Cookie & Tracking Policy
Rules for website and app cookies, SDKs, analytics and advertising identifiers.
Block B · User-facing, mandatory
Cookie & Tracking Policy
Cashletics mobile application — English version
CK-001-EN
⚠️ GOVERNING LANGUAGE NOTICE This document is an English translation of the Hungarian Cookie & Tracking Policy (CK-001). In case of any discrepancy between the Hungarian and English versions, the Hungarian version shall prevail. Hungarian version: https://cashleticsapp.com/legal.php?slug=cookie-tracking&lang=hu |
| Data Controller | Mózer Ferenc (sole trader / egyéni vállalkozó) 6044 Kecskemét, Hetény-Belsőnyír 268/2., Hungary |
| Effective date | 12 October 2026 |
| Prepared by | Dr. Crespo Zsuzsanna | zsuzsanna@crespo.hu |
| Version | v1.10.2 |
| Scope | App-side Firebase services only — the website is tracker-free |
| Governing language | Hungarian (CK-001) — this EN version is a translation |
1. Introduction and Scope
| ✅ The cashleticsapp.com website is completely tracker-free. No Google Analytics, Meta Pixel, Google Tag Manager, Firebase web SDK, or any other cookie / tracking script is used. No cookie banner is required on the website. |
This policy applies exclusively to the in-app tracking technologies used by the Cashletics mobile application: Firebase Analytics, Crashlytics (future), Firebase Cloud Messaging (future), and Google AdMob. These do not use traditional cookies but app-level identifiers.
This policy also forms the basis for completing the Google Play Data Safety form (GPS-001).
2. Cookies vs App-Level Tracking
| Type | Description | In Cashletics |
|---|---|---|
| Web cookie | Small text file stored in browser; used by websites to track visitors | NOT used — website is tracker-free |
| App-level identifier | Unique ID used by mobile app (e.g. Firebase Instance ID) | Used by Firebase Analytics and AdMob |
| Device identifier | Android ID, Advertising ID (GAID) | Used by AdMob for advertising (consent-gated) |
3. Firebase Analytics
| Parameter | Value |
|---|---|
| Provider | Google LLC / Firebase Analytics |
| Purpose | Usage data analysis, app development, error detection |
| Data collected | Usage events, session duration, screen views, device type, OS version, app version |
| Identifier | Firebase Instance ID (unique per app install, resettable) |
| IP address handling | Anonymised (last octet masked) |
| Data storage location | Google LLC servers (USA) — EU-US DPF basis |
| Retention period | 14 months (Firebase default) |
| Legal basis | GDPR Art. 6(1)(a) consent for Firebase Analytics; GDPR Art. 6(1)(f) legitimate interests only for technical bug/crash diagnostics |
| Can be disabled? | Yes — Profile → Settings → usage statistics (Analytics) toggle |
| Play Store Data Safety | Must declare: “Analytics” and “App interactions” data types |
Google Consent Mode v2
In GDPR regions (EU/EEA), Firebase Analytics operates on user consent. Without consent, Analytics collection is disabled or may operate only in a legally permitted non-personal/aggregated mode.
4. Firebase Crashlytics (currently inactive)
| Crashlytics is currently NOT active. If activated in future, this policy will be updated and the trigger in the SZ-001 Internal Policy update matrix will apply. |
Expected data scope (if activated): crash reports, stack traces, device state at time of crash. Legal basis: Article 6(1)(f) legitimate interests (bug fixing). Retention: 90 days.
5. Firebase Cloud Messaging — FCM (currently inactive)
| FCM is currently NOT active. If activated in future, this policy will be updated. |
Expected data scope (if activated): FCM token (push identifier), device identifier. Purpose: sending push notifications. Legal basis: Article 6(1)(a) consent (opt-in required). Withdrawable at any time.
6. Google AdMob — Ad Tracking
In the free version, the Google AdMob SDK is active. Pro subscribers use the application ad-free — AdMob is NOT active for them. In the current version of the app every ad request (banner and rewarded ads) is non-personalized, regardless of the personalized Free ads toggle; serving non-personalized ads also involves data processing. Before the ad request, the app updates Google's consent status (UMP) and shows Google's consent form where required; Google's choices (Profile → Settings → AdMob privacy settings) and the app's own toggles are separate states and do not overwrite each other.
| Parameter | Value |
|---|---|
| Provider | Google LLC / AdMob |
| Purpose | Ad serving, advertising effectiveness measurement |
| Identifiers | Google Advertising ID (GAID), Android ID |
| Data collected | Ad impressions, clicks, rewarded ad completions, IP address (anonymised) |
| Data storage location | Google LLC servers (USA) — EU-US DPF basis |
| Legal basis | GDPR Art. 6(1)(a) consent |
| Applies to | Free users only — inactive for Pro subscribers |
| Can be disabled? | Personalisation: with the app's own toggle and in Google's settings (Profile → Settings → AdMob privacy settings); turning ads off entirely: Pro subscription |
| Play Store Data Safety | Must declare: “Advertising or marketing”, “Device or other IDs” |
Ad personalisation and opt-out
The Google Advertising ID (GAID) can be reset or disabled at any time by the user: Android > Settings > Google > Ads > Delete Advertising ID.
7. Website (cashleticsapp.com) — Tracker-Free
| ✅ The website uses only essential functional cookies (session management where required). No analytics, marketing, or tracking cookies are used. |
| Tracker / tool | Status | Note |
|---|---|---|
| Google Analytics 4 (GA4) | ❌ NOT active | Not integrated |
| Google Tag Manager (GTM) | ❌ NOT active | Not integrated |
| Meta Pixel (Facebook) | ❌ NOT active | Not integrated |
| Firebase web SDK | ❌ NOT active | Not integrated |
| Hotjar / Microsoft Clarity | ❌ NOT active | Not integrated |
| Google Consent Mode v2 | ❌ Not required | No trackers to manage |
| Cookie banner | ❌ Not required | No trackers present |
8. Consent and Withdrawal
For tracking methods that require consent (Analytics in GDPR regions, AdMob), the application uses the following mechanism:
| Tracking tool | How consent is given | How to withdraw |
|---|---|---|
| Firebase Analytics | Separate toggle, off by default — Profile → Settings; at legal re-acceptance also on the consent screen (HJ-001-EN Section 4) | Profile → Settings → usage statistics (Analytics) toggle |
| AdMob (free version) | Personalisation: separate toggle, off by default — Profile → Settings; at legal re-acceptance also on the consent screen (HJ-001-EN Section 4); Google's consent interface (UMP) before the ad request | Profile → Settings → personalized Free ads toggle; no ads in the PRO plan |
| FCM (when active) | System-level push permission request | System Settings > Notifications > Cashletics |
| Crashlytics (when active) | At app launch | App > Settings > Data & Privacy |
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal (GDPR Article 7(3)).
9. Google Play Data Safety — Pre-filled Overview
Detailed field-by-field Play Console guide: GPS-001. The table below summarises declarations relevant to CK-001-EN:
| Data Safety question | Cashletics answer | Reason |
|---|---|---|
| Does the app collect data? | YES | Firebase Analytics, AdMob, account data |
| Is data shared with third parties? | YES (AdMob, Analytics) | Google LLC data processors |
| Is data encrypted in transit? | YES | HTTPS/TLS |
| Account deletion request mechanism? | YES | fiok-torlese.php + privacy@cashleticsapp.com |
| Independent security review? | NO (at launch) | optional later / not a launch blocker |
| Health info collected? | YES (optional) | Step count — Health Connect / HealthKit |
| Financial info collected? | YES (user-provided) | Income/expense records |
| Device or other IDs? | YES | Android ID (AdMob), Firebase Instance ID |
10. Contact and Complaints
| Cookie/tracking questions | privacy@cashleticsapp.com |
| Supervisory authority (NAIH) | www.naih.hu | ugyfelszolgalat@naih.hu |
| Current version (EN) | https://cashleticsapp.com/legal.php?slug=cookie-tracking&lang=en |
| Hungarian version (CK-001) | https://cashleticsapp.com/legal.php?slug=cookie-tracking&lang=hu |
⚠️ GOVERNING LANGUAGE NOTICE This document is an English translation of the Hungarian Cookie & Tracking Policy (CK-001). In case of any discrepancy between the Hungarian and English versions, the Hungarian version shall prevail. Hungarian version: https://cashleticsapp.com/legal.php?slug=cookie-tracking&lang=hu |
Version History
| Version | Date | Change | Approved by |
|---|---|---|---|
| v1.5 | 2026 | Initial release — final | Dr. Crespo Zsuzsanna |
| v1.7 | 1 August 2026 | Sybell registered address corrected (DPA-001); DPA-002 clause 3.6 breach notification narrowed + non-excludable liability categories; DPA-003 liability cap (12 months’ fees, min. HUF 500,000); publication date updated | Dr. Crespo Zsuzsanna |
| v1.8 | 1 August 2026 | Legal review approved (DPIA-001, LIA-001, PR-001; DPA-002 clause 3.6 + liability framework; DPA-003 liability cap). Signatures pending. | Dr. Crespo Zsuzsanna |
| v1.9 | 1 August 2026 | PiggyRun mini-game, Piggy Coin, entry ticket types (standard/silver/gold) and random reward packages (loot boxes) regulated; loot box gambling-law classification approved; gamification data elements extended (AT-001, ROPA-001); DPA-001 AdMob/Firebase acceptance dates; DPIA-001 I4 closed. | Dr. Crespo Zsuzsanna |
| v1.9.1 | 1 August 2026 | Sybell (DPA-002): instead of signing the draft agreement, Section 11.1 of Sybell’s GTC (20 July 2026, Art. 28(3) and (9) GDPR) governs the processing; references updated; GTC archived. | Dr. Crespo Zsuzsanna |
| v1.10 | 1 August 2026 | DPA-003 (Balázs Bánki): implementation of the developer comments — narrowing of the developer role and data categories, incident notification under Art. 33(2) GDPR, notification of unlawful instructions under Art. 28(3) GDPR, clarification of third-country transfers, deletion of the minimum liability floor. Addition of administrator feature switches and audit log (ROPA-001 row 17, 12-month retention); clarification of the admin interface access matrix (SZ-001 2.1). | [külön nem került jóváhagyásra — a v1.10.1 váltotta fel] |
| v1.10.1 | 6 August 2026 · suppl. 4 September 2026 and 5 September 2026 | EN terminology alignment (Article, Data Controller); implementation of the legal review decisions; data categories of the four undocumented collections in Section 4 of AT-001. Supplement of 4 September 2026: placeholder instead of a pre-filled signature date in unsigned copies (14 documents); GDPR Article 12(3) “without undue delay” wording implemented (AT-001 HU/EN, EJ-001); in DPIA-001 the retention of health data after withdrawal changed from 7 to 30 days, aligned with HE-001; corrected EU-US Data Privacy Framework reference in the English version of BH-001; in DPA-002 the processing relationship recorded as based on Section 11.1 of the Sybell GTC and the Controller's written instruction instead of a signature; column misalignment corrected in the Article 28 record of DPA-001. In addition: in ROPA-001 and ATJ-001 the number of recorded processing activities corrected to the actual 25 (previously 17 and 16 respectively); in the consent examples of HJ-001 the reference to the never-published AT-001 v1.8.3 corrected to the published v1.8. Implementation of the legal review decisions (4 September 2026): the assistance obligation under GDPR Article 28(3)(f) added as clause 3.7 of DPA-002 and clause 3.10 of DPA-003; in the Play Data Safety table of GPS-001, transfers to Firebase Analytics are no longer declared as sharing — consistent with the document's own conceptual distinction — and health and fitness data are no longer declared as required; Firebase Analytics (L1) and the aggregated analysis built on it (L3) removed from the scope of LIA-001, as their legal basis is consent, with the exclusion table extended accordingly; the incorrect reference to the Hungarian Infotv. removed from the age-limit reasoning of KK-001, together with the identical wording in GPS-001 and XHV-001; the response deadline in EJ-001 aligned with the public undertaking in AT-001 (60 days in total at most); an explanatory note added to the 30-day undertaking under Article 12(3); the Hungarian version of BH-001 supplemented with the description of third-country transfers; AT-001 now states the storage location of Cloud Firestore as the eur3 European multi-region, consistent with ROPA-001; the developer added to the list of processors in AT-001, and the instruction clause of DPA-003 extended with the transfer wording; in six places the term “anonymised” refined to “pseudonymised”. Based on the Controller's statement of 4 September 2026: two-factor authentication for the admin interface is recorded with its actual completion date (1 September 2026) instead of an expired deadline; the emergency shutdown access issued in the developer's name has not yet been activated, therefore the access matrix of SZ-001 and the transitional provision in clause 3.9.8 of DPA-003 record the current and the final state separately, listing the data actually accessible through that role; the revocation of the earlier project-level (Editor) permission is recorded. The data subject branch of INC-001 received the exemption grounds under GDPR Article 34(3), the retention period of ROPA item 06 was aligned with AT-001, an expired external reference was replaced, and header-row repetition was enabled for two multi-page tables in SZ-001. The duplicate logo on the first page — already present in the header — has been removed from the document body (29 documents); the header logo is unchanged and no document text was altered. Supplement of 5 September 2026: the package-level legal approval recorded in the version table. Supplement of 6 September 2026: based on the Controller's reply of 5 September 2026, the effective date of the package was changed from 1 August 2026 to 1 October 2026 (79 places; the applicability wording of DPA-003, the approval dates in D2-UGY and the dates in the version tables were deliberately left unchanged). Supplement of 24 September 2026: the effective date of the package changed from 1 October 2026 to 12 OCTOBER 2026. Reason: under Section 14 of ASZF-001 and Section 9 of AT-001, users must be notified of changes at least 15 days before the effective date; publication and notification took place on 27 September 2026 (instead of the previously planned 25 September). The signature date of KK-001 and PR-001 is the day of publication. | Dr. Crespo Zsuzsanna |
| v1.10.2 | 3 October 2026 · suppl. 8 October 2026 | References aligned with HJ-001-EN v1.10.2 (based on the controller's technical deviation list of 2 October 2026): usage statistics and personalized ads are two separate toggles on the consent screen, off by default (HJ-001-EN Section 4), replacing the former 'step 5'; the withdrawal path is Profile → Settings. The effective date remains 12 October 2026. Supplement of 8 October 2026, before publication (based on the controller's technical answers of 3 October 2026): in the current version all ad requests are non-personalized; the relationship between Google UMP and the app's own toggles; the optional toggles are in Settings for a new registration and also on the consent screen at re-acceptance. | Dr. Crespo Zsuzsanna |
| Role | Name | Date | Signature |
|---|---|---|---|
| Prepared by | Dr. Crespo Zsuzsanna | ||
| Received / approved by | Mózer Ferenc |
Next review: 1 August 2027