Cookie Policy
Last updated: October 29, 2026
Table of Contents
Legal Basis for Cookie Usage
We operate under the following legal frameworks:
- ePrivacy Directive 2002/58/EC (as amended by Directive 2009/136/EC): Requires consent for storage of or access to information already stored on a user's terminal equipment, except where strictly necessary for providing a service you requested.
- General Data Protection Regulation (GDPR) (EU 2016/679): Requires a legal basis for processing personal data. For analytics and ad campaign measurement we rely on your consent (Art. 6(1)(a)). For crash reporting and remote feature switches in the app we rely on our legitimate interest in running a stable and secure service (Art. 6(1)(f)).
- Czech Act No. 127/2005 Coll. on Electronic Communications, Section 89(3): Implements the consent rule for cookies and similar technologies in Czech law.
Strictly necessary cookies and storage, and storage that only remembers a choice you made (such as your language or theme), do not require consent. Analytics on our websites and in the app, and ad campaign measurement in the app, are only used after you agree, and both are off until you do.
In the app, two things run without consent because we need them to operate the app: crash and error reporting (Sentry) and feature switches (PostHog feature flags, fetched with a random anonymous ID that is not linked to your account). Both are described in In-App Tracking & SDKs.
In-App Tracking & SDKs
Our mobile app does not use browser cookies. Instead it includes SDKs from other providers that can store or read information on your device. On first launch the app asks you about two optional purposes, both off by default, with equal "Accept all" and "Reject all" buttons:
- Analytics: PostHog product analytics, and screen recordings by PostHog and Sentry.
- Ad campaign measurement: the Meta SDK, which tells us which of our own ad campaigns brought people to the app.
You can change these choices at any time in the app under Settings > More > Privacy.
| SDK (Provider) | Purpose | Data | Consent Required? |
|---|---|---|---|
| PostHog analytics (PostHog, EU cloud, Frankfurt) | Understand which screens and features are used. Screen recordings (session replay) on about 20% of sessions, with text inputs and images masked | Screens viewed, taps, app opens and closes, device and app details. Once you sign in, linked to your user ID, email address, name, roles and account status | Yes (Analytics). Without consent PostHog captures nothing |
| PostHog feature flags (PostHog, EU cloud, Frankfurt) | Lets us switch features on or off remotely, for example maintenance mode, events, ads and rewards | A random anonymous ID that is not linked to your account, plus the technical details any request carries (such as IP address and app version) | No - necessary to operate the app (legitimate interest) |
| Sentry crash and error reporting (Functional Software, EU data region, Germany) | Find and fix crashes, errors and performance problems | Error details, performance data for a sample of sessions, device and app version, and your user ID. The SDK does not attach your email address, name or IP address | No - always on (legitimate interest in stability and security) |
| Sentry session replay (Functional Software, EU data region, Germany) | Screen recordings to understand what led to a problem: about 5% of sessions, and about 20% of sessions in which an error occurs | Screen recording of the app, with text and images masked | Yes (Analytics). Turning it off stops recording at once; turning it on starts it the next time you open the app |
| Meta SDK (Meta Platforms Ireland) | Measure our own ad campaigns | App events (such as installs and app opens) and your device's advertising ID | Yes (Ad campaign measurement). On iOS the system tracking (App Tracking Transparency) prompt is shown only after you say yes in our app |
| Google AdMob and Google consent form (Google) | Show ads to users without a Caliplaces+ subscription | Device and ad data as described in Google's privacy policy | Personalised ads in the EEA and UK only if you agree in Google's consent form. Google acts as an independent controller |
| Push notifications: Expo push service (Expo), Firebase Cloud Messaging (Google, Android), Apple Push Notification service (Apple, iOS, including Live Activities) | Deliver notifications you allowed | Your device push token and the notification content | No - you control notifications in your device settings |
| Maps: Apple MapKit (iOS), Google Maps SDK (Android) | Show maps of places and events | The map area being shown and the technical details any request carries (such as IP address) | No - needed to show the map you open |
| Apple Wallet | Add tickets and passes to Apple Wallet when you choose to | The pass details you add | No - only when you add a pass |
| RevenueCat and Stripe | Process purchases, subscriptions and payments you make | Your user ID, purchase and subscription details, payment details entered at checkout | No - needed to complete a purchase you request |
We do not use Firebase Analytics.
Ads in the App
- Caliplaces campaigns: ads we serve ourselves are selected by your country, language, approximate area, training level, disciplines and platform, and are not shown to Caliplaces+ subscribers. Advertisers do not receive these values. Campaign statistics count impressions and clicks without your user ID. To check that a click belongs to an ad we actually showed, we keep a record of the ad served to your user ID (or a hash of your IP address) for one hour, and a count of how often you saw a campaign for 24 hours.
- Google AdMob: shown to users without a Caliplaces+ subscription. In the EEA and UK, Google's consent form decides whether ads may be personalised. Google acts as an independent controller for AdMob.
Mobile App Privacy Controls
- Analytics and ad campaign measurement: in the app under Settings > More > Privacy.
- Ad personalisation (AdMob): in the app under Settings > More > Privacy > Ad personalisation, which opens Google's consent form.
- iOS: Settings > Privacy & Security > Tracking controls whether apps may access your advertising ID.
- Android: you can delete or reset your advertising ID in your device's Google or Privacy settings (the exact path depends on your device).
- Notifications: in your device settings for the Caliplaces app.
Changes to This Policy
We may update this Cookie Policy from time to time to reflect changes in the technologies we use, regulatory requirements, or other operational reasons. When we do, we will:
- Post the updated policy here with a new "Last updated" date
- Display a notice on our website if the changes are material
Where a change requires your consent, we will ask for it again through the cookie settings or in the app. Until you agree, the new non-essential technologies will not be used.
Version History
- v1.1 (October 29, 2026): Updated to match the cookies, storage and SDKs we actually use; added the website cookie banner, the in-app privacy choices, ad measurement and ads in the app; removed services we no longer use
- v1.0 (April 8, 2026): Initial publication
Contact Information
If you have questions about this Cookie Policy, our cookie practices, or wish to exercise your rights regarding cookies and tracking, please contact us:
- Email: legal@caliplaces.com
- Privacy Inquiries: privacy@caliplaces.com
- Company: Caliplaces s.r.o.
- Registration Number (IČO): 23311207
- Address: Uralská 689/7, Bubeneč (Praha 6), 160 00 Praha
- Country: Czech Republic
Data Protection Authority
If you have unresolved concerns about our cookie practices, you have the right to lodge a complaint with the competent data protection authority:
- Czech Republic: Office for Personal Data Protection (ÚOOÚ)
- EU - General: European Data Protection Board (EDPB)
For consumer disputes you may also contact the Czech Trade Inspection Authority (ČOI), the out-of-court dispute resolution body: adr.coi.cz.
Summary of Your Rights
Under GDPR and Czech data protection law, you have the right to:
- Right to Information: Know what cookies and similar technologies we use and why
- Right to Consent: Give or withdraw consent for non-essential cookies and SDKs
- Right of Access: Request details about cookies and tracking data we collect
- Right to Deletion: Request deletion of cookie data (subject to legal obligations)
- Right to Object: Object to processing based on our legitimate interest
- Right to Lodge a Complaint: File a complaint with your data protection authority