Kismat Cookie Policy

Version 4. Effective: 3 November 2026.

This policy explains what Kismat stores on your device and which cookies are used on the website kismat.at, in the Kismat web app and in the Kismat apps. Our Privacy Policy explains how we process personal data in general.

1. In short

Kismat itself does not set cookies.
The website and the web app store a few necessary settings in your browser's local storage, for example that you are signed in.
Google Analytics on the website is loaded only after you agree in the cookie banner. It is never used inside the signed-in web app.
The iPhone app does not track you and shows no ads. The Android app shows an ad only when a free member chooses to watch one, after Google's consent dialog.

2. Website and web app: what is stored without consent

These entries are strictly necessary to provide the service you ask for (§ 165 (3) TKG 2021). They are stored in your browser's local storage, not as cookies, and stay until you sign out, delete them in your browser, or they are replaced.

Sign-in: your sign-in token, a refresh token and basic account data, so you stay signed in.
Your choices: your cookie banner choice (12 months, then we ask again), language, light or dark mode.
Display state: which tips, banners and prompts you have already seen or closed, so we do not show them again.
Invite code: if you opened a friend's invite link, the code is kept for 30 days so the invite works when you sign up.
Sign in with Apple: a short-lived security value while you are redirected to Apple and back.
App files: the web app stores its own program files in your browser (service worker) so it loads fast and works as an installable app.

3. Website: Google Analytics (only with your consent)

If you click "Accept" in the cookie banner, we load Google Analytics 4 on the marketing pages of kismat.at (not inside the signed-in web app). It counts page visits and how the website is used. We shorten the IP address, send only the page path, and keep all advertising features switched off.

Cookies: _ga and _ga_<ID>, set by Google on kismat.at, used to tell visits apart. Lifetime: up to 2 years.
Provider: Google Ireland Ltd. and Google LLC (USA). See section 8 of the Privacy Policy for transfers.
You can withdraw your consent at any time with "Manage Cookies" at the bottom of the website. We then stop Google Analytics and delete its cookies on kismat.at.

"Reject" and "Accept" are offered with equal weight. Closing the banner counts as "Reject".

4. Third-party pages you choose to use

Sign in with Google or Apple: on the sign-in page, Google's and Apple's sign-in scripts are loaded so the buttons work. Google and Apple can set their own cookies when you use them.
Payment: when you pay on the website, you go to a payment page of Stripe, which sets its own cookies for security and fraud prevention.

These providers are responsible for their own cookies.

5. The iPhone and Android apps

Sign-in: your sign-in token is kept in the secure storage of your device (iOS Keychain or Android Keystore).
Settings and display state: language, theme and which tips you have seen are stored in the app's storage on your device.
Push notifications: with your permission, your device gets a push token from Apple or Google so we can send you notifications.
App updates: when the app checks for an update, the update service (Expo) receives your IP address, an installation identifier and the app version.
Ads (Android only): free members can choose to watch a short video ad for extra likes. Before any ad is loaded, Google's consent dialog asks whether ads may be personalised. With your consent, Google can use your device's advertising ID for personalised ads; without it, Google shows non-personalised ads, which still use some device information for frequency limits, fraud prevention and counting. You can change your choice at any time in Settings > Legal & Support > Ad privacy choices. You can also reset or delete the advertising ID in your Android settings. Plus members and new members in their first 48 hours see no ads.
iPhone: the iPhone app shows no ads and does not access the advertising identifier (IDFA).

The apps contain no analytics or tracking tools from other companies.

6. Managing your choices

Website: "Manage Cookies" at the bottom of every page, and your browser settings to delete stored data.
Android ads: Settings > Legal & Support > Ad privacy choices in the app, and Settings > Privacy > Ads on your device.
Push notifications and location: the settings of your device or browser.

7. Contact

Questions: support@kismat.at.

Cookie Policy