Version v1.0 — 29/07/2026.
A tracker is information read from or written to a browser, a phone or another terminal device: cookie, local storage, software identifier, mobile SDK or equivalent technology.
The rules draw a distinction. A tracker that is strictly necessary for the service you have asked for does not require your consent. Any other tracker — audience measurement, advertising, social networks — must be authorised by you before it is placed.
Etaligo uses no tracker of the second kind. That is why you will not see a consent banner: there is nothing to ask you.
Inventory established by auditing the code and the deployed configuration, not by declaration. Everything listed below is strictly necessary for the functionality you have asked for.
| Mechanism | What it holds | Why |
|---|---|---|
| Firebase Authentication (IndexedDB) | Session token and refresh token | Keeping you signed in from one screen to the next and from one visit to the next |
| Cloud Firestore (IndexedDB) | Local cache of data already displayed | Showing your orders and catalogues without downloading them again, and coping with an unstable connection at a market |
| Firebase App Check (IndexedDB) | Application attestation token | Proving that the request comes from our application and not from a script |
etaligo_locale (local storage) | The code of the language you chose | Reopening the application in your language |
etaligo_intro_seen_v1 (local storage) | A plain yes/no | Not showing you the introduction screen on every visit |
install_prompt_dismissed (local storage) | A plain yes/no | Not offering to install the application again if you have already declined |
Notification service worker (firebase-messaging-sw.js) | Service worker registration and FCM device token | Receiving the notifications relating to your orders when the tab is closed. Installed only if you allow notifications |
None of these elements serves to profile you, to measure an audience or to track you from one site to another, and none is disclosed to an advertiser.
Even where a tracker is exempt from consent because it is strictly necessary, the associated processing remains subject to the GDPR: it is described in the privacy policy.
Beyond what is written to your device, a page may call a third-party server, which then receives your IP address. Here is the complete list.
| Recipient | When | What it receives |
|---|---|---|
| Google / Firebase | Throughout use | The application traffic: authentication, database, files, notifications. This is our host |
| reCAPTCHA Enterprise (Google) | On the web, at start-up | Browsing signals and your IP address, for App Check. Strictly necessary security: without it, any script could call our servers |
www.gstatic.com (Google) | When the notification service worker is installed | Your IP address, in order to download the Firebase Messaging library |
| Google Maps | Only after you click "Show the map" | Your IP address, information about the device and the map tiles requested |
The Google map is never loaded without an action on your part. Until you click, no request is sent to Google Maps. Address search, by contrast, goes through our own servers: it is our server that queries Google, and your IP address is not disclosed to it on that occasion. In practice this mapping function concerns sellers only, for placing their stall at a market.
The list is shorter than its description:
A link to a seller's website or Instagram account remains a plain link: nothing is loaded before you click.
Were any of these points to change, this policy would be updated and, if the new function requires it, your consent would be sought before anything is placed. This is not boilerplate: the inventory above is re-checked on every new dependency.
As no consent-requiring tracker is used, there is no preference to set. You nevertheless remain in control of:
A system permission (notification, photo, camera) is not legal consent: we ask for a permission only when it is needed, and a refusal is never treated as agreement.
Contact: privacy@joasolucions.com.