Privacy Policy

Last updated 1 September 2026 · applies to the Just Currency Converter mobile app for iOS and Android, and to this website at justcurrencyconverter.app.

1. Who is responsible for your data

Just Currency Converter is made and operated by Mert Ceyhan, an individual developer established in the Netherlands. For the purposes of the EU General Data Protection Regulation (GDPR) he is the data controller for the processing described here.

• Email: pushnoteapplication@gmail.com
• Postal address: available on request by email, and published on the developer page of the app's Google Play and App Store listings.

No data protection officer is appointed; none is required at this scale. Questions go to the address above.

2. What the app collects

Two things, both through Google Firebase, and nothing else. Both are covered by the single switch described in section 3.

The installation identifier is random, generated on the device, and is not linked to your name, your email address or any account — there is no account. We still treat it as personal data, because EU law treats a persistent identifier that could single out a device as personal data even when we cannot tell who is behind it. Reinstalling the app generates a new one.

What is never collected

Amounts, currency pairs, favourites, anything typed on the keypad, your name, your email address, your phone number, your contacts, your photos or files, your precise location, your advertising identifier, and your device's Android ID. The five events above are the complete list; there is no event that carries a value.

Advertising collection is switched off in the build itself, not merely unused: google_analytics_adid_collection_enabled and google_analytics_ssaid_collection_enabled are both false, and the Android app does not request the AD_ID permission. There are no advertising SDKs in the app at all.

3. Turning it off, and your right to object

Because we rely on legitimate interests, you have the right under GDPR Art. 21 to object to this processing at any time. Settings › Share Diagnostics is that objection, and it needs no email and no explanation.

Switching it off disables collection inside both Firebase SDKs rather than merely discarding the result, takes effect immediately, and persists across launches and updates. From that moment nothing further is sent. The switch is on when you first install the app.

4. What stays on your device, and is never collected

The app remembers a few small things so that it opens where you left it. All of them are written to your device's own storage — SharedPreferences on Android, NSUserDefaults on iOS — and none of them is ever uploaded:

• the pair of currencies you last converted between;
• the currencies you have pinned as favourites;
• your theme (system, light or dark) and your accent colour;
• your Share Diagnostics choice;
• the most recent set of exchange rates, kept so the app still works with no signal.

On iOS these live in a shared App Group so the home-screen widget can read the same rates. Deleting the app deletes all of it. There is no server-side copy and no backup, because there is no server of ours.

5. Exchange rates: the one network request the app makes

To refresh rates the app makes a single, plain GET request to Frankfurter, an open-source service that republishes reference rates gathered from central banks.

• The request carries no account, no device identifier, no advertising ID and nothing you have typed. It asks only for the current rate table, which is identical for every user.
• As with any request to any website, Frankfurter's servers can see the IP address it came from. Frankfurter decides on its own what it does with that, as an independent controller; we neither receive nor store it.
• The app asks at most once an hour while you are using it, and roughly once a day in the background. If the request fails, the app keeps the rates it already has and says so on screen.

The Android app declares one permission, INTERNET, and it exists only for this request.

6. Who else sees the data

• Google (Google Ireland Limited and Google LLC), for Firebase Crashlytics and Google Analytics for Firebase. Google acts as our processor under the Firebase Data Processing and Security Terms and processes the data on our instructions. Google's own description is in the Firebase privacy documentation.
• Nobody else. There are no advertising partners, no data brokers, no attribution or marketing SDKs, and no analytics provider other than the one named above.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We would disclose data if a valid legal obligation required it; that has not happened, and the data we hold would tell an authority almost nothing.

7. Where the data goes

Firebase data may be processed on Google servers outside the European Economic Area, including in the United States. For those transfers Google relies on the European Commission's Standard Contractual Clauses together with Google LLC's certification under the EU–U.S. Data Privacy Framework.

8. How long anything is kept

The retention periods are in the table in section 2. Beyond those, we keep nothing: there is no database of ours, no export, and no copy of Firebase data anywhere else. When Google's retention period expires the data is deleted on Google's schedule and there is nothing left to ask for.

9. Your rights

Under the GDPR (and the UK GDPR, if you are in the United Kingdom) you have the right to access your personal data, to have it corrected or erased, to have its processing restricted, to object to processing based on legitimate interests, to data portability, and to withdraw consent where consent is the basis.

The honest limit

There is no account, so in the ordinary case we cannot connect a request from you to a particular installation — the random installation identifier is the only thread, and nothing links it to a person. GDPR Art. 11 covers exactly this situation: where a controller cannot identify a data subject, it is not obliged to acquire extra information purely to do so. In practice this means:

• To stop it, use Settings › Share Diagnostics. That is immediate and complete, and needs nothing from us.
• To have it deleted, email us with “Data deletion request” in the subject. If you can supply the installation identifier we will delete the data attached to it. Reinstalling the app also issues a new identifier and orphans the old one, which Google then deletes on the schedule above.
• Your device data — currency pair, favourites, theme — never reaches us, and deleting the app removes it.

We answer requests within one month. There is no charge.

Complaints

If you think we have handled your data wrongly you can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or to the supervisory authority where you live.

If you are in California or another US state

We do not sell or share personal information as those terms are defined by the CCPA/CPRA, we do not use it for cross-context behavioural advertising, and we collect no sensitive personal information. The rights described above are available to you on the same terms, by email, without discrimination for having asked.

10. Children

The app is rated and offered for users aged 13 and over and is not directed to children under 13. We do not knowingly collect personal data from children under 13. There is no advertising in the app of any kind, and no advertising identifier is collected from anyone. If you believe a child under 13 has used the app and that data was collected, email us and we will delete what we can identify.

11. Security

Every network request the app and the site make uses HTTPS. Data held in Firebase is protected by Google's infrastructure controls, and access to the Firebase project is limited to the developer named above, over an account with two-factor authentication. No system is perfectly secure, and we reduce the risk mainly by collecting almost nothing.

12. This website

The converter on this site runs entirely in your browser and makes the same single Frankfurter request the app does. Fonts are served from this domain rather than from a font service, and there are no tracking pixels and no embedded third-party content.

Analytics, only if you say yes

Nothing is set until you agree. On your first visit the site asks whether it may count the visit. Until you choose “Allow”, the analytics script is not even fetched and no cookie of any kind is written. Choose “No thanks” and none ever is; the answer is remembered so you are not asked on every page.

If you allow it, Google Analytics sets its own cookies to tell one visit from the next and records the page you were on, an approximate location derived from your IP address, and your browser and device type. Advertising signals and personalisation are switched off, so this cannot be used to target you. The legal basis is your consent, GDPR Art. 6(1)(a); you can withdraw it at any time by clearing this site's data in your browser, which brings the question back.

Storage that is not analytics

Whatever you answer, the site keeps a few small values in your browser's own storage — never in a cookie, and never sent anywhere. jcc_source, jcc_target, jcc_favorites and jcc_theme hold the currencies you picked, the ones you pinned, and whether you chose light or dark; jcc_launched lasts as long as the tab and stops the opening animation replaying; jcc_consent remembers the answer you gave above. Each is written only because you chose something, none identifies you, none is readable by another site, and clearing your site data removes them. Storage that only remembers what you picked is strictly necessary, which is why the banner asks about analytics and nothing else.

Hosting

The site is hosted on Google Firebase Hosting, which keeps standard server request logs including IP addresses for security and operation, under Google's own retention schedule.

13. Changes to this policy

If this policy changes, the date at the top changes with it, and a meaningful change is noted in the app's release notes. Where a change would require your consent, we will ask before it takes effect rather than after.

14. Contact

Mert Ceyhan, Netherlands — pushnoteapplication@gmail.com. For a data request, put “Data deletion request” or “Privacy request” in the subject line so it is not missed.