Privacy Policy

The operator of the cFlash application and website (hereinafter: "Service") is committed to protecting the personal data of users. This notice describes how we collect, use, and protect your data in accordance with the European Union General Data Protection Regulation (GDPR) and applicable data protection laws.

1. Data Controller

The data controller is established in the European Union (Hungary), therefore no EU representative designation is required.

2. Data We Collect

2.1 Data Provided During Registration

• Username – account identification; also functions as your unique referral code
• Email address – communication, account recovery
• Password – stored encrypted (bcrypt hash), we have no access to the original password
• Referral code (optional) – if you registered using another user's referral code, we store this relationship for the reward program

2.2 Data Collected During Use

• Settings and preferences – language, theme, notification settings
• Saved content – bookmarked news
• Push token (device identifier) – for sending notifications
• Telegram chat ID – if you connect your Telegram account for notifications
• Referral program data – the number of users you have invited and the number of those who became active Premium subscribers (for operating the reward program)

2.3 Automatically Collected Data

• IP address – for security purposes, abuse prevention
• Device type and platform – application optimization
• Analytics data (in-app) – aggregated usage statistics collected via Firebase Analytics: screens viewed, session length, in-app purchase events, app version, operating system version, device model, language, approximate country (derived from IP, not exact location)
• Pseudonymous analytics identifier – Firebase Analytics App Instance ID: a device-level pseudonymous identifier generated by the Firebase SDK. It is not linked to your email or account name and cannot be used to identify you personally. It resets if you reinstall the app or clear app data.
• Crash diagnostic data – if the app crashes, Firebase Crashlytics records a stack trace, breadcrumbs (the last actions before the crash), device model, OS version, and app version, in order to diagnose and fix the bug

We do not collect advertising identifiers (IDFA on iOS, Advertising ID on Android). We do not track your activity across other apps or websites.

2.4 Payment-Related Data

If you purchase a Premium subscription, the payment transaction is handled by Apple Inc. (iOS) or Google LLC (Android). We have no access to payment card data, the name on the card, or the billing address – these are managed by Apple and Google in accordance with their own data processing policies.

For subscription management, we receive and store the following data:

• Transaction identifier
• Product identifier (monthly or yearly subscription)
• Purchase date and expiration date
• Subscription status (active, cancelled, expired, trial period)
• RevenueCat customer identifier (to verify Premium access)

3. Purpose and Legal Basis for Processing

Purpose	Legal Basis (GDPR)
Account creation and operation	Performance of contract (Art. 6(1)(b))
Sending push notifications	Consent (Art. 6(1)(a))
Sending Telegram notifications	Consent (Art. 6(1)(a))
Subscription management, payment processing	Performance of contract (Art. 6(1)(b))
Sending transactional emails	Performance of contract (Art. 6(1)(b))
Operating the referral program and distributing rewards	Performance of contract (Art. 6(1)(b))
Security protection, abuse prevention	Legitimate interest (Art. 6(1)(f))
Service improvement	Legitimate interest (Art. 6(1)(f))
Usage analytics (Firebase Analytics)	Legitimate interest (Art. 6(1)(f))
Crash reporting and stability diagnostics (Firebase Crashlytics)	Legitimate interest (Art. 6(1)(f))

3.1 Legitimate Interest Assessment

For processing based on legitimate interest, we have balanced our interests against your fundamental rights. Our legitimate interest in maintaining service security and improvement does not override your rights to personal data protection. Security-related processing (e.g., IP address logging, login attempt limitations) is essential for protecting the service and our users.

For usage analytics and crash diagnostics we use only default, non-personalized data collection: no advertising identifiers, no cross-app or cross-site tracking, and pseudonymous device-level identifiers only. These enable us to understand which features are used, to detect and fix crashes, and to plan service development. Given the limited scope, aggregated nature and low intrusiveness of this processing, we consider that our legitimate interest does not override your fundamental rights.

4. Data Processors

We do not sell your personal data to third parties. We use the following data processors to operate the Service:

Provider	Status	Purpose	Data Transferred	Location
Sybell Kft.	Data Processor	Website hosting	Website visit data	Hungary
Szerverplex Kft.	Data Processor	Backend servers, database	All user data	Hungary
Expo (Expo.dev)	Data Processor	Push notification delivery	Push token, platform	USA
Resend Inc.	Data Processor	Email delivery	Email address	USA
Google LLC (Firebase Cloud Messaging)	Data Processor	Delivery of Android push notifications	Push token, notification content	USA
Google LLC (Firebase Analytics)	Data Processor	Aggregated usage analytics (in-app)	Pseudonymous App Instance ID, event data, device model, OS version, app version, approximate country	USA
Google LLC (Google Analytics 4)	Data Processor	Aggregated website usage analytics (opt-in only)	Pseudonymous client ID, page URL, referrer, anonymised IP, user agent, approximate country	USA
Meta Platforms Ireland Ltd. (Facebook Pixel)	Data Processor	Website conversion measurement and advertising audiences (opt-in only)	Pseudonymous visitor ID, page URL, referrer, IP address, user agent, event data	Ireland (EU) / USA
Google LLC (Firebase Crashlytics)	Data Processor	Crash reporting and stability diagnostics	Stack traces, breadcrumbs, device model, OS version, app version	USA
RevenueCat, Inc.	Data Processor	Subscription management and IAP event processing	Subscription status, transaction ID, RevenueCat customer ID	USA
CoinGecko	Independent Service	Public crypto market data	No user data transmitted	Germany
Apple Inc.	Independent Controller	In-App Purchase (iOS)	Subscription status	USA
Google LLC	Independent Controller	In-App Purchase (Android)	Subscription status	USA

5. International Data Transfers

Some of our data processors (Expo, Resend, Firebase, RevenueCat) operate in the United States. Data transfers are made based on Standard Contractual Clauses (SCC) approved by the European Commission or adequacy decisions, ensuring GDPR-compliant protection of your data.

For Hungarian providers (Sybell, Szerverplex) and the German provider (CoinGecko), no transfers to third countries occur.

6. Data Retention Period

• Active account: As long as your account is active, or for 2 years from last login in case of inactivity.
• After account deletion: Deletion is immediate in our primary database. Server-side caches are cleared within 24 hours. If backups are created, they are purged within 30 days.
• Security logs (IP addresses, login attempts): Retained for 90 days, then automatically deleted.
• Firebase Analytics data: Retained by Google in aggregated form for 14 months (Firebase Analytics default), then automatically deleted.
• Google Analytics 4 (website) data: Retained by Google in aggregated form for 14 months (GA4 default), then automatically deleted. GA4 cookies (_ga, _ga_<PROPERTY>) expire after 24 months on your device unless you withdraw consent sooner.
• Facebook Pixel (website) data: Retained by Meta in aggregated form for up to 2 years (Meta default). Pixel cookies (_fbp) expire after 90 days on your device unless you withdraw consent sooner.
• Firebase Crashlytics data: Crash reports are retained for 90 days from the last occurrence, then automatically deleted.
• Transaction and billing data: In accordance with legal requirements (generally 8 years under accounting laws).
• Support communication: May be retained for quality assurance and legal purposes until account deletion, or for 2 years from the communication.

7. User Rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15): You may request information about what data we process about you.
• Right to rectification (Art. 16): You may request correction of inaccurate data.
• Right to erasure (Art. 17): You may request deletion of your data ("right to be forgotten").
• Right to restriction (Art. 18): In certain cases, you may request restriction of processing.
• Right to data portability (Art. 20): You may request your data in a machine-readable format.
• Right to object (Art. 21): You may object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7): You may withdraw your consent to notifications (push, Telegram) at any time in the app settings or device settings.

To exercise your rights, email support@cflash.app. We will respond to your request within 30 days. If we cannot clearly identify the requester, we may ask for additional identity verification before processing the request (e.g., a confirmation sent from the registered email address).

8. Account and Data Deletion

You can delete your account and all associated personal data at any time:

• In the app: Settings → Manage Account → Delete Account
• On the web: cflash.app/delete-account.html
• By email: support@cflash.app (if you cannot sign in)

In-app deletion is immediate: your personal data is removed from our primary database at once, server-side caches are cleared within 24 hours. If backups are created, they are purged within 30 days. Data subject to legal retention requirements (e.g., billing data) is retained for the statutory period.

9. Cookies and Tracking

The cFlash website uses Google Analytics 4 (GA4) to measure aggregated site usage. Analytics cookies are disabled by default; they are only activated after you give explicit consent through the cookie banner. If you reject or ignore the banner, no analytics cookies are set and no measurement takes place.

Consent Mode v2 is implemented: until you consent, no _ga, _ga_<ID>, or other GA4 cookies are stored, and no measurement requests are sent to Google. On consent, GA4 sets the following cookies for up to 24 months: _ga (client ID), _ga_<PROPERTY> (session state). A cross-domain linker connects cflash.app with stories.cflash.app so a single visit is not double-counted.

The cFlash website also uses the Facebook Pixel (Meta Platforms Ireland Ltd.) to measure the effectiveness of our Facebook and Instagram advertising. The Pixel is a marketing cookie, loaded only after you give explicit consent for the "Marketing" category in the cookie banner. If you reject or ignore the banner, no Pixel code is loaded and no data is sent to Meta. For details see section 11.9.

IP anonymisation is enabled for Google Analytics 4. You can withdraw or change your consent at any time via the "Cookie settings" link in the website footer. For details see sections 11.8 and 11.9.

The website also uses third-party fonts (Google Fonts), which may transfer minimal technical data (e.g., IP address) during loading. This is a necessary technical process, not for user tracking purposes.

The mobile application uses Firebase Analytics (a separate product from GA4 web analytics) to measure aggregated in-app usage (screens viewed, sessions, in-app purchase events). This is based on a pseudonymous device-level identifier (Firebase App Instance ID); it is not linked to your identity and cannot be used to profile you. We do not collect advertising identifiers (IDFA / Android Advertising ID) and we do not track your activity across other apps or websites. For details see section 11.6. Firebase Analytics (app) and Google Analytics 4 (website) are separate properties and are not linked to each other.

The application uses local storage (AsyncStorage, SecureStore) for storing settings and login data on the device. This data is not transferred to third parties and does not constitute cookies.

10. Automated Decision-Making

cFlash does not employ solely automated decision-making or profiling that would produce legal effects concerning you or similarly significantly affect you (GDPR Art. 22).

11. External Services

11.1 Telegram Integration

If you connect your Telegram account to the cFlash application, Telegram's own privacy policy also applies to communication with the Telegram platform. We only store your Telegram chat ID for sending notifications, which you can delete at any time in the app settings.

11.2 App Store and Google Play

When downloading the app and during In-App Purchase transactions, Apple's and Google's own privacy policies apply:

• Apple Privacy Policy
• Google Privacy Policy

11.3 AI Processing

The Service uses artificial intelligence to generate short summaries of public crypto news articles and to detect duplicate content. The following applies:

• Only the publicly available content of RSS news articles is sent to third-party AI language models for processing. No user account data, search queries, preferences, or any personally identifiable information is shared.
• AI processing happens server-side on our backend; it is not triggered by your individual actions in the app.
• AI-generated summaries may contain inaccuracies or misinterpretations. Always refer to the original source for critical decisions.

11.4 Firebase Cloud Messaging (FCM)

On Android devices, push notifications are delivered through Google's Firebase Cloud Messaging service. The push token generated by your device and the notification payload (title, body) are transferred to FCM for delivery. You can disable push notifications at any time in the app settings or in your device's system settings. See Firebase Privacy Information.

11.5 RevenueCat (Subscription Management)

We use RevenueCat, Inc. (USA) for managing Premium subscriptions. RevenueCat receives Apple App Store and Google Play purchase events (via webhooks), tracks subscription status, and forwards it to our backend system for Premium access verification. RevenueCat does NOT store or process payment card data. The service is GDPR-compliant, and data transfer is made based on Standard Contractual Clauses (SCC). See: RevenueCat Privacy Policy.

11.6 Firebase Analytics

The mobile app uses Google's Firebase Analytics service to collect aggregated usage statistics: screens viewed, session length, in-app purchase events, app and OS version, device model, language, and approximate country (derived from IP, not exact location). Data is associated with a pseudonymous Firebase App Instance ID that is not linked to your account. We do not use advertising identifiers (IDFA / Android Advertising ID) and we do not perform cross-app or cross-website tracking. Data transfer is made based on Standard Contractual Clauses (SCC). Retention: 14 months (Firebase Analytics default).

You can further restrict the collection at the operating system level: on iOS via Settings → Privacy → Analytics & Improvements, on Android via Settings → Privacy → Ads (Delete advertising ID). Uninstalling the app or clearing app data resets the Firebase App Instance ID. See: Firebase Privacy Information.

11.7 Firebase Crashlytics

If the app crashes, Firebase Crashlytics automatically sends a diagnostic report to Google: stack trace, breadcrumbs (the last user actions before the crash), device model, OS version, and app version. This data enables us to detect and fix bugs. The report does not contain your name, email address, or account content. Data transfer is made based on Standard Contractual Clauses (SCC). Retention: 90 days from the last occurrence. See: Firebase Privacy Information.

11.8 Google Analytics 4 (Website)

The cflash.app website uses Google Analytics 4 (GA4), operated by Google LLC, to measure aggregated site usage: pages viewed, session duration, referring source, approximate country (derived from anonymised IP), device type, browser and operating system. The measurement is based on a pseudonymous client ID stored in the _ga cookie; it is not linked to your cFlash account or any personally identifying information.

GA4 is loaded with Consent Mode v2 and analytics storage is denied by default. No GA4 cookies are set and no measurement requests are transmitted until you actively give consent through the cookie banner. IP anonymisation is enabled and advertising features (Google Signals, remarketing) are not used.

A cross-domain linker connects cflash.app and stories.cflash.app so navigation between the two is counted as a single session. Data transfer to the USA is made based on Standard Contractual Clauses (SCC). Retention: 14 months in Google's aggregated GA4 storage; the _ga/_ga_<PROPERTY> cookies on your device expire after 24 months.

You can withdraw or change your consent at any time via the "Cookie settings" link in the website footer, or by clearing your browser's cookies for cflash.app. See: Google Privacy Policy, GA4 data protection.

11.9 Facebook Pixel (Website)

The cflash.app website uses the Facebook Pixel, operated by Meta Platforms Ireland Ltd. (Ireland), to measure the effectiveness of our advertising on Facebook and Instagram, build advertising audiences and show more relevant ads. The Pixel collects: a pseudonymous visitor identifier, the URL of the page viewed, the referring page, your IP address, your user agent (browser and operating system), and standard events (currently: page view). The data is not linked to your cFlash account.

The Facebook Pixel is a marketing cookie and is denied by default. No Pixel script is loaded and no data is sent to Meta until you actively enable the "Marketing" category in the cookie banner. Google Consent Mode v2 signals (ad_storage, ad_user_data, ad_personalization) are updated in parallel with your choice.

Meta Platforms Ireland Ltd. (Ireland) is the EU-based entity responsible for processing EEA/UK user data. Data may be transferred to Meta Platforms, Inc. (USA) based on Standard Contractual Clauses (SCC) and Meta's EU-US Data Privacy Framework certification. For retention and further details see Meta's own policies. Retention: Meta retains Pixel event data in aggregated form for up to 2 years (Meta default).

You can withdraw or change your consent at any time via the "Cookie settings" link in the website footer. You may also opt out of personalised advertising at the Meta level in your Facebook or Instagram ad preferences. See: Meta Privacy Policy, About the Meta Pixel.

12. Support Communication

Communication at support@cflash.app may be retained for quality assurance and legal purposes. This includes the email address, message content, and any attachments. Support communication retention period is until account deletion, or 2 years from the communication.

13. Data Security

To protect your data, we implement the following technical and organizational measures:

• Encrypted connection (SSL/TLS) for all data transfers
• Secure password storage (bcrypt hash algorithm)
• Access restriction and logging on servers
• Regular security backups
• Login attempt limitation (brute-force protection)
• API rate limiting for abuse prevention

14. Children's Data Protection

Legal capacity under applicable law is required to use the Service. We do not knowingly collect data from persons lacking legal capacity. If we become aware that we are processing such a person's data, we will delete it immediately.

15. Data Breach Incidents

In case of a data breach, we act in accordance with GDPR Articles 33 and 34:

• We report the incident to the National Authority for Data Protection and Freedom of Information (NAIH) within 72 hours if it is likely to result in a risk to the rights and freedoms of data subjects.
• If the incident results in high risk, we notify affected users without undue delay.

16. Supervisory Authority

If you believe we have violated your data protection rights, you may file a complaint with the competent supervisory authority:

You may also seek judicial remedy before the competent court at your place of residence or habitual residence.

17. Changes

We reserve the right to modify this Privacy Policy. We will notify you of significant changes via the application or email. The modified policy takes effect on the date of publication. We recommend reviewing this page regularly.

18. Contact

For privacy questions, exercising your rights, or complaints, please contact us: