Privacy policy

This policy covers the Zsebszakma exam-preparation mobile app and the zsebszakma.hu website: it explains what personal data is processed when you use them, for what purpose and for how long, and what rights you have. It is based on Regulation (EU) 2016/679 (GDPR) and on Hungarian Act CXII of 2011 (Infotv.).

1. In short

• No sign-up is needed to use the app: no account, no password, we do not ask for your e-mail address.
• Your learning data stays on your device - which questions you answered and how, the questions you flagged and your settings. None of it is uploaded to a server, and we cannot see it.
• No ads, no tracking. We collect no advertising identifier, and we do not track you across other apps or websites.
• The app sends anonymous usage statistics (for example that a practice session was started or finished), so that we can see what is worth improving. They do not identify you, and you can switch them off in Settings at any time.
• We do not sell, rent or trade personal data, and we do not pass it to third parties for marketing. We do not use it to train artificial intelligence either.
• We do not request precise location, contacts, photos, the microphone or the camera, and we process no special categories of data such as health data.
• The statistics shown in the app and the questions selected for review are computed on your device from your own previous answers: they are study suggestions, they do not grade you, and they have no bearing on your actual exam.
• Exactly two external services receive any data from the app, both on our behalf: RevenueCat (purchases and access) and PostHog (anonymous usage statistics, crash reporting and the reports you send about questions, study material and trades, and your feedback).

2. Data controller

• Name: Nullvoid Kft.
• Company reg. no.: 19-09-525913
• Tax no.: 33115670-2-19
• E-mail: hello-noreply@nullvoid.hu.invalid

For any data protection question, request or complaint, write to that address.

3. What data is processed

3.1 Data stored on your device

The app stores on your device whether you have seen the introductory screens, your chosen appearance (system / light / dark), and your learning progress: which questions you answered and with what result, your practice sessions and mock exams, the questions you flagged, and the statistics derived from them.

This data lives exclusively in your device's own storage, inside the app's sandbox. We do not transmit it anywhere and we cannot access it - we have no server that could receive it. The anonymous usage statistics in section 3.4 are separate: they contain only the summary counts of a session, not your answers. Because it never reaches us, we carry out no processing within the meaning of the GDPR in respect of it: it is under your control, and uninstalling the app removes it.

Depending on your device settings, your operating system's automatic backup (iCloud Backup, or Google One / Android Auto Backup) may include this data. That backup is performed by Apple or Google under their own privacy policies; we have no access to its contents.

3.2 Purchases and access

Some modules of the app are unlocked with a one-off purchase. The payment itself is handled by the Apple App Store or Google Play: they process your card and billing details as independent controllers in their own right - we never see or store them. From them we receive only aggregated sales and payout statements that cannot be linked to an individual.

To check whether you have bought a given module, we use RevenueCat. On our behalf, RevenueCat processes a randomly generated, anonymous identifier (it contains no name, e-mail address or phone number, and we do not combine it with any other data), purchase data (the identifier of the product, the time of the purchase, the receipt returned by the platform and its validity, the state of the purchase) and technical data (device type and platform, operating system and app version, the country derived from the request's IP address, and on Apple devices the Identifier for Vendor).

This is needed so that we can unlock the content you bought, let you restore your purchase on a new or reinstalled device, and handle refunds - in other words, to perform our contract with you. We do not collect or transmit any advertising identifier (IDFA, Google Advertising ID), the app does not ask for tracking permission, and purchase data is not shared with any ad network.

3.3 Crash reporting, content reports and feedback

When the app hits an error or crashes, we receive an automatic report through PostHog, stored on servers it operates in the European Union (Frankfurt): the type of the error and the stack trace, the app version and the time of the error, details of the device and operating system, and the technical events preceding the crash - for example which screen inside the app you opened.

A crash report carries no name, e-mail address or advertising identifier, PostHog is configured not to store your IP address and not to derive a location from it, and your learning data, your individual answers and your purchase data are not part of a crash report. The only identifier in it is a randomly generated one: the per-install identifier described in section 3.4 or, if you switched the usage statistics off, a random identifier that is replaced every time the app starts. Crash reports are sent even when the usage statistics are switched off. We do this on the basis of our legitimate interests: we want the app you paid for to work correctly, and to notice failures without depending on user reports. You may object to this processing as described in section 6.

When you use the "Hiba jelzése" (report a problem) button on a question or on a topic's study material to tell us the content is wrong, ambiguous, outdated or needs fixing for another reason, we receive that report through PostHog as well. It contains the identifier and text of the question or topic, the reason you picked from a fixed list, the app version and device and operating system details, with the same settings as crash reporting: the same random identifier, no stored IP address, no name or contact details, and there is no free-text field in a problem report. Sending a report is voluntary, and it is sent even when the usage statistics are switched off, because you asked for it. We use reports to fix wrong or misleading questions and study material, which is our legitimate interest; you can also reach us by e-mail as described in section 3.6.

If you use "Nem találod a szakmád?" (can't find your trade?) at the bottom of the trade list to tell us which trade you are preparing for, the short text you type (at most 60 characters) also reaches us through PostHog, in the same way as a problem report: together with the app version and device and operating system details, but without a stored IP address, name or contact details. Please do not put personal data in it. Sending a suggestion is voluntary, and we use it to decide which trades to add next, which is our legitimate interest.

If you use "Visszajelzés" (feedback) in the app's Settings to send us an idea, a note about missing content or a bug report, the message you type (at most 1000 characters) and the category you picked (idea, missing content, bug or other) reach us through PostHog as well, in the same way as a problem report: together with the app version and device and operating system details, but without a stored IP address, name or contact details. This is a free-text field, so please do not put personal data in it; because we receive no contact details, we cannot reply to it. Sending feedback is voluntary, and we use it to improve the app and to decide what to build or add next, which is our legitimate interest.

3.4 Anonymous usage statistics

To see how the app is used and what is worth improving, we collect anonymous usage statistics through PostHog. PostHog stores this data on servers it operates in the European Union (Frankfurt).

The app sends events from a fixed list: the app being opened and sent to the background, the names of the screens you open, finishing the introductory screens, the trade and specialization you chose, the identifiers of the topics, study material and glossary terms you open, starting, finishing or abandoning a practice session or mock exam (with its mode, the number of questions and of correct answers, and its duration), taps on locked content, opening the purchase screen and the outcome of a purchase, and opening the store's promo code redemption screen (never the code itself). Each event carries a randomly generated per-install identifier, the app version, and technical details of the device and operating system (for example the device model, screen size and language).

We send no name, e-mail address or advertising identifier; PostHog is configured not to store your IP address and not to derive a location from it. The events do not say which answer you gave to which question, and they contain nothing you typed (the reports you send yourself are covered by section 3.3). We build no user profile, we do not combine the identifier with your purchase or with any other data, and we record neither the screen nor your touches.

We do this on the basis of our legitimate interest in improving the app. You can switch the statistics off at any time with the "Névtelen használati statisztika" (anonymous usage statistics) switch in the app's Settings: the app then stops sending usage statistics at once and deletes the identifier from your device; if you switch it back on, it starts with a new identifier. The switch covers the usage statistics only: crash reports and the reports you send yourself keep working as described in section 3.3.

3.5 The website (zsebszakma.hu)

The website is static: it sets no cookies, stores nothing in your browser and loads nothing from a third party - even the fonts are served from our own domain. That is also why there is no cookie banner: there is nothing to consent to.

The exam-question quiz pages (zsebszakma.hu/vizsgakerdesek) send anonymous statistics to PostHog, to the same servers in the European Union (Frankfurt) as the statistics described in section 3.4, so that we can see how many people start and finish the quizzes, how hard the questions are, and how many go on to the app store. Four events are sent: opening a quiz, giving the first answer, finishing the quiz and tapping the App Store or Google Play button. They carry the name of the quiz (the trade) and the number of the attempt; on finishing, the score, the time taken, and whether each question (by its number) was answered correctly; and for a store button, which store, where the button was on the page and how many questions had been answered. The events are linked by a random identifier that lives only as long as that one page visit and is not stored in your browser either, so two of your visits cannot be linked. The events contain no name, e-mail address, browser or device details, or anything you typed; PostHog is configured not to store your IP address and not to derive a location from it. If your browser sends a "Global Privacy Control" or "Do Not Track" signal, the pages send no statistics at all. We do this on the basis of our legitimate interest in improving the quizzes; you can object to it as described in section 6.

The site is served through Cloudflare, which logs requests to the extent needed to operate the service and to defend against attacks (for example IP address, timestamp, requested path, user agent). We do this on the basis of our legitimate interest in serving the website and keeping it secure.

3.6 If you contact us

If you write to us by e-mail - with a question, a bug report or a data protection request - we process your e-mail address, your name (if you give it) and the content of your message so that we can reply. In the case of a data protection request, we are under a legal obligation to fulfil it and to be able to demonstrate that we did.

4. Who receives data

Acting on our behalf as processors are RevenueCat, Inc. (policy), PostHog, Inc. (policy) and Cloudflare, Inc. (policy) - we have entered into a data processing agreement under Article 28 GDPR with each of them. For payment and invoicing, Apple Distribution International Ltd. (policy) and Google Ireland Ltd. (policy) act as independent controllers under their own policies. Beyond that, we disclose personal data only where required by law or upon a lawful request from a court or authority.

All three processors are United States companies, so some of the data they process may leave the European Economic Area; PostHog stores the data it receives in the European Union. Such transfers rely on the Standard Contractual Clauses adopted by the European Commission or, where the provider is a certified participant, on the adequacy decision for the EU–US Data Privacy Framework.

5. Retention

The learning data and settings on your device stay until you delete them - that is, until you uninstall the app. We keep purchase and entitlement data while the rights from the purchase subsist, or until we fulfil your deletion request; crash reports, the reports, suggestions and feedback you send and the anonymous usage statistics (including the website quizzes') for 1 year; and e-mail correspondence for 12 months after the matter is closed. Payout and sales statements from the platforms are kept for 8 years, under section 169 of Hungarian Act C of 2000 on accounting.

6. Your rights

You may ask for access to the personal data we hold about you and a copy of it, have inaccurate data rectified, have your data erased, have processing restricted, and receive data processed on the basis of a contract in a structured, machine-readable format. You may also object to processing based on legitimate interests - crash reporting, content reports and feedback under section 3.3 are such processing, as are the anonymous usage statistics under section 3.4, which you can also switch off yourself in Settings - and we will then stop, unless we demonstrate compelling legitimate grounds.

Write to hello-noreply@nullvoid.hu.invalid: we answer within one month, free of charge. Because we keep no user account, your e-mail address alone is often not enough for us to establish which data is yours; for a request concerning a purchase we may therefore need proof of it, such as your App Store or Google Play receipt.

The simplest way to stop everything is to uninstall the app: that removes the data stored on your device and stops the app sending anything further.

If you believe we have infringed your rights, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Falk Miksa utca 9–11, 1055 Budapest, ugyfelszolgalat@naih.hu, naih.hu), or go to court - in Hungary the action may be brought before the regional court of your domicile or residence. If you live in another Member State, you may contact your own supervisory authority.

7. Security and children

The app handles no passwords and keeps no accounts, so there are no credentials that could leak. Your answers and your progress never leave your device; it is protected primarily by your device lock (PIN, fingerprint, face recognition). All network communication uses an encrypted channel (TLS), and we deliberately include few third-party libraries in the app.

The app is aimed at adults and at vocational students approaching adulthood who are preparing for a trade exam. It is not a service directed at children, and we do not market it to them. We do not knowingly process personal data relating to anyone under 16, and as there is no registration, we do not collect age data at all.

8. Changes to this policy

We may update this policy from time to time - for example when a new feature or a new provider is introduced. The version in force is always available at zsebszakma.hu/en/privacy-policy, with the effective date shown at the top. We will draw attention to material changes in the app or on the website before they take effect.