POY — Cookie & Tracking Technologies Policy
Version 1.0 — Effective date: 15 August 2026 — Last updated: 2026-06-08
This policy explains the cookies, SDKs, and device identifiers used by POY — in the mobile app and on the heypoy.app website — and your choices. It supplements our Privacy Policy.
The short version: POY does not use advertising cookies, third-party ad SDKs, or cross-app/cross-site tracking. We use only the technologies needed to run, secure, and operate the Service, plus (with your permission) push notifications.
1. The POY mobile app
A native app doesn't use browser "cookies", but it uses SDKs and identifiers that work similarly. POY uses only strictly necessary and functional/security technologies:
| Technology | Provider | Purpose | Category |
|---|---|---|---|
| Firebase Authentication | Verify your phone number and keep you signed in | Strictly necessary | |
| Cloud Firestore / Storage / Functions SDKs | Store and retrieve your content, votes, and settings; run server logic | Strictly necessary | |
| Local storage / installation identifier | App / Google | Remember session, app state, and the device's app instance | Strictly necessary |
| Firebase Cloud Messaging (push token) | Send notifications (e.g. vote milestones) | Functional — requires your device permission (consent) | |
| App Check (Play Integrity) | Confirm requests come from the genuine POY app, to prevent abuse | Security | |
| Firebase Crashlytics | Diagnose crashes to keep the app stable (off in debug builds) | Functional | |
| Firebase Analytics (Google Analytics for Firebase) | Product analytics only — measure, in aggregate, how many people use POY, how often they return, what they post, and which distribution channel an install came from, so we can improve the app | Consent-based — off until you accept | |
| Google Play Install Referrer | Read once on first launch to attribute your install to a marketing channel (the campaign tag on the store link). No advertising ID is used | Consent-based | |
| IP address & device/app/OS identifiers | Google infra | Security, fraud prevention, reliability, and serving "Decide" content in your language | Strictly necessary |
We do not use these for advertising or to build a behavioural profile of you. We do not include any third-party advertising, analytics-for-ads, or social-media tracking SDKs.
About our analytics. Firebase Analytics is configured for product measurement only: collection stays switched off until you accept the consent screen, the advertising identifier and personalised-ad signals are disabled, and we log only coarse, non-identifying events (e.g. "a post was created", "a vote was cast"), never your phone number or any content. Aggregate counts (signups, daily-active users, posts by type) are also computed on our servers so they never carry personal data. You can withdraw consent at any time — see Your choices below.
2. Your choices (app)
- Usage analytics: turn analytics on or off anytime in Profile → Usage analytics. It starts off and only turns on if you accept the consent screen; switching it off stops all analytics collection immediately.
- Push notifications: grant or revoke anytime via your device settings (Android → Apps → POY → Notifications) or in-app. Revoking stops notifications and we delete the token.
- Permissions: camera and photo/gallery access are requested only when you post; you control them in device settings.
- Reset advertising identifier / opt out of personalised ads at OS level: POY doesn't use the advertising ID, but you can manage it in Android settings regardless.
- Delete everything: Profile → Delete my account.
3. The heypoy.app website
The marketing/legal website today is static and brochure-only — it sets no analytics, advertising, or functional cookies. The only browser storage it uses is a single strictly-necessary local flag that remembers you've seen the cookie notice below, so it doesn't reappear on every visit.
| Cookie/storage type | Purpose | Consent needed? |
|---|---|---|
| Strictly necessary (cookie-notice acknowledgement) | Remember you've dismissed the cookie notice | No (exempt) |
| Functional (not currently used) | Remember preferences (e.g. language) | Yes, if added |
| Analytics (not currently used) | Understand site usage in aggregate | Yes — opt-in, if added |
Under UK PECR/the EU ePrivacy rules, non-essential cookies require your consent. A cookie notice is shown on your first visit; because the site sets no non-essential cookies today, it is a plain acknowledgement rather than an accept/reject choice. If we add functional or analytics cookies in future, this notice will be upgraded to a full opt-in banner before those cookies are set, and this table updated.
4. Do Not Track / Global Privacy Control
We do not use cross-site tracking, so there is nothing to track across sites. Where the website honours browser signals such as Global Privacy Control, we'll treat them as an opt-out of any non-essential cookies.
5. Changes
We'll update this policy if our technologies change. The current version lives at heypoy.app/cookies.
Questions: privacy@heypoy.app.
Questions about this policy? Contact privacy@heypoy.app or visit our contact page.