Privacy Policy
Detailed information about Cashletics data processing, legal bases, retention periods and data subject rights.
Block B · User-facing, mandatory
Privacy Policy
Cashletics mobile application — English version
AT-001-EN
⚠️ GOVERNING LANGUAGE NOTICE This document is an English translation of the Hungarian Privacy Policy (AT-001). In case of any discrepancy between the Hungarian and English versions, the Hungarian version shall prevail. Hungarian version: https://cashleticsapp.com/legal.php?slug=adatkezeles&lang=hu |
| Data Controller | Mózer Ferenc (sole trader / egyéni vállalkozó) 6044 Kecskemét, Hetény-Belsőnyír 268/2., Hungary |
| Effective date | 12 October 2026 |
| Prepared by | Dr. Crespo Zsuzsanna | zsuzsanna@crespo.hu |
| Version | v1.10.1 |
| Governing language | Hungarian (AT-001) — this EN version is a translation |
1. Data Controller Details
| Data Controller | Mózer Ferenc |
| Business form | Sole trader (egyéni vállalkozó / EV), Hungary |
| Registered address | 6044 Kecskemét, Hetény-Belsőnyír 268/2., Hungary |
| Registration number | 58145155 |
| Tax number | 41905517-1-23 |
| Privacy contact email | privacy@cashleticsapp.com |
| Support email | support@cashleticsapp.com |
| Legal email | legal@cashleticsapp.com |
| Support phone | +36 30 728 4422 |
| Website | https://cashleticsapp.com/legal.php |
| Data request (web form) | https://cashleticsapp.com/adatkerelem.php |
| Account deletion (web form) | https://cashleticsapp.com/fiok-torlese.php |
| Response deadline | 30 days (GDPR Art. 12) |
2. Purpose of This Policy and Data Processing Principles
This Privacy Policy describes what personal data we process when you use the Cashletics application, for what purpose, on what legal basis, for how long we retain it, and what rights you have as a data subject.
Data processing principles (GDPR Article 5):
Lawfulness, fairness, and transparency
Purpose limitation — data is used only for specified, explicit purposes
Data minimisation — only data necessary for the given purpose is processed
Accuracy and storage limitation
Integrity, confidentiality, and accountability
| Please do not enter special category data (e.g. medical conditions, political views) or personal data of third parties into the application, unless you have a lawful basis to do so. |
3. Overview of Legal Bases
| Legal basis | GDPR reference | When applied |
|---|---|---|
| Performance of contract | Art. 6(1)(b) | Account, financial records, goals — core app functions |
| Consent | Art. 6(1)(a) | Analytics, marketing notifications, AdMob, leaderboard, banking notifications |
| Explicit consent | Art. 9(2)(a) | Health data (step count) — special category data |
| Legitimate interests | Art. 6(1)(f) | Bug fixing, fraud prevention, internal statistics |
| Legal obligation | Art. 6(1)(c) | Tax / accounting retention obligations (where applicable) |
Basis for the provision of data. Providing the data required for registration (e-mail address, password) is a precondition for using the service: without them the account cannot be created, because the service cannot be provided. Providing any further data is voluntary — health data, the reading of banking notifications, analytics processing and marketing communication are each subject to separate consent and may be withdrawn at any time. Refusing or withdrawing consent affects only the availability of the function concerned, not the account as a whole.
4. Personal Data Processed — Itemised Table
The table below covers the main processing activities. The complete Record of Processing Activities (GDPR Article 30): ROPA-001.
| Data category | Specific data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Account data | Email, username, avatar, password (hash), Google UID | Registration, authentication, security | Art. 6(1)(b) | Until account deletion + 30 days |
| Profile data (functional) | Language, currency, theme | Operation and display of the application | Art. 6(1)(b) | Until account deletion |
| Profile data (optional) | Country, age, gender | Personalisation — providing them is voluntary | Art. 6(1)(a) consent | Until account deletion or withdrawal of consent |
| Financial records | Income/expense amount, category, date, note | Core app function, statistics | Art. 6(1)(b) | Until account deletion + 30 days |
| Savings goals | Goal name, amount, deadline, status | Core app function | Art. 6(1)(b) | Until account deletion + 30 days |
| Points / badges | XP, CP, coins, levels, badges, streaks, Piggy Coin balance, coin origin (source protection), conversion transactions, loot box opening events, limit counters | Gamification, motivation | Art. 6(1)(b) | Until account deletion |
| Leaderboard data | Username, avatar, score — publicly visible | Community competition, motivation | Art. 6(1)(a) consent | Until consent withdrawal |
| Consent records | Who accepted what, when (timestamp, version) | GDPR Art. 7(1) demonstrability of consent | Art. 6(1)(c) legal obligation | Account deletion + 5 years |
| Prize draw data | Participation, draw, winner identification; the winner's name and postal address (for delivery); the data of the certificate on the legal title and HUF value of the prize | Running and fulfilling draws, delivering the prize, meeting tax and accounting obligations | Art. 6(1)(b); the accounting document: Art. 6(1)(c) | Participation data: until the account exists · draw record: 5 years · delivery data: delivery + 1 year · accounting document: 8 years (Hungarian Accounting Act) |
| Health data | Step count (daily aggregate) | Activity tracking, reward | Art. 9(2)(a) explicit consent | Until consent withdrawal / max 90 days |
| Banking notification text | Notification text (deleted after processing) | Expense recognition (optional) | Art. 6(1)(a) consent | Deleted immediately after processing |
| Analytics data | Usage events, screen time, app version | Bug fixing, development | Art. 6(1)(a) consent | Event data: 2 months. User data: 14 months, reset upon new user activity — retention runs from the user's last activity. |
| Ad data (AdMob) | Ad identifier, Android ID, IP address | Personalised advertising | Art. 6(1)(a) consent | Per AdMob own policy |
| Support communication | Email correspondence content | Customer support | Art. 6(1)(b) / 6(1)(f) | 3 years |
| Technical / diagnostic | Device type, OS version, app version | Bug fixing, security | Art. 6(1)(f) legitimate interests | 90 days |
| Abuse flags | User identifier, reason for the flag, parameters of the flagged operation, timestamp | Fraud and abuse prevention, subsequent verification | Art. 6(1)(f) legitimate interests | 12 months |
| Administrator announcements | Message title and body, recipient identifier for targeted messages, timestamp | Sending and logging service announcements | Art. 6(1)(b) | 12 months |
| In-app support messages | Identifier, display name, email address, free-text message, administrator reply | Customer support | Art. 6(1)(b) | 30 days from account deletion, otherwise 12 months from case closure |
| Daily operation limit | User identifier, date, daily operation count | Abuse prevention for friend-list operations | Art. 6(1)(f) legitimate interests | Until account deletion |
| Friend-code mapping | Server-side mapping of the shareable PiggyRun friend code to the user identifier (version, timestamp) | Community feature — friend list | Art. 6(1)(b) | Until account deletion — deleted on account deletion |
Deletion and backups. When an account is deleted, the data is erased from the live database according to the retention periods stated per data category in the table in Section 4 — with the exceptions indicated there —, and the deletion process starts without undue delay in line with EJ-001. The system creates daily backups with a retention period of 98 days; deleted data may therefore still be present in those backups until the backup expires, for a maximum of 98 days. Backups are used solely for recovery following an outage or data loss. If a restore takes place, previously requested deletions are re-applied to the restored data. Access to backups is logged.
5. Recipients, Data Processors and Firebase Data Flow
The application uses the following Firebase (Google LLC) services and other data processors. A written Data Processing Agreement (DPA) is in place / to be concluded with each processor (GDPR Article 28). Detailed register: DPA-001.
5.1 Active Firebase services
| Service | Google LLC entity | Data processed | Server location | Transfer basis |
|---|---|---|---|---|
| Firebase Auth | Google LLC | Email, Google UID, password (hash), login timestamps | USA / EU | EU-US DPF |
| Cloud Firestore | Google LLC | All user data (profile, transactions, points, consent) | EU — eur3 multi-region (verified) | EU-US DPF |
| Firebase Analytics | Google LLC | Usage events, session data, device info | USA | EU-US DPF |
| Cloud Functions | Google LLC | Server-side processing (rewards, draws) | USA / EU | EU-US DPF |
5.2 Other recipients and data processors
| Recipient | HQ | Role | Data processed | Transfer basis |
|---|---|---|---|---|
| Google LLC / AdMob | USA | Ad serving | Android ID, IP, ad tracking data | EU-US DPF |
| Google LLC / Play Store | USA | Subscription, purchases | Transaction metadata | EU-US DPF |
| Sybell Informatika Kft. | Budapest, HU | Web hosting, email (support) | Support correspondence | EU — no USA transfer |
| Balázs Bánki (sole developer) | Hungary | Development and operational support. NO PRODUCTION DATA ACCESS AT PRESENT — access is opened only under DPA-003 (signed on 7 September 2026) after a separately documented technical activation, in a limited and logged form | Production data becoming accessible AFTER activation, within troubleshooting and emergency shutdown | EU — no USA transfer |
| Public (leaderboard) | — | Recipient of the public leaderboard | Username, avatar, score | — (no third-country transfer) |
| Masterpont Kft. (masterpont.hu) is NOT a data processor — it has no access to any user data. |
5.3 Firebase data flow (schematic)
Phone → Firebase Auth (authentication) → Cloud Firestore (data storage) → Firebase Analytics (analytics) → Cloud Functions (server processing) → AdMob (advertising) — all USA transfers on EU-US DPF basis.
6. Health Data — Step Count (GDPR Article 9)
| ⚠️ SPECIAL CATEGORY DATA — GDPR ARTICLE 9 | Step count qualifies as health data. Processing is only lawful with explicit consent (GDPR Art. 9(2)(a)). |
| Parameter | Android (Health Connect) | iOS (HealthKit) |
|---|---|---|
| Data source | Health Connect API or device sensor | iOS / HealthKit currently inactive; to be updated before iOS launch |
| Permission type | READ_STEPS | iOS / HealthKit currently inactive |
| Data processed | Daily aggregate step count | iOS / HealthKit currently inactive; to be updated before iOS launch |
| Legal basis | GDPR Art. 9(2)(a) explicit consent | GDPR Art. 9(2)(a) explicit consent |
| Storage | Firestore (aggregated, not raw) | Firestore (aggregated, not raw) |
| Retention | Until consent withdrawal / max 90 days | iOS / HealthKit currently inactive; to be updated before iOS launch |
| Revocable? | Yes — at any time via app settings | Yes — at any time |
Health data (step count) is used EXCLUSIVELY for:
activity tracking and gamified reward calculation
NOT transferred to AdMob, any third-party advertiser, or any external server beyond Firestore (EU-US DPF basis)
NOT displayed on the public leaderboard
NOT used for insurance, employment or credit decisions, nor for advertising (Google Play Health Policy); the permitted personalisation purposes are listed in Section 10
Detailed consent text and conditions: HE-001-EN Health Data Statement.
7. Banking Notification Reading
The application may optionally — and only with the user's explicit consent — read the text of banking push notifications to help identify expenses.
| Parameter | Value |
|---|---|
| Data processed | Notification text (push notification content) |
| App ACCESSES | Notification text only |
| App does NOT ACCESS | Bank account, account number, balance, PIN code |
| Purpose | Automatic expense recognition from text |
| Processing location | Locally on device |
| Retention | Notification text deleted immediately after processing |
| Legal basis | GDPR Art. 6(1)(a) consent (BH-001-EN) |
| Revocable? | Yes — at any time via app settings |
| Play Store policy | Google Play Financial Data policy compliant |
Detailed conditions: BH-001-EN Banking Notification Consent.
8. Push Notifications and Marketing
| Notification type | Legal basis | Revocable? |
|---|---|---|
| Transactional / service (e.g. reward available) | Art. 6(1)(b) contract | Can be limited (not fully disabled) |
| Motivational / daily reminder | Art. 6(1)(a) consent | Yes — at any time |
| Marketing / promotional | Art. 6(1)(a) consent | Yes — at any time |
9. International Data Transfers (USA)
The cashleticsapp.com website and email infrastructure operate exclusively in the EU (Sybell Informatika Kft., Budapest) — no USA transfer occurs via email. For the following services a transfer to a third country (USA) may occur through Firebase and AdMob, exclusively on the basis of the EU–US Data Privacy Framework (EU-US DPF). Data stored in Cloud Firestore is physically held in the eur3 European multi-region (verified); the transfer basis is retained because of the possibility of access by Google LLC:
| Processor | Data transferred | Transfer basis | DPF certification |
|---|---|---|---|
| Google LLC / Firebase Auth | Authentication data | EU-US DPF | Google LLC — certified |
| Google LLC / Cloud Firestore | All user data | EU-US DPF | Google LLC — certified |
| Google LLC / Firebase Analytics | Usage analytics | EU-US DPF | Google LLC — certified |
| Google LLC / Cloud Functions | Server processing | EU-US DPF | Google LLC — certified |
| Google LLC / AdMob | Ad-related data | EU-US DPF | Google LLC — certified |
| Google LLC / Play Store | Subscription metadata | EU-US DPF | Google LLC — certified |
| Sybell Informatika Kft. (email) | Support correspondence | EU — no USA transfer | — |
EU-US DPF framework: https://www.dataprivacyframework.gov/
Note: Should the EU-US DPF be invalidated, the legal basis for these transfers is the Standard Contractual Clauses (SCC) applied by Google LLC under European Commission Implementing Decision (EU) 2021/914 — these apply automatically as part of the Google Cloud Data Processing Agreement (DPA). A copy of these safeguards can be obtained: the EU-US DPF certification of Google LLC at www.dataprivacyframework.gov, the SCC text as the annex to Commission Implementing Decision (EU) 2021/914 (eur-lex.europa.eu), and the Google Cloud Data Processing Addendum at cloud.google.com/terms/data-processing-addendum — also on request at privacy@cashleticsapp.com. In plain terms: your data is stored in Europe, but Google LLC, a US-based company, may access it; this is covered by safeguards recognised by the European Union, and your rights can be exercised in the same way as within the EU.
10. Profiling and Automated Decision-Making (GDPR Article 22)
The application may build a combined user profile from financial, activity, and gamification data (combination of financial + health + behavioural data). This carries profiling risk.
Profiling is used EXCLUSIVELY for:
Displaying personalised rewards and challenges
Calculating leaderboard scores
Prohibited profiling purposes (Google Play Health Policy and GDPR Article 22):
Automated credit, insurance, or employment decisions
Use of health data for advertising purposes
Transfer to third parties without notification
Automated rejection of operations. Certain operations — for example crediting a reward or an action exceeding the daily limit — may be automatically rejected by the system. This does not result in account suspension, point deduction, or any lasting sanction. If you consider a rejection unjustified, you may report it to support@cashleticsapp.com.
Detailed Data Protection Impact Assessment: DPIA-001.
11. Your Rights as a Data Subject (GDPR Articles 15–22)
| Right | GDPR Art. | Description | How to exercise |
|---|---|---|---|
| Right of access | Art. 15 | Information about data processed | privacy@cashleticsapp.com or adatkerelem.php |
| Right to rectification | Art. 16 | Correction of inaccurate data | App profile settings or email |
| Right to erasure | Art. 17 | Deletion of data (“right to be forgotten”) | fiok-torlese.php or privacy@cashleticsapp.com |
| Right to restriction | Art. 18 | Request restriction of processing | privacy@cashleticsapp.com |
| Right to portability | Art. 20 | Data in machine-readable format | privacy@cashleticsapp.com (JSON export) |
| Right to object | Art. 21 | Object to legitimate interest processing | privacy@cashleticsapp.com |
| Withdrawal of consent | Art. 7(3) | At any time, without retroactive effect | App settings, email or postal mail (6044 Kecskemét, Hetény-Belsőnyír 268/2., Hungary) |
| Right to complain | Art. 77 | Lodge complaint with supervisory authority | NAIH: www.naih.hu | ugyfelszolgalat@naih.hu |
Response deadline: without undue delay, and in any event within 30 days (GDPR Article 12). Extendable to 60 days in justified cases; you will be notified. (Article 12(3) GDPR provides for one month; the Controller undertakes a stricter deadline of 30 days.) Detailed request handling procedure: EJ-001.
12. Protection of Children's Data
Under Hungarian law, consent-based processing requires the data subject to be at least 16 years of age (GDPR Article 8). Beyond this, the Data Controller has decided of its own accord that the application is not available to persons under 16 at all: parental consent handling is not implemented, and therefore a person under 16 cannot register even with parental consent. The application does not participate in the Google Play Families programme. If we become aware that we are processing data of a person under 16, we will delete it immediately and suspend the account. Please report such cases to: privacy@cashleticsapp.com
13. Data Security
Firebase Security Rules (Firestore) — per-user data access isolation
Authentication: Firebase Auth (email + password hash, Google SSO)
Data in transit: HTTPS / TLS encryption on all communication; Data at rest: Google Cloud AES-256 encryption — consistent with GPS-001 Play Console declaration
Access control: Firebase Console access may be granted to the Data Controller and to a developer acting under a data processing agreement; access is limited, logged, MFA/2FA protected and based on the need-to-know principle.
Data breach: NAIH notification without undue delay and, where feasible, no later than 72 hours (GDPR Article 33); template: INC-001
14. Cookies and Tracking
The cashleticsapp.com website is tracker-free — no Google Analytics, Meta Pixel, Google Tag Manager, or other cookies. No cookie banner is required.
Within the application, Firebase Analytics uses app-level identifiers rather than traditional cookies. Detailed policy: CK-001-EN Cookie & Tracking Policy.
15. Changes to This Policy and Governing Language
The Data Controller may update this Privacy Policy. For material changes, you will be notified at least 15 days in advance (email or in-app). The current version is always available at: https://cashleticsapp.com/legal.php?slug=adatkezeles&lang=en
⚠️ GOVERNING LANGUAGE NOTICE This document is an English translation of the Hungarian Privacy Policy (AT-001). In case of any discrepancy between the Hungarian and English versions, the Hungarian version shall prevail. Hungarian version: https://cashleticsapp.com/legal.php?slug=adatkezeles&lang=hu |
Version History & Change Log
A. Version history
| Version | Date | Change | Approved by |
|---|---|---|---|
| v1.5 | 2026 | Initial release — final | Dr. Crespo Zsuzsanna |
| v1.7 | 1 August 2026 | Sybell registered address corrected (DPA-001); DPA-002 clause 3.6 breach notification narrowed + non-excludable liability categories; DPA-003 liability cap (12 months’ fees, min. HUF 500,000); publication date updated | Dr. Crespo Zsuzsanna |
| v1.8 | 1 August 2026 | Legal review approved (DPIA-001, LIA-001, PR-001; DPA-002 clause 3.6 + liability framework; DPA-003 liability cap). Signatures pending. | Dr. Crespo Zsuzsanna |
| v1.8.1 | 4 August 2026 | Out-of-cycle correction: in the Section 4 data table the Points / badges category has been supplemented with the data elements related to the PiggyRun mini-game (Piggy Coin balance, coin origin, conversion transactions, loot box opening events, limit counters). No other substantive change. [Internal version — never published; its corrections were incorporated into v1.8.2.] | Dr. Crespo Zsuzsanna |
| v1.8.2 | 5 August 2026 | Pre-publication correction: the GDPR Article 33(1) wording “without undue delay” restored; the 16-year age threshold separated into statutory threshold and the controller's own exclusion decision; Firebase Analytics retention corrected to the actual configuration (event data 2 months, user data 14 months, reset on activity). [Never published; superseded by v1.8.3 with the date and version-table corrections.] | Dr. Crespo Zsuzsanna |
| v1.8.3 | 6 August 2026 | Pre-publication administrative correction: the effective date unified on the cover page, in the footer and in the version history; the unpublished v1.8.1 and v1.8.2 rows annotated; the missing v1.6 version noted. New substantive element: GDPR Article 13(2)(e) — whether the provision of personal data is obligatory. [Never published; superseded by v1.8.4 with the editorial corrections.] | Dr. Crespo Zsuzsanna |
| v1.8.4 | 7 August 2026 | Pre-publication editorial correction and additions. Six textual errors corrected in the Hungarian version (Sections 3, 4, 5 and 8); retention wording in Section 4 unified and aligned with Section 6; abbreviated expressions expanded in both languages. The Section 4 introduction now states that the table covers the main processing activities, with ROPA-001 as the complete record. The Section 6 prohibited-purpose list has been extended with employment decisions. Section 10 gained a new paragraph on the automated rejection of operations and how to contest it. GDPR references now use “Art.” in tables and “Article” in running text; quotation marks unified. The administrative duplicate of the v1.7 row has been removed from the Hungarian version history, which now matches this table, the reference to it has been removed from the v1.8.3 entry, and a note on the incomplete date information of earlier releases has been added below the table. The note on the Standard Contractual Clauses fallback basis, previously present only in the Hungarian version, has been added here. The scope of processing has not changed; the additions are informational. [Never published; the published version remained v1.8.] | Dr. Crespo Zsuzsanna |
| v1.9 | 1 August 2026 | PiggyRun mini-game, Piggy Coin, entry ticket types (standard/silver/gold) and random reward packages (loot boxes) regulated; loot box gambling-law classification approved; gamification data elements extended (AT-001, ROPA-001); DPA-001 AdMob/Firebase acceptance dates; DPIA-001 I4 closed. | Dr. Crespo Zsuzsanna |
| v1.9.1 | 1 August 2026 | Sybell (DPA-002): instead of signing the draft agreement, Section 11.1 of Sybell’s GTC (20 July 2026, Art. 28(3) and (9) GDPR) governs the processing; references updated; GTC archived. | Dr. Crespo Zsuzsanna |
| v1.10 | 1 August 2026 | DPA-003 (Balázs Bánki): implementation of the developer comments — narrowing of the developer role and data categories, incident notification under Art. 33(2) GDPR, notification of unlawful instructions under Art. 28(3) GDPR, clarification of third-country transfers, deletion of the minimum liability floor. Addition of administrator feature switches and audit log (ROPA-001 row 17, 12-month retention); clarification of the admin interface access matrix (SZ-001 2.1). | [külön nem került jóváhagyásra — a v1.10.1 váltotta fel] |
| v1.10.1 | 6 August 2026 · suppl. 4 September 2026 and 5 September 2026 | EN terminology alignment (Article, Data Controller); implementation of the legal review decisions; data categories of the four undocumented collections in Section 4 of AT-001. Supplement of 4 September 2026: placeholder instead of a pre-filled signature date in unsigned copies (14 documents); GDPR Article 12(3) “without undue delay” wording implemented (AT-001 HU/EN, EJ-001); in DPIA-001 the retention of health data after withdrawal changed from 7 to 30 days, aligned with HE-001; corrected EU-US Data Privacy Framework reference in the English version of BH-001; in DPA-002 the processing relationship recorded as based on Section 11.1 of the Sybell GTC and the Controller's written instruction instead of a signature; column misalignment corrected in the Article 28 record of DPA-001. In addition: in ROPA-001 and ATJ-001 the number of recorded processing activities corrected to the actual 25 (previously 17 and 16 respectively); in the consent examples of HJ-001 the reference to the never-published AT-001 v1.8.3 corrected to the published v1.8. Implementation of the legal review decisions (4 September 2026): the assistance obligation under GDPR Article 28(3)(f) added as clause 3.7 of DPA-002 and clause 3.10 of DPA-003; in the Play Data Safety table of GPS-001, transfers to Firebase Analytics are no longer declared as sharing — consistent with the document's own conceptual distinction — and health and fitness data are no longer declared as required; Firebase Analytics (L1) and the aggregated analysis built on it (L3) removed from the scope of LIA-001, as their legal basis is consent, with the exclusion table extended accordingly; the incorrect reference to the Hungarian Infotv. removed from the age-limit reasoning of KK-001, together with the identical wording in GPS-001 and XHV-001; the response deadline in EJ-001 aligned with the public undertaking in AT-001 (60 days in total at most); an explanatory note added to the 30-day undertaking under Article 12(3); the Hungarian version of BH-001 supplemented with the description of third-country transfers; AT-001 now states the storage location of Cloud Firestore as the eur3 European multi-region, consistent with ROPA-001; the developer added to the list of processors in AT-001, and the instruction clause of DPA-003 extended with the transfer wording; in six places the term “anonymised” refined to “pseudonymised”. Based on the Controller's statement of 4 September 2026: two-factor authentication for the admin interface is recorded with its actual completion date (1 September 2026) instead of an expired deadline; the emergency shutdown access issued in the developer's name has not yet been activated, therefore the access matrix of SZ-001 and the transitional provision in clause 3.9.8 of DPA-003 record the current and the final state separately, listing the data actually accessible through that role; the revocation of the earlier project-level (Editor) permission is recorded. The data subject branch of INC-001 received the exemption grounds under GDPR Article 34(3), the retention period of ROPA item 06 was aligned with AT-001, an expired external reference was replaced, and header-row repetition was enabled for two multi-page tables in SZ-001. The duplicate logo on the first page — already present in the header — has been removed from the document body (29 documents); the header logo is unchanged and no document text was altered. Supplement of 5 September 2026: postal mail added to the channels for withdrawing consent (dual withdrawal channel); the "Processor" column in table 5.2 renamed to "Recipient" and the public leaderboard added as a recipient; the package-level legal approval recorded in the version table. Supplement of 6 September 2026: based on the Controller's reply of 5 September 2026, the effective date of the package was changed from 1 August 2026 to 1 October 2026 (79 places; the applicability wording of DPA-003, the approval dates in D2-UGY and the dates in the version tables were deliberately left unchanged). Supplement of 6 September 2026 following the external quality review (P2), 37 confirmed findings: the developer row of table 5.2 records the actual state — no production data access at present; access is opened only after the signature of DPA-003 and a separately documented technical activation. Following the re-measurement of the P1 external review: Section 9 now states where a copy of the appropriate safeguards can be obtained (GDPR Art. 13(1)(f)). Following the P3–P5 external reviews (operability · data-subject perspective · adversarial) of 6 September 2026: the account-deletion sentence refers to the per-category retention periods in Section 4; the Section 6 profiling restriction refers to Section 10; a plain-language explanation of the safeguards in Section 9. Based on the controller's partial status letter of 7 September 2026 and the signed DPA-003 (11 September 2026): the developer-processor row now states the signing date of DPA-003. Supplement of 11 September 2026 (AT-001 ↔ ROPA completeness, cell matching): new row in the Section 4 table for the friend-code mapping (ROPA-001 item 23). Second supplement of 16 September 2026 (legal reviewer's decisions 3, 4, 6 and 9 of 15 September 2026): banking notification split into two steps in ROPA item 06 (reading/processing under Art. 6(1)(a) with immediate deletion; the approved entry falls under item 03, Art. 6(1)(b)); prize draw data categories and retention periods in Section 4 of AT-001 (HU/EN) and ROPA item 10 aligned with Section 8 of PR-001 (four retention periods, accounting document under Art. 6(1)(c)); the deletion sentence of PR-001 converted into conditional form referring to GDPR Article 17(3)(b); the effective-date cell of PR-001 reads „1 October 2026”; the profile data row split (language/currency/theme under Art. 6(1)(b) · country/age/gender under Art. 6(1)(a), optional). Third supplement of 16 September 2026 (approved by the legal reviewer): the title of Section 5 reads „Recipients, Data Processors and Firebase Data Flow” — consistent with the column of table 5.2 renamed to „Recipient” on 5 September 2026 (Hungarian and English versions). Supplement of 24 September 2026: the effective date of the package changed from 1 October 2026 to 12 OCTOBER 2026. Reason: under Section 14 of ASZF-001 and Section 9 of AT-001, users must be notified of changes at least 15 days before the effective date; publication and notification took place on 27 September 2026 (instead of the previously planned 25 September). The signature date of KK-001 and PR-001 is the day of publication. | Dr. Crespo Zsuzsanna |
[Version v1.6 was not issued for AT-001; the version number relates to other documents in the package.]
[Date information for earlier releases is incomplete or standardised: the v1.5 entry shows the year only, and the v1.7 and v1.8 entries carry the same date. These are not corrected retroactively. Versions v1.8.1–v1.8.4 were produced on the branch of the published privacy policy, but none of them was published; their dates are those shown on the version itself (completion or intended effective date), which is not corrected retroactively. This is why an apparent backward step in dates appears after v1.8.4; the substantive order of versions follows the version numbers.]
B. Changes from the March 2026 draft (synchronized with AT-001 HU)
| Item | Draft | Final version | Reason |
|---|---|---|---|
| Health data section | Missing | Section 6 — GDPR Art. 9 | Mandatory for special category data |
| Banking notification | Missing | Section 7 | Play Financial Data policy |
| Firebase detail | Generic | Auth/Firestore/Analytics/CF breakdown (Sec. 5) | GDPR Art. 28 transparency |
| AdMob | Missing | Separate processor row (Sec. 5) | Independent data processor |
| USA transfer | Generic | Itemised EU-US DPF table (Sec. 9) | GDPR Art. 46 |
| Retention periods | “Reasonable time” | Itemised table (Sec. 4) | Art. 5(1)(e) |
| Leaderboard data | Missing | Separate row (Sec. 4) | Publicly shared personal data |
| Consent storage | Missing | Firestore (Sec. 4) | GDPR Art. 7(1) demonstrability of consent |
| Prize draw data | Missing | Separate ROPA row (Sec. 4) | Processing purpose |
| Profiling | Missing | GDPR Art. 22 risk (Sec. 10) | DPIA-001 basis |
| Governing language | Missing | Cover + Section 15 | HU version prevails |
C. Signature block
| Role | Name | Date | Signature |
|---|---|---|---|
| Prepared by | Dr. Crespo Zsuzsanna | ||
| Received / approved by | Mózer Ferenc |
Next review: 1 August 2027
v1.5a supplement — step-count permissions:
On Android, the application may request READ_HEALTH_DATA_HISTORY and ACTIVITY_RECOGNITION in addition to READ_STEPS. These permissions support historical aggregated step totals and Android activity/step-count handling. This does not involve processing GPS, routes, heart rate, workout type, or other health data.