Privacy Policy
Application: Sushimori (com.cortexstudio.sushimori), available on Google Play for Android.
Sushimori is a sushi piece counter. Using it requires signing in with a Google account, which is what lets your history survive a change of phone and what lets get-togethers with friends tell who is who. This document explains what information is processed, why, for how long, and what you can do about it.
1. Data controller
| Controller | Sergio Expósito |
| Contact email | soporte@cortex-studio.es |
| Trading name | Cortex Studio |
You can write to that address about anything concerning your data, including the rights described in section 8.
The full tax details and postal address, required by e-commerce law rather than by this one, are in the legal notice.
No Data Protection Officer has been appointed, as the processing does not meet the thresholds of Article 37 GDPR.
2. Summary in one sentence
You sign in with your Google account to use the app, and from then on what you count is kept both on your phone and in your account so you do not lose it when you change phones; the only things that reach other people are what you share in a get-together — your display name and your pieces — plus the technical data Google needs to show you ads, if you consent to it.
3. What data is processed
3.1. Your Google account
Signing in is mandatory: the app cannot be used without an account. It uses Google’s system (“Sign in with Google”), which means you type your password into Google and the controller never sees or stores it.
From the profile Google shares when you sign in, the following is kept:
| Data | What for |
|---|---|
| User identifier (UUID) | Telling your data apart from everyone else’s. It is the one attached to your visits and to your row in each get-together |
| Email address | Identifying your account and showing it to you in Settings, so you know which one you are signed in with |
| Profile name | Used as a suggestion for your display name in get-togethers. You can change it to anything you like under Settings → Your name |
| Sign-up and last sign-in timestamps | Security, and applying the deletion periods in section 7 |
Your profile picture, your contacts, your calendar and any other data in your Google account are neither requested nor stored.
3.2. What is kept on your phone
This data lives in the app’s local storage and disappears when you uninstall it or clear its data from Android settings:
| Data | Contents |
|---|---|
| Visit history | Start date and time, piece count, duration and, if you note it, the restaurant |
| Current visit | Start time and pieces counted so far |
| Finished get-togethers | How each get-together you took part in ended, with the display names of those present |
| Preferences | The chosen language |
| Display name | The last one you typed for get-togethers |
| Active room | Identifier of the last room you joined, and the pieces you have counted in it |
| Local purchase copy | A flag recording whether you bought ad removal |
Apart from the language and that local copy of the purchase, the rest is also synchronised with your account, as explained below.
3.3. Your history in your account
So that your history survives losing your phone or switching to a new one, your visits and finished get-togethers are copied to your account on the server:
| Data | Contents | Who sees it |
|---|---|---|
| Visits | Date, time, pieces, duration and any restaurant you noted | Only you and the controller |
| Finished get-togethers | The result of each get-together exactly as your phone composes it, with the display names of those who took part | Only you and the controller |
| Deletion markers | When you delete a visit, a marker is kept so the deletion also reaches your other devices | Only you and the controller |
Nobody but you can read this data: it is the server that checks on every query, not the app.
3.4. Shared rooms (only if you use them)
Rooms are optional. If you never create or join one, this section does not apply to you.
| Data | Contents | Who sees it |
|---|---|---|
| Display name | The one you choose for get-togethers | Other members of that room |
| Pieces | How many pieces you have eaten in that get-together | Other members of that room |
| Times | When you started and finished eating in that get-together | Other members of that room |
| Room | Its name, the 6-character code, the place if one was noted, and the creation, closing and last-update timestamps | Other members of that room |
| Device identifier | A random number generated on your phone, so the server knows which one you are counting from if you use two | Only the controller |
You choose your display name. It is shown to everyone else in the room, so we recommend not using your full name or anything you would rather not share: the app suggests the name on your Google profile, but you can change it to any nickname under Settings → Your name, and the change also reaches the get-together you are currently in.
You can only read rooms you belong to, and you can only modify your own score, and it is the server that enforces that. To prevent abuse it also keeps a daily count of how many rooms you create and how many codes you try without success, tied to your identifier; it is deleted after 7 days.
3.5. Searching for restaurants nearby (only if you ask)
When you save a visit you can note which restaurant it was. You can type the name by hand, and in that case nothing leaves your device.
Only if you tap “Search nearby”, and only then, does the app ask for your location in order to show you the restaurants around you:
| Data | What happens to it |
|---|---|
| Your coordinates | Sent to the server, which forwards them to HERE to ask which restaurants are at that point. They are not stored on the server or on your device: they are used for that query and discarded |
| The response | Only the name and identifier of each restaurant. The address and coordinates HERE returns are discarded on the server and never reach the app |
| The place you pick | Stored on your device, alongside the visit, as a name. Never as a position |
| Number of searches | The server counts how many searches you make each day, tied to your identifier, to prevent abuse of the service. Deleted after 7 days |
In other words: the app does not keep a history of where you have been. It keeps the name of the restaurant you picked — a piece of information you could just as well have typed yourself.
Location is not used in the background, is not requested when you open the app and is not used for advertising. If you deny the permission, everything else keeps working and you can still type the name.
3.6. Technical connection data
The infrastructure provider logs, in its own systems, the technical data common to any internet connection — IP address, timestamp and request type — in order to keep the service secure, prevent abuse and diagnose faults. These logs are handled by the provider under its own technical retention periods and are not used for profiling or to identify you.
3.7. Advertising
The free version shows ads served by Google AdMob. To do so, Google’s SDK may process:
- The Android Advertising ID (AAID), which you can reset or delete at any time under Settings → Google → Ads on your device.
- Your IP address and approximate location derived from it.
- Device information: model, operating system, language and country.
- Ad interaction data: whether an ad was shown, whether you tapped it and how long it stayed on screen.
In the European Economic Area, the United Kingdom and Switzerland, the app shows you a consent form before loading any ad, managed through Google’s User Messaging Platform under the IAB Europe Transparency and Consent Framework. Personalised ads are served only if you explicitly accept. If you decline, you will still see ads, but they will not be personalised.
You can change or withdraw your choice at any time under Settings → Privacy preferences inside the app.
Google acts as an independent controller for this data. How it uses it is described in:
If you purchase ad removal, the app stops requesting ads and the SDK stops processing this data.
3.8. In-app purchase
The app offers a one-time payment to remove advertising. The transaction is processed entirely by Google Play: the controller never receives or stores your name, address, card details or any other payment data.
So that your purchase keeps working after reinstalling or switching phones, and to confirm that it is genuine, the app sends the server the purchase receipt Google Play issues. The server shows it to Google and keeps only:
| Data | Contents |
|---|---|
| Purchase token | The code identifying that purchase to Google Play. It is not payment data and cannot be used to charge anything |
| Your user identifier | To know which account it belongs to |
| Last verification timestamp | To ask Google again and withdraw the benefit if the purchase is cancelled or refunded |
That check is also what stops anyone from switching on the paid version without having bought it.
3.9. Crash reports
When something breaks inside the app, an automatic report is sent to Google’s Firebase Crashlytics so it can be fixed. That is what makes it possible to learn about a failure that only happens on one phone model, or on a version of Android nobody here owns: without those reports, the only way to find out the app is failing is for someone to bother writing an email.
Each report contains:
| Data | Contents |
|---|---|
| The failure | The point in the program where it broke and the sequence of calls that led there |
| App version | Which one you had installed when it happened |
| The device | Model, manufacturer, Android version, free memory and storage, screen orientation and whether the phone is rooted |
| Installation identifier | A random number generated by Firebase, so that several reports can be recognised as coming from the same phone. It is not your account or your email, and it disappears when you uninstall the app |
Nothing about what you do in the app is sent: not your visits, not the pieces you count, not the restaurant you note down, not your get-togethers, not your email, not your display name, not your user identifier. The report describes how the program broke, not who you are or what you were eating.
Crash reports are on by default and you can switch them off at any time under Settings → Crash reports, inside the app. Sending stops immediately, including any reports still queued to upload; those already sent are kept for the period in section 7.
3.10. What is not done
- No record is kept of where you have been: location is used only at the moment you tap “Search nearby” and is not stored anywhere (see 3.5).
- Location is never used in the background or for advertising.
- No access to contacts, camera, microphone, photos or files.
- No usage analytics or behavioural tracking tools: the reports in section 3.9 describe program errors, not what you do with the app.
- Personal data is never sold to third parties.
- No automated decision-making or profiling producing legal effects on you.
4. Legal basis for each purpose
| Processing | Legal basis (Art. 6 GDPR) |
|---|---|
| User account and Google sign-in | Performance of a service you requested: without an account the app cannot be provided — Art. 6(1)(b) |
| Copy of your history in your account | Performance of a service you requested, namely not losing it when you change phones — Art. 6(1)(b) |
| Shared rooms | Performance of a service you requested — Art. 6(1)(b) |
| Searching for restaurants nearby | Your consent, given when you grant the location permission and withdrawable from your phone’s settings — Art. 6(1)(a) |
| Daily counters for searches, rooms created and codes tried | Legitimate interest in preventing abuse of a service with a limited quota — Art. 6(1)(f) |
| Verifying the purchase with Google Play | Performance of the purchase contract, and legitimate interest in preventing fraud — Art. 6(1)(b) and 6(1)(f) |
| Personalised advertising | Your consent, withdrawable at any time — Art. 6(1)(a) |
| Non-personalised advertising | Legitimate interest in financially sustaining a free app, balanced against your rights — Art. 6(1)(f) |
| Technical logs and security | Legitimate interest in keeping the service available and free of abuse — Art. 6(1)(f) |
| Crash reports | Legitimate interest in fixing the errors suffered by people using the app, balanced against your rights: the report describes the program and carries none of your activity, and you can switch it off in Settings — Art. 6(1)(f) |
| Purchase handling | Performance of the purchase contract — Art. 6(1)(b) |
Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
5. Recipients
Data is not disclosed to third parties other than the providers needed to run the service:
| Provider | Role | What it processes |
|---|---|---|
| Supabase, Inc. | Processor, bound by contract under Art. 28 GDPR | Hosting of the database and the authentication service: your account, your history, your get-togethers and the rooms |
| HERE Global B.V. | Independent controller | Receives a set of coordinates and returns which restaurants are at that point, when you tap “Search nearby”. It receives no identifier of yours and no other data about you |
| Google Ireland Ltd. / Google LLC (Sign in with Google) | Independent controller | Verifies your identity and passes the app your email address and profile name |
| Google Ireland Ltd. / Google LLC (AdMob) | Independent controller | Ad selection and delivery |
| Google Ireland Ltd. (Google Play) | Independent controller | App distribution, payment processing, and confirming that a purchase is genuine and still valid |
| Google Ireland Ltd. / Google LLC (Firebase Crashlytics) | Processor, bound by the Firebase data processing terms | Receives the automatic crash reports: where the program broke, the app version, the device details and an installation identifier |
Public authorities may also access data where there is a legal obligation.
6. International transfers
The rooms database is hosted in a data centre located in the European Union, so that data does not leave the European Economic Area in its ordinary storage.
HERE Global B.V. is a Dutch company, within the EEA. Its servers may be spread across several regions, and the query it receives carries no identifier of yours: just a point on the map.
Crash reports (section 3.9) are processed on Google’s infrastructure, which may be outside the EEA.
The providers listed above are companies with US parent entities and, for support or maintenance work, could access data from outside the EEA. Such transfers rely on:
- The EU-U.S. Data Privacy Framework, to which Google LLC is certified, under the European Commission’s adequacy decision of 10 July 2023.
- The Standard Contractual Clauses approved by the European Commission, incorporated into the data processing agreements signed with the providers, together with the corresponding supplementary measures.
You can request a copy of the applicable safeguards by writing to the contact address in section 1.
7. Retention periods
| Data | Retention |
|---|---|
| History and preferences on your phone | Until you uninstall the app or clear its data |
| History and get-togethers in your account | Until you delete them or delete the whole account |
| Deletion markers for a visit | 90 days, just long enough for the deletion to reach your other devices, then removed |
| The restaurant of each visit | With the rest of that visit. You can remove it at any time from the visit itself |
| Your coordinates when searching | Not retained: used for the query and discarded |
| Daily counters (searches, rooms created, codes tried) | 7 days, then deleted automatically |
| Your row in a room (display name and pieces) | Until you leave the room. On leaving it is deleted immediately and in full |
| Inactive rooms | Automatically deleted after 12 months without any activity |
| Closed rooms where nobody counted anything | 7 days |
| Inactive accounts | Automatically deleted after 24 months without a single sign-in, along with everything hanging off them |
| Purchase receipt | For as long as the purchase remains valid. If Google reports it was cancelled or refunded it is deleted; it also goes when you delete your account |
| Provider technical logs | Per the infrastructure provider’s own technical retention periods, for security and diagnostics |
| Advertising consent state | Up to 13 months, or until you change it under Settings → Privacy preferences |
| Crash reports | Kept by Google for 90 days from receipt, then deleted |
| Purchase record | Kept by Google Play against your account, under its own policy |
8. Your rights
The GDPR and Spanish Organic Law 3/2018 grant you the following rights, which you may exercise free of charge:
- Access: know what data about you is processed and obtain a copy.
- Rectification: correct inaccurate data.
- Erasure (“right to be forgotten”): request deletion.
- Objection: object to processing based on legitimate interest.
- Restriction: request that data be kept but not used while a complaint is resolved.
- Portability: receive your data in a structured, commonly used format.
- Withdraw advertising consent at any time.
How to exercise them
On your own, without contacting anyone:
| I want to… | How |
|---|---|
| Delete my account and everything in it | Settings → Delete account, inside the app. It erases your account, your history, your get-togethers and your rows in rooms, with no way back. It can also be requested from this website, without having the app installed |
| Delete a single visit | Swipe it away in the history. The deletion also reaches your other devices |
| Delete my data from a room | Leave the room in the app: your display name and pieces are erased instantly |
| Change the name others see | Settings → Your name. It also reaches the get-together you are in |
| Delete the local copy | Android Settings → Apps → Sushimori → Storage → Clear data, or uninstall the app. This does not delete your account |
| Withdraw advertising consent | Settings → Privacy preferences, inside the app |
| Stop sending crash reports | Settings → Crash reports, inside the app. Sending stops immediately |
| Reset my advertising identifier | Android Settings → Google → Ads |
Two limits of deletion worth knowing, because they concern data that is no longer in your hands or ours. When a get-together ends, each participant keeps their own copy of the result with the display names of those present: those copies live on their phones and in their accounts, so the name you appeared under may remain there. And any rooms you created disappear with you, which closes an ongoing get-together for everyone else too.
By email: write to soporte@cortex-studio.es from the address of the Google account you use with the app, stating which right you wish to exercise. Requests are answered within one month of receipt. Writing from that address is what allows us to confirm the account is yours; if that is not possible, another reasonable proof will be requested before anything is disclosed or deleted.
Complaint to the supervisory authority
If you believe your data has not been handled properly, you may lodge a complaint with the Spanish Data Protection Agency:
- Electronic office: sedeagpd.gob.es
- Website: www.aepd.es
- C/ Jorge Juan, 6 — 28001 Madrid, Spain
Users resident in another EEA country may instead complain to their own national supervisory authority.
9. Minors
The app is not directed at children under 14 and is not aimed at a child audience. Using it also requires a Google account, subject to the age requirements Google enforces in each country.
Under Article 7 of Spanish Organic Law 3/2018, processing a minor’s data on the basis of their consent is lawful in Spain from the age of 14. In other EEA countries that threshold may be as high as 16, depending on what each state has set. Below the applicable age, the consent of the holder of parental responsibility is required.
If you become aware that a child has entered personal data into a room, write to soporte@cortex-studio.es and we will delete it without delay.
10. Content written by other people
Rooms display the names typed by other participants. That content is the responsibility of whoever enters it.
If a room shows an offensive name, one impersonating someone, or one containing another person’s personal data, you can report it by writing to soporte@cortex-studio.es with the room code and the name in question. We will review the report and, where warranted, remove that content and the access of whoever entered it.
Without waiting for that review you have two immediate options inside the app: if you created the room, you can remove that person from the participants block; and in any case you can leave the room, which stops you seeing that content and takes your data out of it instantly.
11. Security
- All communication with the server is encrypted over HTTPS/TLS.
- Each account can only read and modify its own data, and it is the server that checks this on every request: it does not rely on the app behaving well.
- No password of yours is ever stored: Google handles identification and the app only receives confirmation that you are who you say you are.
- The paid version is not decided by the phone: it is verified against Google Play on the server.
No measure offers absolute security, but these are proportionate to the nature of the data processed, which includes no special categories under Article 9 GDPR.
12. Users outside the European Union
This policy applies to all users of the app, wherever they are. Depending on your country, you may also have the following rights:
California (CCPA/CPRA). We do not sell personal information for money. However, the use of personalised advertising may constitute “sharing” personal information for cross-context behavioural advertising under the CPRA. You can exercise your right to opt out under Settings → Privacy preferences inside the app. You also have the right to know, delete and correct your personal information, and not to be discriminated against for exercising these rights.
United Kingdom. The same rights as under the GDPR apply, per the UK GDPR and the Data Protection Act 2018. The supervisory authority is the Information Commissioner’s Office.
Other countries. Write to soporte@cortex-studio.es and we will honour any right granted to you by the law applicable where you live.
13. Changes to this policy
If the app changes in a way that affects how your data is processed, this policy will be updated and the date at the top of the document amended. Where the change is substantial, notice will be given inside the app before it takes effect.
14. Contact
For any question about this policy or about how your data is handled: soporte@cortex-studio.es
Drafted in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights.