Privacy Policy

Last updated: 23 October 2026

This policy explains what personal data the Cashtic app (Android and iOS) and the cashtic.com website collect, why, who else receives it, how long we keep it, and the choices and rights you have. It covers app users, store owners who list a business, affiliates, and website visitors.

1. Who is responsible for your data

The data controller is György Chityil, who runs Cashtic. Address: Óra út 4/A, 1125 Budapest, Hungary. Email: cashticapp@gmail.com. Write to that address about anything in this policy.

2. What we collect

Your account

• From the sign-in you choose (Google, Apple or Facebook): your name and profile photo. With Facebook we also receive your Facebook user ID. We copy your Facebook photo to our own storage so it keeps working in the app.
• What you add in the app: profile photos, languages, currencies, the money transfer apps you use, your commission or fee, your opening hours, and business details if you are a store.
• Phone number, if you verify it. On Android the app can read the phone numbers on your SIM card to fill the number in for you, with your permission. We confirm the number with a one-time code sent by SMS.

Your location

• With your permission, the app uses your device's precise GPS location. We store your position and an address worked out from it (street, area, postal code), and the meeting points of your cash requests and offers.
• The app uses location only while you use it. It does not track you in the background.
• To keep the map honest, the app checks whether the location is faked by a mock-location app.
• The app does not work without location, because it cannot show you anyone nearby. You can withdraw the permission at any time in your phone's settings.

Cash requests, offers and activity

• The amount and currency you ask for or offer, the money transfer apps you accept, and your fee.
• Who you contacted or matched with, completed exchanges, ratings you give and receive, people you blocked, and reports you send about other users.
• Chat messages you send to other users. The text is stored so both of you can read the conversation, and it is included in the push notification that tells the other person about your message.
• Cashtic never asks for passwords or access to your bank or payment apps. What you type about money transfer apps is shown to other users as information only, and we do not check it.

Your device and how you use the app

• App version, operating system and version, device language, number of devices, and sign-in times.
• Usage events (for example which screens you open and whether a request was completed), measured with Google Analytics for Firebase when your consent choices allow it.
• Crash reports from Firebase Crashlytics, linked to your account ID.
• An age check: the app asks Google Play or Apple whether the account belongs to an adult, and blocks sign-up for supervised accounts and anyone under 18.

Subscriptions and payments

• App subscriptions are bought through Google Play or the Apple App Store. They process the payment. We receive the plan, price, status, dates and the purchase reference, and we never see your card details.
• Store owners who list a business on cashtic.com pay through Stripe. We send Stripe the store name, address and map position, and the owner's name, email and phone. Stripe handles the card details.
• Affiliates give us their name, email, payout method (PayPal, Wise or other) and payout details so we can pay commission.

When you visit cashtic.com

• Our server records the requests it receives: IP address, browser, the page and the time. A copy of your IP address, scrambled with a one-way hash, is used for a short time to block abuse.
• Google Analytics 4 measures visits (see cookies).
• If you use the map or "near me" search, your browser sends your search or position to OpenStreetMap's map and address services to draw the map. We do not store that position.
• If you arrive through an affiliate's QR code, we store the affiliate's code in a cookie, and in the app for 60 days, so the affiliate gets credit.

3. What other people can see

Who	What they see
Nearby app users	When you have an active request or offer: your short name or initials, photo, your position or meeting point on the map, the amount and currency, the money transfer apps and fee you chose, your hours, ratings, completed exchanges and verification badges. Stores are always shown with their address.
Anyone on cashtic.com	Public city pages list people with an active request or offer, verified users and stores. They show the short name or initials, photo, currencies, transfer apps, language, badges, completed exchanges and the meeting point (street or area, and a map position accurate to about 10 metres). Stores are shown with their street address. Turn on Hide profile in the app's settings to be left off these pages; stores are always listed. Pages are updated daily.
People you chat with	Your messages and your profile.

Only share what you are comfortable with others seeing. When you meet someone, choose a busy public place.

4. Why we use your data, and our legal basis

Under the EU and UK GDPR we must have a legal basis for each use.

Purpose	Legal basis
Run your account, show you people and stores nearby, show your requests and offers to others, chat, notifications you asked for, subscriptions and business listings	Performing our contract with you (the terms of service)
Use your device's location	Your consent through the location permission, which you can withdraw in your phone's settings
Publish profiles of people with an active request or offer, and of stores, on public city pages	Our legitimate interest in helping people find cash nearby, balanced by the Hide profile setting
Safety and fraud prevention: phone verification, fake-location checks, age checks, blocking and reports, abuse limits on the website	Our legitimate interest in keeping users safe, and legal obligations
Fixing crashes and improving the app	Our legitimate interest in a working product
App analytics and personalised ads	Your consent, asked for by the consent screen in the app (and Apple's tracking prompt on iPhone)
Website analytics	Your consent in the EU, EEA, UK and Switzerland; our legitimate interest elsewhere
Reminder and "new near you" notifications	Our legitimate interest; you can switch each type off in the app's notification settings
Invoices, tax and accounting records	Legal obligation

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Who else receives your data

We use these service providers. Each handles data under its own terms and privacy policy.

• Google Firebase (Google Ireland / Google LLC): sign-in and SMS verification, database, file storage, server functions, push notifications, analytics and crash reports.
• Google AdMob and Meta Audience Network: ads in the app.
• Google, Apple and Meta (Facebook): sign-in, if you choose them.
• Google Play and the Apple App Store: app downloads, subscriptions and payments. Google Play also tells us which link or QR code an install came from.
• Stripe: payments for business listings on cashtic.com.
• Maps and routes: Google Maps (map and address lookup in the app), OpenRouteService (walking routes, which receive the start and end point), OpenStreetMap services such as Overpass and Nominatim (ATMs and addresses near a position) and OpenStreetMap map tiles on the website.
• Google Analytics 4: website statistics.
• Content networks (cdnjs/Cloudflare, jsDelivr, unpkg), which deliver icons and map code to your browser and so see your IP address.
• PayPal or Wise, when we pay an affiliate.
• Hetzner, our hosting provider, whose data centre in Finland runs the website and its database.

We may also disclose data when the law requires it, to protect someone's safety, or to a buyer if Cashtic is ever sold, who must then follow this policy.

Transfers outside the EU

Google, Meta, Apple and Stripe may process data in the United States and other countries. Where a country lacks an EU adequacy decision, the transfer relies on the EU–US Data Privacy Framework, where the company is certified, or on the European Commission's Standard Contractual Clauses.

6. How long we keep data

• Account and profile: until you delete your account or ask us to.
• Chats and ratings: as long as both accounts exist, or until you ask us to delete them with your account.
• Public city pages: refreshed daily, so a profile you hide or delete drops off at a later refresh.
• Payment and invoice records: 8 years, as Hungarian accounting law requires.
• Server logs and security records: for a limited time, for security and troubleshooting.
• Affiliate records: while the affiliate account is active and for as long as payouts or accounting require.

7. Your choices and rights

In the app you can edit your profile, hide your profile, choose which notifications you get, block and report users, and change location, tracking and notification permissions in your phone's settings.

Deleting your account: Settings → Delete account in the app removes your profile and photos. To ask for the rest to be erased, including your sign-in record, chats, ratings and any business or affiliate records, email us.

Wherever you live, you can ask us to:

• give you a copy of your data, in a portable format if you want;
• correct it;
• delete it;
• restrict how we use it, or object to a use based on legitimate interests (including the public city pages);
• withdraw a consent you gave, without affecting what was done before.

Email cashticapp@gmail.com. We may ask you to confirm it is your account.

If you are in the EU or EEA, you can complain to your local data protection authority. Our lead authority is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), Falk Miksa utca 9–11, 1055 Budapest, naih.hu. In the UK, contact the ICO.

US state privacy rights

Residents of California and other US states with privacy laws can ask what personal data we collect, use and disclose, and ask for it to be corrected or deleted. The categories we collect are listed in section 2, the sources are you, your device and the sign-in service you choose, and the recipients are listed in section 5.

We do not sell personal data for money. Personalised ads in the app may count as "sharing" for cross-context behavioural advertising under California law. To opt out, decline personalised ads in the app's consent screen, deny tracking on iPhone, or delete or reset your advertising ID on Android, or email us. We do not use sensitive personal data to infer characteristics about you.

8. Cookies and similar technologies

• Needed for the site to work: a session cookie when a store owner or affiliate signs in, the affiliate attribution cookie, and settings stored in your browser such as your cookie choice and dismissed banners.
• Analytics: Google Analytics 4 cookies measure visits.
  • In the EU, EEA, UK and Switzerland they are off until you click Accept in the banner. Until then, Google's consent mode sends only cookieless signals without identifiers.
  • Elsewhere they are on by default.
  • You can block them in your browser or with Google's opt-out add-on.
• The website shows no ads.
• In the app, the advertising and analytics SDKs use your device's advertising identifier, according to the consent choices described above.

9. Children

Cashtic is only for people aged 18 and over. The app checks the age signal from Google Play or Apple and blocks sign-up for anyone under 18. If you believe a child has given us data, email us.

10. Security

Data is sent over encrypted connections and stored with Google Firebase and our hosting provider. No system is perfectly secure.

11. Changes to this policy

This page may change. The date at the top shows when it was last updated.