In-app Consent Texts and Flow

The complete Cashletics consent flow, user-facing texts and withdrawal paths.

B BLOCK · FOR USERS

In-app Consent Flow

& Texts Specification

HJ-001-EN

cashleticsapp.com/legal.php · Public consent-flow notice GDPR-compliant ✔

1. Purpose and scope

This document describes the consent and declaration management flow of the Cashletics mobile application as it operates from 12 October 2026. It covers:

• the mandatory declarations and optional choices shown at registration and at legal re-acceptance, with the user-interface texts in Hungarian and English;

• the feature-bound permission requests (Health Connect step count, banking notification import);

• where the leaderboard participation and the prize-draw rules acceptance take place;

• the withdrawal paths and their effects, including pending operations;

• the actual data structure of the consent log (GDPR Article 7(1));

• the Google Play compliance summary.

2. Overview — decision points

The app does not request consents in a fixed multi-step registration sequence. At registration, the three mandatory declarations (Terms, Privacy Policy, age) are requested on the registration screen, without optional toggles (Section 4.1). The post-login consent screen, with three mandatory declarations and two optional toggles, is shown when the core declarations are missing or the document versions have changed (Sections 4.2 and 4.5). The optional choices are off by default and can be given or withdrawn at any time under Profile → Settings. Permission for health and banking data processing is requested only when the user switches on the respective feature.

3. Flow diagram

The diagram below shows the logical sequence of registration, of the post-login consent screen and of the feature-bound permission requests.

4. Registration and consent screen — mandatory declarations and optional choices

4.1 Registration

Besides the account details, the e-mail registration screen requests the year of birth (in YYYY format) and three mandatory checkboxes, unchecked by default: acceptance of the Terms, acknowledgement of the Privacy Policy and the declaration of being at least 16 years old. There are no optional toggles on the registration screen.

For registration with a Google account, and before Google sign-in on the login page, a separate dialog requests the year of birth and the 16+ declaration; acceptance of the Terms and acknowledgement of the Privacy Policy are recorded by two checkboxes on the registration screen.

The year of birth is used only for a local pre-check: four digits, and the year of birth may be at most the current year minus 16; the 16+ declaration is required separately as well. The app does not save the year of birth, and it is not included in the consent log: the log records the declaration and the KK-001 version (ageConfirmed, agePolicyVersion).

For a new registration, the two optional choices (usage statistics, personalized ads) start switched off; the user can switch them on under Profile → Settings.

4.2 Consent screen (after login)

The consent screen is shown after login if any of the three core declarations is missing or outdated — including at legal re-acceptance (Section 4.5). The screen is blocking: without the three mandatory declarations the app cannot be used. It does not request the year of birth, only the 16+ declaration.

4.3 Interface labels — Hungarian and English

4.4 Rules of operation

• The mandatory checkboxes are unchecked by default; none of them is pre-ticked (GDPR Article 7, Recital 32).

• Continue remains disabled until all three mandatory boxes are checked.

• Acceptance of the Terms is a contractual declaration. Acknowledgement of the Privacy Policy is not consent: it records that the data subject has received the information required by GDPR Article 13. The two declarations are separate checkboxes and separate log events.

• The age threshold (16 years) is supplied by the server-side legal configuration; the declaration records the age limit set out in KK-001. The app does not store the year of birth entered at registration (Section 4.1).

• Usage statistics and personalized ads are two separate toggles, off by default. Neither is a condition for continuing; each can be given and withdrawn separately, with its own log event (GDPR Article 7(2)–(3), Recitals 32 and 43).

• Personalized ads can only appear in the Free plan; no ads are shown in the PRO plan. In the current version of the app every ad request (banner and rewarded ads) is non-personalized, regardless of the toggle; the toggle records the user's choice. Google's own consent interface (UMP) is described in Section 11.

• The choices are recorded in the consent log (Section 10).

4.5 Legal re-acceptance

The published document versions and the age threshold are held in the server-side legal configuration. The app requests the core declarations again when the version of the Terms, the Privacy Policy or the age policy (KK-001) changes; a change of the configuration revision alone does not trigger re-acceptance. In that case the full consent screen is shown, not only the changed document: all three mandatory checkboxes are unchecked and both optional toggles are switched off.

On saving, the toggle positions set on the screen replace the earlier optional choices: a toggle left switched off records the off state even if the user had previously consented. The versions of the health, banking, leaderboard and prize-draw decisions are handled by their own permission requests (Sections 5, 6 and 8).

5. Step count — Health Connect permission (feature-bound)

5.1 When it is shown

Not part of registration. It is shown when the user switches on the step-count-based feature. Optional; if declined, the step-count features are unavailable and the rest of the app can be used unchanged.

5.2 Notice and explicit consent

Step count is health data; the legal basis for processing it is explicit consent under GDPR Article 9(2)(a). Before requesting the system permission, the app shows a separate, scrollable notice dialog (Google Play Health Connect requirement). The verbatim text of the notice is set out in Section 4 of HE-001.

The interface element for explicit consent is the positive button of the notice dialog: „Continue to permission” (on the Hungarian interface „Folytatás az engedélyhez”); there is no separate checkbox. The „Not now” button declines: no system permission request is opened. If there is no current Health consent, after the positive button the server first records the consent (health_accept event), and only then does the app request the Android Physical activity and Health Connect permission.

The in-app consent and the Android system permission are two separate states: the system permission can still be refused after the consent has been recorded, and this does not by itself delete the recorded consent; without the system permission no step count can be read.

5.3 System permission

After the notice, Android's own Health Connect permission screen is shown. The app requests only permissions related to step count and aggregated step totals for past periods (READ_STEPS, READ_HEALTH_DATA_HISTORY, ACTIVITY_RECOGNITION); it does not request GPS, routes, heart rate or workout type. If the user refuses the permission in the system screen, the feature is unavailable and the app continues to run.

5.4 iOS — HealthKit

iOS / HealthKit is not currently active; this section must be updated before the iOS version is launched.

5.5 Logging

The decision is recorded in the healthConsent and healthPolicyVersion fields of the consent log (Section 10).

6. Banking notification import (feature-bound)

6.1 When it is shown

Not part of registration. It is shown when the user switches on the „Automatic notification import” toggle under Profile → Settings. Optional; without it, expenses can be recorded manually.

6.2 Notice

Tapping the toggle is not in itself an approval: a separate notice dialog opens, without a separate checkbox. The positive button is „Continue to settings” (on the Hungarian interface „Folytatás a beállításhoz”), the declining button is „Do not allow” („Nem engedélyezem”). If the user declines, Android's notification access setting is not opened. If there is no current consent, after the positive button the server records the consent (bank_notification_accept event) and the import is switched on.

The verbatim text of the notice — which notifications the app processes and which data are stored — is set out in BH-001.

6.3 System permission

If Android notification access has not yet been granted, the app opens its settings page (Settings → Apps → Special app access → Notification access), where the user switches on the system-level permission. A consent recorded in the app does not mean that the system-level permission has also been granted. The notification listener service may start only after the system-level permission has been granted, and the permission status must be checked at every app start.

6.4 Logging

The decision is recorded in the bankNotificationConsent and bankPolicyVersion fields of the consent log (Section 10).

7. Marketing push notifications (FCM) — future

8. Leaderboard participation and prize-draw rules

8.1 Leaderboard participation

Showing the username, avatar and score on the public leaderboard is a separate, optional consent that is not part of the mandatory declarations (GDPR Article 7(4)). The decision point is available on first opening the leaderboard and in Settings, and can be withdrawn at any time. On withdrawal, the link between the public leaderboard identifier and the user is deleted. Logging: leaderboardConsent, leaderboardPolicyVersion.

8.2 Prize-draw rules

Acceptance of the prize-draw rules (PR-001) is not a condition of registration or of the app's core functions. The app requests it in a separate acceptance dialog (Accept / Cancel) before the first daily reward-wheel spin, the ad-funded extra spin and joining a campaign, if there is no acceptance of the current version of the rules. The rules can be opened from the dialog and their version is shown. If the user declines, the action does not start.

The acceptance is recorded by the server (raffle_rules_accept event; raffleRulesAccepted, raffleRulesVersion — PR-001); a new version of the rules requires a new acceptance. There is currently no active campaign with physical prizes. Entry tickets can be redeemed from reward points (CP) only from CP verifiably earned free of charge; purchased CP cannot be used for this (PR-001). The free ticket reward of the daily reward wheel is independent of this.

9. Withdrawal and changes

Every optional choice can be withdrawn at any time, as easily as it was given (GDPR Article 7(3)). Withdrawal does not affect the lawfulness of processing before the withdrawal.

10. Consent log — GDPR Article 7(1)

The controller must be able to demonstrate that the data subject has consented to the processing. Cashletics records this at two levels: the current state of the user's choices, and a separate event record for every change.

10.1 Structure

10.2 Event types

• Acceptance of the Terms and acknowledgement of the Privacy Policy create separate events: terms_accepted and privacy_acknowledged respectively.

• Usage statistics and personalized ads use separate grant and withdrawal event types (for example ad_personalization_revoke).

• The feature-bound decisions create their own events: health_accept, bank_notification_accept, raffle_rules_accept (Sections 5, 6 and 8).

• The version fields contain the identifier of the document version published at the time of the event (format, for example: ASZF-001-v1.5-2026-07-05).

10.3 Rules

• Event records can be written only by a server-side function (recordedBy: server_callable_v1); the timestamp and the version data are set by the server, and no client-side timestamp is used.

• The log does not contain IP addresses (the controller's live check of 7 September 2026).

• The field name privacyAccepted is retained from the earlier schema; it means acknowledgement of the Privacy Policy, not consent.

• On account deletion the original event records and the current state are deleted. Before that, the data needed to demonstrate consent are copied to a separate, reduced evidence archive (legal_consent_evidence): the choices, the document versions, the event type and time, the language and the configuration data, with a keyed (HMAC) pseudonymous identifier instead of the user identifier. This is pseudonymisation, not anonymisation. Name, e-mail address, year of birth and IP address are not included in the archive. If archiving fails, the account deletion does not proceed.

• Retention: the evidence archive is kept for at most 5 years after account deletion (ROPA-001 08), to demonstrate consent and to establish, exercise or defend legal claims.

11. Google Play compliance summary

12. Governing Language and Version Control

Acknowledgement of Receipt

Next scheduled review: 1 August 2027