Privacy Policy

This Privacy Policy applies to the service available at the stories.cflash.app subdomain (the "Service"). The Service is a public, read-only interface that displays AI-generated summary stories covering crypto, AI, tech, macroeconomics, investment, and other related topics. This policy explains how we handle your data in accordance with the EU General Data Protection Regulation (GDPR) and applicable laws.

1. Data Controller

The controller is established in the European Union (Hungary); no EU representative designation is required.

2. Scope of This Policy

This policy covers only the stories.cflash.app subdomain. The cFlash mobile app and the cflash.app main website process data separately and are covered by their own Privacy Policy.

Using the Service does not require registration, an account, or a sign-in. All content is publicly readable.

3. Data We Process

3.1 Cookie

The Service uses a single, strictly functional cookie:

Cookie name	Purpose	Lifetime	Type
lang	Remembers your selected language preference (English / Hungarian / German)	1 year	Functional (first-party)

Under the GDPR and the ePrivacy Directive, strictly functional cookies do not require prior consent, so we do not display a cookie-consent banner on this Service. You may delete the cookie at any time through your browser settings.

3.2 Server-Side Logs

The web server (nginx) serving the Service automatically logs the following technical data for security and operational purposes:

• IP address
• Browser identifier (User-Agent string)
• Timestamp and requested URL
• HTTP response code and response size

This data is used exclusively for abuse detection, troubleshooting, and system stability monitoring. It is not used for profiling or advertising purposes.

4. Data We Do NOT Process

The Service does not collect or store:

• Account or registration data (no registration exists)
• Name, email address, phone number, or payment data
• Analytics cookies (Google Analytics, Facebook Pixel, etc.) or advertising cookies
• Tracking pixels or fingerprinting technologies
• Any user-generated content (no comments, ratings, or messages)

5. Legal Basis for Processing

Data	Purpose	Legal basis (GDPR)
lang cookie	Remembering language preference	Legitimate interest (Art. 6(1)(f))
Server logs (IP, User-Agent)	Security, abuse prevention, troubleshooting	Legitimate interest (Art. 6(1)(f))

For processing based on legitimate interest, we have balanced our interests against your fundamental rights. The functional cookie and security logging are essential for the safe and proper operation of the Service and involve minimal intrusion into your privacy.

6. Processors and External Loads

We use the following external providers to operate the Service:

Provider	Purpose	Data transferred	Location
Szerverplex Kft.	VPS hosting, backend and database	Server logs, database content	Hungary
Google LLC (Google Fonts)	Serving the Inter typeface via CDN	IP address, User-Agent (technical necessity)	USA

Google Fonts are fetched by your browser from Google's servers at load time, which technically requires your IP address and User-Agent to reach Google. This is used solely to deliver the typeface and not for user tracking. See Google's Privacy Policy.

7. Artificial Intelligence

The story texts displayed on the Service are generated by artificial intelligence from publicly available RSS news sources, within the cFlash backend system. No user data is transmitted to the AI providers — because the Service has no user accounts, such data does not exist.

AI-generated content is published under human supervision but may contain inaccuracies or omissions. Always consult the original sources (linked at the end of each story) before making important decisions.

8. Data Retention

• lang cookie: stored in your browser for 1 year, or until you delete it.
• Server logs (IP, User-Agent): retained for a maximum of 90 days, then automatically deleted.
• Backups: the daily automated backup rotates within 30 days (older backups are automatically deleted).

9. Your Rights Under GDPR

Because the Service does not collect personally identifiable data beyond what is briefly stored in server logs, most GDPR rights are of limited relevance. Nevertheless, you have the right to:

• Access (Art. 15): request confirmation of whether any data relating to you is stored.
• Erasure (Art. 17): request early deletion of your IP address from server logs (before the standard 90-day retention expires).
• Restriction (Art. 18): in certain circumstances.
• Objection (Art. 21): object to processing based on legitimate interest.

To exercise these rights, contact support@cflash.app. We will respond within 30 days.

10. Data Security

We apply the following technical and organisational measures to protect your data:

• Encrypted connection (SSL/TLS) for all data transfer (Let's Encrypt certificate)
• Regular security updates on the server and software components
• API rate limiting to prevent abuse
• Daily automated backups

11. Children's Privacy

The Service is not directed at children under 16, and we do not knowingly collect data about them. If we become aware that we have processed data relating to a child under 16, we will delete it without delay.

12. Data Breaches and Supervisory Authority

In the event of a data breach, we act in accordance with Articles 33 and 34 of the GDPR and notify the Hungarian Data Protection Authority (NAIH) within 72 hours if the breach is likely to result in a risk to the rights of data subjects.

If you believe we have infringed your data protection rights, you may lodge a complaint:

13. Changes

We reserve the right to modify this Privacy Policy. Material changes will be indicated by the effective date at the top of this page. We recommend reviewing this page from time to time.

14. Contact