Kismat Cookie Policy

Version 5. Effective: 7 November 2026.

This policy explains what Kismat stores on your device and which cookies are used on the website kismat.at, in the Kismat web app and in the Kismat apps. Our Privacy Policy explains how we process personal data in general.

1. In short

Kismat itself does not set cookies.
The website and the web app store a few necessary settings in your browser's local storage, for example that you are signed in.
Google Analytics on the website and the blog is loaded only after you agree in the cookie banner. It is never used inside the signed-in web app.
The iPhone app does not track you and shows no ads. The Android app shows an ad only when a free member chooses to watch one, after Google's consent dialog.

2. Website and web app: what is stored without consent

These entries are strictly necessary to provide the service you ask for (§ 165 (3) TKG 2021). They are stored in your browser's local storage, not as cookies, and stay until you sign out, delete them in your browser, or they are replaced.

Sign-in: your sign-in token, a refresh token and basic account data, so you stay signed in.
Your choices: your cookie banner choice (12 months, then we ask again), language, light or dark mode.
Display state: which tips, banners and prompts you have already seen or closed, so we do not show them again.
Invite code: if you opened a friend's invite link, the code is kept for 30 days so the invite works when you sign up.
Sign in with Apple: a short-lived security value while you are redirected to Apple and back.
App files: the web app stores its own program files in your browser (service worker) so it loads fast and works as an installable app.

3. Website: Google Analytics (only with your consent)

If you choose "Accept all" in the cookie banner, or switch on Analytics under "Customize", we load Google Analytics 4 on the public pages of kismat.at, including the blog at kismat.at/blog (never inside the signed-in web app). The blog has no banner of its own: it uses the choice you made on kismat.at, and without that choice nothing is loaded there.

What is measured: which pages are visited, how far a page is scrolled, clicks on links to other websites, file downloads, video plays, and clicks on the App Store and Google Play buttons and on the links into the web app. We send only the page path, never the full address with its parameters, and no name, email address or member ID. Google derives an approximate location (city level) and the type of device and browser from the visit; we do not receive your IP address.

All advertising features are switched off: no Google signals, no ad personalisation, and no sharing of this data with Google for its own purposes. Google keeps the data for 14 months and then deletes it.

Cookies: _ga and _ga_<ID>, set by Google on kismat.at, used to tell visits apart. Lifetime: up to 2 years.
Provider: Google Ireland Ltd. and Google LLC (USA). See section 8 of the Privacy Policy for transfers.
You can withdraw your consent at any time with "Manage Cookies" at the bottom of the website. We then stop Google Analytics and delete its cookies on kismat.at.

"Accept all" and "Reject all" are offered with equal weight. Closing the banner counts as "Reject all".

4. Third-party pages you choose to use

Sign in with Google or Apple: on the sign-in page, Google's and Apple's sign-in scripts are loaded so the buttons work. Google and Apple can set their own cookies when you use them.
Payment: when you pay on the website, you go to a payment page of Stripe, which sets its own cookies for security and fraud prevention.

These providers are responsible for their own cookies.

5. The iPhone and Android apps

Sign-in: your sign-in token is kept in the secure storage of your device (iOS Keychain or Android Keystore).
Settings and display state: language, theme and which tips you have seen are stored in the app's storage on your device.
Push notifications: with your permission, your device gets a push token from Apple or Google so we can send you notifications.
App updates: when the app checks for an update, the update service (Expo) receives your IP address, an installation identifier and the app version.
Ads (Android only): free members can choose to watch a short video ad for extra likes. Before any ad is loaded, Google's consent dialog asks whether ads may be personalised. With your consent, Google can use your device's advertising ID for personalised ads; without it, Google shows non-personalised ads, which still use some device information for frequency limits, fraud prevention and counting. You can change your choice at any time in Settings > Legal & Support > Ad privacy choices. You can also reset or delete the advertising ID in your Android settings. Plus members and new members in their first 48 hours see no ads.
iPhone: the iPhone app shows no ads and does not access the advertising identifier (IDFA).

The apps contain no analytics or tracking tools from other companies.

6. Managing your choices

Website: "Manage Cookies" at the bottom of every page, and your browser settings to delete stored data.
Android ads: Settings > Legal & Support > Ad privacy choices in the app, and Settings > Privacy > Ads on your device.
Push notifications and location: the settings of your device or browser.

7. Contact

Questions: support@kismat.at.

Cookie Policy