Unlokie d.o.o.
Last updated: August 26, 2026
This Cookie Policy explains what we store on your device, and what we read from it, when you use our website and our iOS and Android apps. It covers cookies, browser and app storage, device tokens, and the software kits our providers build into the App.
Read it together with our Privacy Policy, which explains what we do with personal data once we hold it.
In short. Our website sets no cookies of its own and runs no analytics or advertising. The App stores what it needs to sign you in and run a rental. Usage analytics is optional, it is off unless you switch it on, and you can switch it off at any time. Error and crash reporting always runs, and Section 8 explains how to object to it.
1. Data Controller
Controller: Unlokie d.o.o.
Address: Rožmanići 23B, 51221 Kostrena, Croatia
OIB: 87513636162
Email: [email protected]
Website: unlokie.com
Our full company details are in Section 1 of our Terms & Conditions.
We are the controller for the processing described in this policy.
2. What This Policy Covers
This policy covers:
- cookies and local storage in your browser;
- data the App stores on your device, including sign-in tokens and your settings;
- push notification tokens that identify your device to Apple and Google;
- software kits (SDKs) built into the App by us and by our providers, which write to and read from that storage.
We use no advertising pixels, no web beacons, and no cross-site or cross-app tracking. Our emails contain no tracking pixels.
3. Website and Mobile Apps
3.1 Website
Our website sets no cookies of its own. It runs no analytics, no advertising and no tracking pixels. Because it places nothing that needs your consent, it shows no consent banner.
The only thing the website stores in your browser is the language you chose, under the key language, with the value hr or en. It stays there until you clear the site data for unlokie.com, and it is never sent to us.
Our website is delivered through Cloudflare, which protects it against attacks and abuse. Cloudflare receives the IP address of every request to the site. If it needs to tell a person apart from a bot, it can set a short-lived security cookie of its own. That cookie is strictly necessary to keep the site available, and it is not used to profile you or to advertise to you.
Our pages also carry two unused connection hints to Google's font servers. Nothing is loaded from Google, because we serve our fonts from our own servers. Your browser may still open a connection to Google when a page loads, and Google can see your IP address in that connection. Nothing is stored on your device by it.
If you send us the enquiry form on the website, nothing is stored in your browser for it. Your message goes to our server and on to the provider that delivers it to us by email, as described in our Privacy Policy.
3.2 Mobile Apps (iOS and Android)
The App is not a web browser, and it uses no cookies of ours. It stores data on your device so the service works:
- sign-in tokens, so you stay signed in between sessions;
- the language you chose in the App;
- your usage analytics choice;
- rental feedback you have started writing and not yet sent;
- on Android, a record of a payment that was interrupted, so it can be completed or recovered. On an iPhone that record is held only while the App is running, and nothing is written to your device for it;
- which permission prompts and in-app announcements you have already seen;
- a push notification token that identifies your device to Apple's and Google's notification services.
Some of that storage belongs to providers whose software kits we build into the App. Section 5 lists them.
Two steps happen outside the App itself. If you sign in with Google on an iPhone, Google's own sign-in page opens, and Google sets and reads its own cookies there. If your bank asks you to confirm a card payment, that step runs in a secure page provided by your bank and our payment provider, and any storage it uses is theirs, not ours.
4. Categories and Legal Bases
| Category | What it covers | Legal basis |
|---|---|---|
| Strictly necessary | Signing you in, keeping your session secure, payment integrity, push notification tokens, remembering your language and your privacy choice | ePrivacy exemption for strictly necessary storage and access; performance of our contract with you, and our legitimate interest in keeping the service secure |
| Functional | Features you ask for, such as the map | Performance of our contract with you |
| Error and crash reporting | Diagnosing faults, crashes and performance problems in the App | Our legitimate interest in a working, secure App. You can object: see Section 8 |
| Usage analytics, including session replay | Measuring how the App is used so we can improve it | Your consent |
| Advertising and cross-site tracking | Not used | Not applicable |
5. Technologies Currently Used
This is the full list as at the date of this policy.
| Provider or technology | Where | What it does | Category |
|---|---|---|---|
| Unlokie website storage | Website | Stores the site language you chose, under the key language. Nothing else | Strictly necessary |
| Cloudflare | Website | Delivers and protects the website. Receives the IP address of each request, and can set a short-lived security cookie of its own to tell a person from a bot | Strictly necessary |
| Unlokie app storage | iOS and Android | Keeps you signed in, and holds your app language, your analytics choice, an unsent rental feedback draft, which prompts and announcements you have seen, and, on Android only, a record of an interrupted payment | Strictly necessary |
| Firebase Authentication (Google) | iOS and Android | Signs you in and keeps your session valid. Stores sign-in tokens on your device | Strictly necessary |
| Google Sign-In | iOS and Android | Signing in with a Google account, if you choose it. On an iPhone this opens a Google page that uses Google's own cookies | Strictly necessary |
| Stripe | iOS and Android | Card entry, payment confirmation and fraud prevention inside the App. Card details go to Stripe, not to us | Strictly necessary |
| Firebase Cloud Messaging, and Apple Push Notification service on iPhone | iOS and Android | A token that identifies your device, so we can send you rental notifications and, on an iPhone, the rental Live Activity | Strictly necessary |
| Google Maps | iOS and Android | Shows the map and the lockers on it. Google's software kit collects device and network data and caches map data on your device | Functional |
| QR code scanning: Google ML Kit on Android, Apple's built-in scanner on iPhone | iOS and Android | Reads the QR code on a locker. It runs entirely on your device, and no image is sent anywhere for it | Strictly necessary |
| Sentry | iOS and Android | Records errors, crashes and app performance so we can fix faults. Held in Sentry's German region | Error and crash reporting. Legitimate interest, not covered by the analytics switch |
| PostHog product analytics | iOS and Android | Only if you switch usage analytics on. Records the screens you open and the actions you take in the App, linked to your account by an internal sign-in identifier, together with your device and app details. On Android it also records each time the App is opened or put in the background, and the address of a link used to open the App. Held in PostHog's European Union region | Usage analytics. Consent |
| PostHog session replay | iOS and Android | Only if you switch usage analytics on. Records a playback of your screens and taps for a sample of sessions, roughly one in ten. Anything you type, and images the App displays, are masked by the recorder on your device before the recording is sent | Usage analytics. Consent |
Some details about error and crash reporting are not obvious, so we set them out here. An error report is linked to your account by an internal sign-in identifier. It includes a picture of the App screen and its layout at the moment of the error, so whatever was on the screen at that moment is in the report. It also includes the web addresses of the requests the App made just before the error, and one of those, the check we run when you type your email address at sign-in, contains your email address. We never put your name, your phone number or your card details into a report ourselves, and your card details never reach our servers: they go from the App straight to Stripe.
We run no advertising or marketing trackers on the website or in the App, and we do not sell personal data.
6. New Technologies
Before we start using a technology that is not strictly necessary, we will update the table in Section 5, ask for your consent where the law requires it, and give you a way to withdraw that consent.
We should be straight about the previous version of this policy. Usage analytics, session replay and error reporting were added to the App after that version was published, and we did not update this policy at the time, which is what this section promises. This version lists them.
7. Lifetimes
- Site language in your browser: until you clear the site data for unlokie.com.
- Cloudflare's security cookie, where one is set: short-lived, set and expired by Cloudflare.
- App language: until you change it, clear the App's data, or uninstall the App.
- Your usage analytics choice: stored on your device as a simple on or off setting. It has no expiry date, and it lasts until you change it in Settings, clear the App's data, or uninstall the App. We do not ask you again on a schedule.
- Sign-in tokens: refreshed while you are signed in, and cleared when you sign out or uninstall the App.
- Push notification token: until it is replaced, or until you sign out, uninstall the App, or the token stops working.
- Live Activity tokens on iPhone: the token for one rental's Live Activity is deleted 30 days after the App tells us that Live Activity has finished. The separate token that lets us start a Live Activity on your device is kept until Apple tells us it no longer works.
- Unsent rental feedback: on your device until it is sent, or until you clear the App's data. The record of an interrupted payment: on Android, until the payment is resolved or you clear the App's data. On iPhone it is held only while the App is running.
- Usage analytics and session recordings held by PostHog: 12 months for events, and 90 days for screen recordings.
- Error and crash reports held by Sentry: 90 days.
8. Consent Management
Usage analytics is opt-in, and it is off until you turn it on. When you create an account, the App asks you to choose. Neither answer is pre-selected, and you cannot finish creating the account without choosing one. If your account is older than the current version of the App, you were not asked during signup. You can see and change the setting yourself at any time.
You can change your mind at any time. In the App, open Settings, then Privacy, and use the Usage analytics switch. Turning it off takes effect immediately: the App stops capturing usage events, and no further session recordings are sent. Events that were already captured before you switched it off may still be sent, and switching off does not delete what we collected before. To ask us to delete that, write to [email protected].
There is one switch, not a set of categories. Usage analytics and session replay are covered by the same switch. There is no category picker, in the App or on the website.
Error and crash reporting is not covered by that switch. It runs in every released version of both apps, on the basis of our legitimate interest in keeping the App working and secure. There is no in-app switch for it today. If you want to object to it, write to [email protected] and tell us, and we will handle your objection under Article 21 GDPR.
Your choice is stored on your device. We keep no copy of it on our servers. It applies to the device and the installation where you made it, so if you install the App on another device, or reinstall it, usage analytics starts switched off again and you turn it on in Settings if you want it.
If you use the App without an account, no usage analytics runs at all, because the analytics tool is never started until someone turns the setting on. Error and crash reporting does run.
The website shows no consent banner because it places nothing that needs consent.
9. Browser and Device Controls
You can also control this outside our services:
- clear or block site data in your browser, which removes the stored site language;
- uninstall the App, or clear its data, which removes what it stored on your device, including your analytics choice;
- change the location, camera and notification permissions in your iOS or Android settings;
- use the tracking and advertising controls in your iOS or Android settings. We build no advertising kits into the App, so there is nothing of ours for those controls to switch off.
Blocking what is strictly necessary may stop parts of the service from working. You may not be able to stay signed in, start a rental, or receive rental notifications.
10. Third-Party Processing and International Transfers
The providers named in Section 5 process personal data on our instructions. Our analytics provider holds its data in the European Union, and our error reporting provider in Germany.
Google, Apple, Stripe and Cloudflare are international companies, and parts of their processing happen outside the EEA, including in the United States. The safeguards we rely on for transfers outside the EEA are set out in Section 6 of our Privacy Policy, which also lists every provider we use, including those that are not device technologies and so are not in this policy.
11. Do-Not-Track
There is no single accepted technical standard for Do-Not-Track and similar browser signals, and we do not act on them. It makes little practical difference here: our website runs no tracking at all, so there is nothing for such a signal to switch off. In the App, the Usage analytics switch in Settings is the control.
12. Your Rights
You have rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw consent at any time. Withdrawing consent does not affect what we did lawfully before you withdrew it.
To exercise a right, write to [email protected]. To delete your account, see Account Deletion.
You can also complain to the Croatian Personal Data Protection Agency (AZOP), azop.hr, or to the supervisory authority in the EU or EEA country where you live.
13. Policy Updates
We update this policy when our technology or the law changes, and we publish the current version with its date.
In this version we rewrote Section 5, which had listed technologies we do not use on the website and had left out analytics, session replay, error reporting, push notifications and QR scanning. We corrected Section 3.1, which had described website cookies that do not exist. And we corrected Section 7, which had given a twelve month life for a choice that in fact has no expiry.
14. Contact
Unlokie d.o.o.
Rožmanići 23B
51221 Kostrena
Croatia
OIB: 87513636162
Email: [email protected]