TODO: Draft under legal review — not final. Items marked [TBD] need decisions before launch.

Privacy Policy — Quit Vaping Help

Last updated: [TBD — set at publish] · Operator: [TBD — legal entity name] · Contact: [TBD — privacy contact email]

1. What we collect

  • Account: email address (via Supabase Auth) — sign-in, account management.
  • Quit program: quit date, daily use, check-in times — run your quit plan.
  • Check-ins, SOS sessions, slips: streaks, progress, trigger patterns.
  • Journal: free text, encrypted before storage — your private reflection space.
  • Buddy pairing: friend code, pair link, per-field share flags — optional accountability.
  • Trigger spots (premium, opt-in): labels, coordinates, radius, crossing counts.
  • Payment: Stripe customer ID + subscription status — card numbers never touch us.
  • Technical: API token metadata, request logs — security, abuse prevention.

2. How we use your data

Check-ins, SOS support, streaks, milestones, personal trigger patterns, billing, and security. We do not sell your data. We do not use journal or health-adjacent data for advertising.

3. Who sees your data

You. Your buddy — only what you opt in per field (streak, today-status, milestones; journal, spots, and location are never shared). Processors (Supabase, Cloudflare, Stripe) under their own security commitments. Legal disclosure only if required, with notice unless barred.

4. Payments

Billing runs through Stripe hosted checkout. We never see, store, or transmit your card number.

5. Location data (trigger spots — premium, opt-in)

Only if you create spots and grant background location. Delete any spot anytime; deleting a spot deletes its crossing history too.

6. Health-adjacent data and security

TLS in transit, encryption at rest, row-level security, application-layer journal encryption, hashed API tokens. Quit Vaping Help is a coaching companion, not medical care. Severe withdrawal symptoms → talk to a doctor.

7. Children and teens [DECISION NEEDED]

TODO: age policy decision pending — this draft assumes 18+.

8. Retention and deletion

Data lives as long as your account. Delete anytime (settings or via our contact page); personal data deleted within 30 days except legally required billing records. Backups age out within 90 days.

9. Your rights

Access, correct, export, or delete your data: reach us via our contact page — response within 30 days.