Select Language

English

My Account

With Friends

Cookie Policy

Last updated: 10 August 2026

This Cookie Policy explains how City Code uses cookies and similar technologies on the website at citycodegame.com, the game platform at game.citycodegame.com, and other webpages or online interfaces operated as part of the City Code service (together, the “Service”).

This Cookie Policy should be read together with our Privacy Policy.

1. Who we are

The Service is operated and distributed by:

TheAI Ltd
DIFCA Licence Number: 12561
Tax Registration Number: 105345863200001
Registered address: Innovation One, IH-00-01-03-OF-05, DIFC, Dubai, United Arab Emirates
Telephone: +971 52 626 6400
Email: contact@theai.com

For purposes of this Cookie Policy, “City Code”, “we”, “us” and “our” refer to TheAI Ltd.

2. What cookies and similar technologies are

Cookies are small files or pieces of information stored on or accessed from your browser or device when you visit a website or use an online service.

We may also use technologies that perform similar functions, including:

local storage;
session storage;
pixels;
tags;
scripts;
browser or device identifiers;
authentication and security tokens;
software development kits or similar technologies where applicable.

These technologies may store information on your device, retrieve information from it or allow information about your interaction with the Service to be processed.

In this Cookie Policy, we use the term “cookies” to refer collectively to cookies and similar technologies unless the context requires otherwise.

3. Why we use cookies

We may use cookies to:

operate the website and game platform;
authenticate Users and maintain secure login sessions;
provide access to purchased or assigned Cases;
maintain active game sessions and progress;
remember language and interface preferences;
identify User roles and permissions;
remember cookie consent choices;
protect the Service against fraud, abuse and unauthorised access;
maintain security and availability;
enable and secure checkout and payment functionality;
diagnose technical problems;
understand how the Service is used;
analyse performance;
improve the Service;
measure advertising and marketing performance;
support advertising or audience measurement where you have provided the required consent.

Cookies that are strictly necessary to provide a service requested by you, maintain security, complete a transaction or remember your privacy choices may be used without consent where permitted by applicable law.

Analytics, advertising and other non-essential cookies will be activated only where the required consent has been obtained.

4. Categories of cookies

4.1 Strictly necessary cookies and technologies

These technologies are required to operate, secure or provide functions of the Service requested by you.

They may include the following.

Authentication and session technologies

Purpose: to authenticate Users, maintain secure login sessions and provide access to accounts and the game platform.

Duration: normally for the session, until logout or until the relevant security token expires.

Persistent authentication technologies

Purpose: where enabled, to maintain secure login between sessions.

Duration: until logout, revocation or expiry under the applicable security settings.

User role and permission technologies

Purpose: to identify applicable roles and permissions and provide the corresponding functionality.

Duration: normally for the session or until the User's permissions change.

Game session storage

Purpose: to maintain information necessary for the current Case, team, game session or progress and to provide or restore gameplay functionality.

Duration: for the session or for the period reasonably necessary to provide or restore the relevant game session.

Language and locale preferences

Purpose: to remember a language, locale or other interface setting selected by the User.

Duration: until changed, deleted or expired.

Cookie consent preference

Purpose: to record whether you accepted, rejected or configured non-essential cookies and to avoid repeatedly asking for the same choice.

Duration: for a limited period appropriate to the applicable consent framework, after which we may ask you to renew your choice.

Security and infrastructure technologies

Purpose: to protect the Service, prevent abuse, route traffic, balance requests, detect technical incidents and maintain availability.

Providers may include City Code and providers of hosting, infrastructure, content delivery, security and anti-abuse services.

Duration: normally for the session or for another limited period required for security and operation.

Checkout and payment security technologies

Purpose: to initiate and maintain a checkout session, authenticate transactions, prevent fraud, secure payments and enable the payment method selected by the User.

These technologies may be provided by the Payment Provider involved in the relevant transaction.

Duration: for the checkout session or for another period determined by the applicable Payment Provider.

Strictly necessary technologies are not normally disabled through our cookie settings because doing so may prevent requested parts of the Service from functioning correctly.

5. Functional cookies

Functional cookies may remember choices or enable optional functionality intended to improve your experience.

These may include:

Interface preferences

Purpose: to remember settings such as language, display, accessibility or navigation preferences.

Game and platform preferences

Purpose: to remember optional settings relating to the game platform or User experience.

Where such functionality is strictly necessary to provide a feature expressly requested by you, consent may not be required where permitted by law.

Otherwise, functional cookies will only be activated after the required consent has been obtained.

6. Analytics cookies

We may use analytics technologies to understand how visitors interact with the Service.

They may help us:

measure visits;
understand which pages and features are used;
measure interactions and events;
detect technical problems;
understand general device and browser characteristics;
evaluate changes to the Service;
improve usability and performance.

Where required by applicable law, analytics technologies are activated only after you provide consent.

Google Analytics

Where enabled, we may use Google Analytics to measure and analyse use of the Service.

Google Analytics may process information such as:

pages visited;
interactions and events;
approximate geographic information;
device type;
browser information;
online identifiers;
general usage patterns.

The specific cookies, identifiers and retention periods used depend on our current Google Analytics configuration and Google's applicable technology.

Google Tag Manager

Where enabled, we may use Google Tag Manager to manage tags and technologies used by the Service.

Google Tag Manager is used to control the deployment of other technologies and should not be configured to activate analytics or advertising technologies requiring consent before the relevant consent has been obtained.

7. Advertising and marketing technologies

Where enabled and where you have provided the required consent, we may use advertising and marketing technologies to:

measure advertising campaigns;
measure conversions;
determine whether a visit followed interaction with an advertisement;
create campaign reports;
perform audience measurement;
limit or optimise advertising;
support relevant or personalised advertising where permitted.

Meta Pixel

Where enabled, we may use Meta Pixel or related technologies provided by Meta Platforms.

These technologies may be used to measure website activity, conversions and advertising performance and may support audience measurement or advertising personalisation.

Depending on the configuration, technologies associated with Meta may include browser or device identifiers such as _fbp or successor technologies.

Advertising technologies will not be intentionally activated for Users requiring consent until the relevant consent has been obtained.

8. Payment Provider technologies

We may use different third-party providers to process or facilitate payments.

For purposes of this Cookie Policy, “Payment Provider” may include:

a payment processor;
payment service provider;
payment facilitator;
acquiring provider;
payment orchestration provider;
reseller;
Merchant of Record;
another provider involved in processing or securing a transaction.

The Payment Provider applicable to a particular transaction may be identified during checkout, in the payment interface, order confirmation, receipt or invoice.

Depending on the payment arrangement, payment-related technologies may operate:

when you are redirected to an external checkout;
through an embedded checkout;
through a payment form;
through scripts needed to initiate or secure a payment;
through fraud-prevention or authentication technologies.

Payment Providers may use technologies for purposes including:

payment processing;
transaction authentication;
fraud prevention;
security;
tax calculation;
regulatory compliance;
invoicing;
refunds;
chargebacks and disputes.

Where a Payment Provider acts independently as Merchant of Record or otherwise determines the purposes and means of its own processing, its own privacy notice and cookie information will apply to that processing.

Where a Payment Provider acts as a processor or technical service provider for us, its processing will be governed by the applicable contractual and legal arrangements.

9. Third-party technologies

Some technologies used through the Service may be provided or controlled by third parties.

These may include providers of:

payments;
hosting and cloud infrastructure;
content delivery;
cybersecurity and fraud prevention;
analytics;
advertising;
consent management;
communications;
embedded content;
other technology services.

Depending on their role, third parties may process information collected through their technologies under our instructions or for their own purposes.

Where an independent third party sets cookies or accesses information through its own website, checkout or service, its own privacy and cookie information may apply.

10. Consent and cookie choices

When required by applicable law, non-essential cookies will not be activated until you have provided the necessary consent.

Our cookie consent interface may allow you to:

Accept all non-essential cookies;
Reject all non-essential cookies;
configure cookies by category.

Refusing non-essential cookies will not prevent you from using the core functionality of the Service, although certain optional functionality may be unavailable.

Not responding to the cookie banner, closing it or simply continuing to browse will not be treated as consent where affirmative consent is required.

You can change or withdraw your consent at any time through the Cookie Settings control made available through the Service.

Withdrawal of consent will apply to future use of the relevant technologies and does not affect processing that was lawful before the withdrawal.

Where technically possible, withdrawing consent will prevent relevant non-essential technologies from being read or activated in the future. Existing information stored on your device may remain until it expires or is removed through your browser or device settings.

Valid consent under GDPR must be freely given, specific, informed and unambiguous, and EDPB guidance requires a genuine affirmative choice rather than inactivity or pre-selected options.

11. Remembering your choice

We may store your cookie preference so that you do not need to make the same selection each time you visit the Service.

Your preference may be requested again where:

the applicable preference period expires;
relevant laws or regulatory requirements change;
our cookie practices materially change;
new purposes requiring consent are introduced;
technical circumstances make it necessary to obtain a new choice.

For Users subject to jurisdictions where shorter consent-refresh periods are appropriate, we may configure the consent management system accordingly.

As a conservative EU implementation, keeping acceptance and refusal choices for approximately six months is consistent with current CNIL guidance; CNIL also requires withdrawal to remain easily accessible.

12. Browser and device controls

You may also manage cookies and stored information through your browser or device.

Depending on your browser, you may be able to:

block cookies;
delete existing cookies;
block third-party cookies;
restrict local storage;
configure privacy settings.

Browser controls are separate from our consent management system.

Blocking strictly necessary technologies may cause parts of the Service to stop working correctly. For example, you may:

be logged out;
lose an active session;
need to reselect preferences;
be unable to access a Case;
be unable to complete checkout;
need to restart an authentication or payment process.

Browser settings alone should not be relied upon as the mechanism for collecting consent where affirmative consent is legally required. ICO guidance likewise states that non-essential cookies cannot simply be set before consent and that users need meaningful controls over them.

13. International data transfers

Information collected through cookies and similar technologies may be processed in countries other than the country in which you are located.

Depending on the technology and provider involved, this may include processing in:

the United Arab Emirates;
countries in which our service providers operate;
other jurisdictions necessary to provide the Service.

Where personal data is transferred internationally and we are responsible for the transfer, we will use an appropriate legal basis or transfer safeguard where required by applicable data protection law.

Depending on the applicable regime, these may include:

an adequacy decision;
Standard Contractual Clauses;
another legally recognised transfer mechanism;
supplementary technical or organisational safeguards where appropriate.

Where an independent third party determines its own international transfers, its own privacy and transfer arrangements apply.

Further information is provided in our Privacy Policy.

14. Current cookie information

The specific cookies and technologies used by the Service may change as the website, game platform and third-party integrations evolve.

The Cookie Settings interface should provide the current information available about active non-essential technologies, including where applicable:

cookie or technology name;
provider;
purpose;
category;
duration.

A technology described in this Cookie Policy is not necessarily activated during every visit.

For example, payment technologies may only operate when you access checkout, and advertising or analytics technologies may only operate when enabled and after the necessary consent has been obtained.

15. Changes to this Cookie Policy

We may update this Cookie Policy where, for example: