Meet the heroes

Four students from the same school, four different phones. Choose a character and hear their story.

⏱ Short format: 1 mission + discussion ≈ 20 min · Full game ≈ 1 lesson (45 min)

·

ℹ️ Educational simulation: the apps, permission requests and situations are made up. The game doesn’t connect to real accounts, doesn’t change anything on your phone and doesn’t promote any real apps.

← All games
Digital Safety Lab

Permission City

Who else has your key? Investigate the apps and decide: keep their access, limit it or revoke it.

Points0 Level

Phone connection map

Packets show what data the apps can reach right now.
Drag – rotate · Tap an app – select it

Teacher’s guide

What does this game help students understand?

For young people aged 14–19 (suitable from age 12). Duration: from 20 min (one mission) to about one lesson (the full game). Goals: tell account connections apart from device permissions; link a permission to a specific feature; recognise risk signals; understand that revoking access doesn’t delete data that has already been shared.

Characters and archetypes

CharacterArchetypeWhat they explore in this game
EmaDouble-life influencer (“online” and real life)AI filters, a gallery with real photos, brand platforms, follower analytics
KristyStatus queen“VIP” offers, luring in contacts, coupon extensions, impulse buying
LukasPositive creatorAI as a creative tool, protecting creative work, posts in his name
AdamQuiet sceptic“Free” tools, VPNs, checking sources, quizzes that spread in your name

How the game works

  1. For each app, the student decides what to do (keep, limit, revoke) and chooses why. An optional bonus question asks whether it’s a device permission or an account connection (with the hint “How can you tell?”). Younger or less prepared participants can skip it.
  2. Answers are only assessed when the student clicks “Check mission”. Points are awarded for the first attempt; corrected answers get half the points.
  3. Surprises: a permission request pops up in the middle of a mission, and after the check comes a “One month later…” event whose outcome depends on the student’s decision.
  4. The reason options are designed so that one is accurate, another is a myth or an overly broad generalisation (“right decision, but inaccurate reason”), and the third would lead to a different decision.
  5. At the end there’s a 5-question final challenge and a challenge badge showing the level, stars and skills shown in the game (saved as a PNG or printed). The badge can be saved several times; it reflects the current result and isn’t an official certificate.
  6. Improving: any mission or the final challenge can be replayed (from the report or the “Skills” section). The latest attempt counts, so skills can be shown without restarting the whole game. If answers are changed in a mission that’s already completed (e.g. by answering the bonus questions), the “Check changes” button assesses them.

Duration

  • Short activity (≈ 20 min): introduction (3 min), one mission in pairs (8–10 min), discussion (7 min).
  • Full activity (≈ 45 min, one lesson): introduction, four missions of 6–8 min each, final challenge (3 min) and discussion. For slower groups, leave the option to continue in the next lesson – progress is saved in the browser.

Skills shown in the game

Clearing unused access · Data minimisation · Keeping features working · Account or device · Justifying decisions · Spotting risk signals · Revoking ≠ deleting. A skill is marked as shown when all its tasks are done and at least 80% of the answers are correct on the first try. This is a game indicator, not proof of competence: the most meaningful evidence is the student’s ability to explain a new situation in the discussion.

Suggested lesson plan

  1. Before the game (3 min): does using an app automatically justify all of its permissions?
  2. In pairs (20 min): one or two missions each. One student reads the situation, the other suggests a decision. Swap roles after each mission.
  3. Discussion (7 min): compare the “One month later…” events – why did different things happen to different pairs?
  4. Transfer: choose one of your own apps and explain what permissions it has and what you would change. This can be done without actually changing anything. Only change settings on a shared device, or one managed by the school or parents, after agreeing with the responsible adult. Don’t share screenshots of real accounts.

For discussion

  • When is “limiting” not enough, even though it’s an option (Ema and Sleuthy, Adam and the VPN)?
  • Which useful feature would you lose if you revoked everything?
  • Kristy or Ema – which of them is more affected by pressure to give away data for “VIP” status or followers?
  • What would you do to make a service delete data it has already received?

Notes for teachers

  • The “right” answer is the one that’s well-founded in this situation. If a student convincingly justifies a different decision, that’s a good starting point for discussion, not a mistake to be corrected.
  • Archetypes, not stereotypes. The characters are based on the project’s archetypes (influencer, status, creator, sceptic). Discuss how anyone can make risky decisions, regardless of gender or interests: in the game, even sceptical Adam makes a mistake (the VPN), while Kristy makes some decisions responsibly (approving payments).
  • Shared computers. Progress is saved in the browser. In class, before another student sits down, click “New player” on the start screen or “Clear progress” in the footer.
  • Analytics. The game also works if analytics is declined. If participants are under 14, it’s recommended to decline analytics or get parental consent.
  • Link to DigComp 2.2: 4.2 “Protecting personal data and privacy”, 4.1 “Protecting devices”, 2.6 “Managing digital identity”.

Limits of the model

This is an educational simulation: it imitates app permissions, account connections and permission requests, unrelated to managing real accounts or real consent. All the apps, their names and the situations are made up; any resemblance to real apps or their permissions is coincidental. The game doesn’t promote or rate any real apps: the situations include both risky and useful tools, and the decision always depends on the need. The packets in the 3D view are an illustration, not a real amount of data. Specific permission options vary by device and service. The game doesn’t connect to real accounts.

Your city. Your decisions.

Game rules

You forgot the app. But does it still have access? Each character’s phone has six apps. For each one:

  1. What do you do? Keep, limit or revoke the access. (Revoking access and uninstalling the app are different actions.)
  2. Why? Choose the most accurate reason. Watch out for myths!
  3. Where? Is it a device permission or an account connection? In each mission, this question is required for two apps; for the others it’s a ⭐ bonus.

When you’ve sorted all six, click “Check mission”. You’ll find out how many points you scored, and one month later… there may be surprises. ⚡

Points and badge. Points are based on your current answers: correct on the first try – full points, corrected – half (rounded up), wrong – 0. Once you complete all the missions and the final challenge, you’ll get a challenge badge with your level and the skills you showed in the game. If you want to improve your result, you can replay any mission or the challenge – the latest attempt counts. You can save or print the badge as many times as you like: it always shows your current result. The colour of the key depends on your points (out of 610): 🥉 bronze – 0–243, 🥈 silver – 244–426, 🥇 gold – 427–548, 💎 diamond – 549–610 (you can’t reach it without the bonus questions). It’s a game award, not an official certificate; it doesn’t include your name or any other personal data.

⏱ One character’s mission takes about 6–8 min. One mission is enough for a short activity (≈ 20 min with discussion); the full game takes about one lesson. Progress is saved, so you can continue later.

Good to know. This is an educational simulation. The game imitates app permissions, account connections and permission requests – this has nothing to do with managing your real accounts or real consent, and nothing changes on your phone or in your accounts. All the apps, their names, the characters and the situations are made up and used for learning purposes only. Any resemblance to real apps, companies or their permissions is coincidental. The game doesn’t promote, recommend or rate any real apps, services or companies: the right decision depends on the situation and the need, not on the type of app.
Glossary

Permission – what an app can reach on your phone or in your browser (camera, microphone, location, photos, contacts).

Account connection – access to your account data that you gave another service, e.g. by signing in with a “Sign in with…” button.

Extension – a browser add-on that can read or change websites.

VPN – a service that all your internet traffic passes through.

Accessibility service – a phone feature that lets an app see and control what’s on the screen (meant for people with disabilities, but malicious apps can misuse it).

GDPR – the General Data Protection Regulation, which gives you the right, among other things, to ask for your data to be deleted.
Mission report

 ⚡ SURPRISE · SIMULATION

Learning scenario – these buttons don’t grant any real access.

 ⚡ ONE MONTH LATER

🧪 PILOT VERSION

Help us make the game better!

“Permission City” is a new game that we’re testing together with you right now. Did a button get stuck somewhere, did an answer seem odd or a text unclear – or do you have an idea for making the game even more fun? We’d love to hear from you – every comment helps! 💚

✉️ game@itinstitutas.lt 💬 Message us on Facebook

To help us find the bug faster, tell us which character’s mission and which app it happened with, and what device you were playing on. A screenshot would really help!

Don’t include personal data (address, phone number, passwords). If you’re under 14, write the message together with a teacher or parent. Facebook is an external website – its own rules apply there.
Your progress

Skills shown in the game

A skill is marked as shown when all the related tasks are done and at least 80% of the answers are correct on the first try. This is a game result, not an official assessment. To improve, replay a mission or the final challenge – the latest attempt counts.
Final challenge

Apply it to new situations

One attempt per question, +10 points for each correct answer.