier, email us its report number.

For everything else, email privacy@sunapie.com and include your Unity player ID (shown under Settings → Account). We will answer within one month.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live.

7. Children

SuperCitycon is not directed at children under 13, and we do not knowingly collect personal data from them. If you are under 16 (or the age of digital consent in your country), please ask a parent before choosing to include your player ID and log in crash reports, or before sending a bug report.

8. Changes

We will update this policy when the game changes how it handles data. The current version is always available on this page and from the game’s settings (Settings → Account).