Privacy notice
Quitbloom is an app that helps you quit smoking, heated tobacco and vaping, and stay quit. This notice explains which data is processed when you use the app, why, who it is shared with, and what your rights are. If this English version and the Turkish version differ, the Turkish version applies.
For all of the app's data practices see the privacy policy; to delete your account and data see delete account and data.
- We don't ask for your name, email or phone number. You don't have to create an account.
- Your answers about your smoking, heated tobacco or vaping habits count as health data. We only send them to our servers if you give explicit consent.
- If you don't consent, you can still use the app in full. Your answers stay on your device and your plan is prepared there.
- Your data is never used for ads and never sold.
- You can withdraw your consent at any time in Settings. When you do, your health data on our servers is deleted.
1. Data controller
Your personal data is processed by Görkem Karadoğan as the data controller. "We" in this notice means the data controller.
Contact and requests: privacy@quitbloom.com
2. Data we process
Health data (special category personal data)
The data below counts as special category personal data (health data) under Article 6 of the KVKK. We only send it to our servers if you have given explicit consent:
- Your answers to the starting questions: the products you use (cigarettes, roll-your-own, heated tobacco, vape), how much you use per day, what you spend, how soon after waking you first use, and how ready you are to quit.
- The dependency level calculated from these answers and your personal quit plan.
- What you record while using the app: cravings and their intensity, triggers, mood, slips, daily check-ins and use of the in-the-moment support tools.
This data is stored under a randomly generated account ID, not under your name or email.
Other personal data
- Account data: an anonymous account ID created when you first open the app. We don't ask for your name, email or phone number.
- Preferences: language, country, time zone, currency and notification preferences.
- Consent records: which consent you gave or withdrew, for which text version, and when.
- Technical records: the time, outcome and size of AI requests (the request and response text is not stored), and technical connection details such as your IP address and device information when you connect to our servers.
The app does not currently collect analytics. If we add analytics, we will ask for your permission separately and update this notice.
3. Why we process it
- To prepare a quit plan based on your answers.
- To show your progress (time smoke-free, money saved, milestones) and keep your data across your devices.
- To record your consent decisions and act on them.
- To keep the service secure, limit misuse and excessive AI requests, and fix errors.
- To meet our legal obligations and respond to your requests.
Your data is never used for advertising or marketing and is never sold. The app does not give medical advice; the plan it prepares is not a health assessment.
4. How we collect it and legal basis
Your data is collected electronically and automatically, through the answers and records you enter in the app.
| Data | Legal basis |
|---|---|
| Health data (section 2) | Your explicit consent (KVKK art. 6), given on the "Shall we personalise your plan?" screen in the app. |
| Transfer abroad (section 5) | Your explicit consent (KVKK art. 9), recorded separately on the same screen. |
| Account data, preferences | Necessary for us to provide the service (KVKK art. 5/2-c). |
| Consent records | Compliance with our legal obligations (KVKK art. 5/2-ç). |
| Technical records | Our legitimate interest in keeping the service secure, provided it does not harm your fundamental rights and freedoms (KVKK art. 5/2-f). |
Consent is optional. If you don't consent, you can still use the app in full: your answers don't leave your device and your plan is prepared on your device. In that case no health data is sent to our servers.
5. Who we share it with and transfers abroad
We only share your data with the service providers below, to the extent needed to run the service:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Servers and database: where your data is stored. | EU, Germany (Frankfurt) |
| Anthropic | Preparing your personal plan with AI (default provider). | USA |
| OpenAI | Preparing your plan with AI, only as a backup when the default provider is unavailable. | USA |
All of these providers are outside Turkey. Your data is therefore transferred abroad based on the explicit consent you give under Article 9 of the KVKK. AI providers only receive the answers needed to prepare your plan;your name and email are not sent.
Apart from this, we may only share your data with legally authorised public authorities, where the law expressly requires it and to the extent requested.
6. How long we keep it
- Health data: for as long as your consent stands and your account exists. When you withdraw consent or delete your account, your health data on our servers is deleted.
- Unused accounts: anonymous accounts that have not been opened for 12 months and are not linked to an Apple or Google account are deleted together with all their data on our servers. Data on your device is not affected.
- AI request records: 90 days.
- Consent records: for as long as your account exists; deleted when the account is deleted.
Data on your device is under your control. Deleting the app deletes the data on your device.
7. Withdrawing consent
You can withdraw your explicit consent at any time without giving a reason, in the app's Settings or by writing toprivacy@quitbloom.com. When you withdraw consent, your health data on our servers is deleted and no new health data is sent. You can keep using the app; from then on your plan is prepared on your device. Withdrawal does not affect processing carried out on the basis of your consent before that date.
8. Your rights (KVKK art. 11)
By applying to the data controller, you have the right to:
- learn whether your personal data is processed,
- request information about it if it has been processed,
- learn the purpose of processing and whether it is used for that purpose,
- know the third parties, in Turkey or abroad, to whom it is transferred,
- ask for it to be corrected if it is incomplete or inaccurate,
- ask for it to be deleted or destroyed under the conditions in Article 7 of the KVKK,
- ask for corrections, deletions and destructions to be notified to the third parties it was transferred to,
- object to an outcome against you that arises from analysis of your data exclusively by automated systems,
- claim compensation if you suffer damage due to unlawful processing.
How to apply
Send your request by email to privacy@quitbloom.com. Because your account is anonymous, we may ask for additional information to verify that the request is yours. Requests should follow the Communiqué on the Procedures and Principles of Application to the Data Controller.
We will respond free of charge within 30 days at the latest. If the request involves an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. If your request is rejected, you find the response insufficient, or we do not respond in time, you can complain to the Personal Data Protection Board under Article 14 of the KVKK.
9. Changes to this notice
We update this notice when we add new features or service providers to the app. If a change requires new consent, we will ask you again in the app.