Privacy policy
Quitbloom is an app that helps you quit smoking, heated tobacco and vaping, and stay quit. This policy explains what data the app collects, why, who processes it, how long it is kept and what your rights are. It applies to the Quitbloom iOS and Android apps and to quitbloom.com.
If you are in Turkey, the KVKK privacy notice (Turkish original:Aydınlatma metni) also applies.
- We don't ask for your name, email or phone number. The app works with an anonymous account.
- Your answers about your smoking, heated tobacco or vaping habits are health data. They only leave your device if you give explicit consent.
- If you don't consent, you can still use the app in full. Your plan is then prepared on your device.
- We don't sell your data and don't use it for advertising.
- You can withdraw consent and delete your data at any time.
1. Who is responsible
The data controller is Görkem Karadoğan. "We" in this policy means the data controller. For any privacy question or request, write toprivacy@quitbloom.com.
2. Data we collect
| Category | What it includes | When |
|---|---|---|
| Health data (special category) | Your answers to the starting questions (products you use, how much, what you spend, how soon after waking you first use, how ready you are), the dependency level and quit plan calculated from them, and what you record in the app (cravings, triggers, mood, slips, daily check-ins, use of the support tools). | Only sent to our servers if you give explicit consent. Otherwise it stays on your device. |
| Anonymous account ID | A random ID created when you first open the app. It is not linked to your name or email. | Always, so the app can store your data and keep it in sync. |
| Preferences | Language, country, time zone, currency, notification settings. | Always. |
| Device and notification token | Platform (iOS or Android), app version and the push notification token issued by Apple or Google. | If you allow notifications. |
| Purchase status | Whether you have an active subscription, which product, which store and when it expires. Payment is handled by Apple or Google; we never see your card details. | If you subscribe. |
| Consent records | Which consent you gave or withdrew, for which text version, and when. | When you make a consent choice. |
| Technical records | Time, outcome and size of AI requests (the request and response text is not stored); IP address and connection details processed by our hosting provider. | When the app talks to our servers. |
| Messages to us | Your email address and what you write. | If you email us. |
If you use the supporter feature (inviting a friend to cheer you on), we also process the display name you choose for the invitation and a progress summary (total smoke-free days and milestones). Supporters never see your health records. Sharing your streak or a "hard day" signal is off by default and needs your separate permission.
Analytics
The app does not collect analytics today. We plan to add product analytics later. It will only run if you agree, on a separate screen, and analytics about health-related actions will need a separate consent. Analytics will never include free text you type.
3. Why we use it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Preparing your personal quit plan with AI and storing your progress (health data) | Your explicit consent: KVKK art. 6, GDPR art. 6(1)(a) and 9(2)(a). |
| Sending your answers to AI providers in the USA | Your explicit consent: KVKK art. 9, GDPR art. 49(1)(a). |
| Running your account, syncing, notifications, subscription status | Necessary to provide the app you asked for: KVKK art. 5(2)(c), GDPR art. 6(1)(b). |
| Keeping consent records, answering requests | Legal obligation: KVKK art. 5(2)(ç), GDPR art. 6(1)(c). |
| Security, preventing misuse, limiting AI requests, fixing errors | Legitimate interest: KVKK art. 5(2)(f), GDPR art. 6(1)(f). |
| Analytics and ad measurement, if added | Your consent (and on iOS, your App Tracking Transparency permission for ad measurement). |
We don't sell your data, don't show ads in the app and don't use your health data for advertising. The app does not give medical advice and the plan is not a health assessment.
4. Who processes your data
We use these service providers. They process data on our behalf and only for the purpose listed.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, anonymous accounts and server functions. Your data is stored here. | EU (Frankfurt, Germany) |
| Anthropic | Preparing your plan with AI (default). Receives only the answers needed, without name or email. | USA |
| OpenAI | Backup AI provider, only used when the default provider is unavailable. Same data as above. | USA |
| Cloudflare | Hosting quitbloom.com and forwarding email sent to privacy@quitbloom.com. | Global network |
Providers we may use
The following are not in use today. If we use them, they will receive only the data listed here, and anything that needs your consent will be asked for in the app first.
| Provider | Purpose, if used | Location |
|---|---|---|
| RevenueCat | Managing subscriptions: anonymous account ID and purchase status. | USA |
| Apple Push Notification service, Google Firebase Cloud Messaging | Delivering notifications: notification token and the notification itself. | USA |
| PostHog | Product analytics, only with your consent. | EU (Frankfurt, Germany) |
| Attribution provider (Airbridge or Singular) | Measuring which ad led to an install or purchase, only with your consent. Install and purchase events (never health data) may then be shared with the ad platforms we advertise on. | Stated here once a provider is chosen |
Apple and Google process payments and app downloads under their own privacy policies. We may also disclose data to public authorities where the law requires it.
5. International transfers
Your data is stored in the EU. When you consent, the answers needed for your plan are sent to AI providers in the USA, without your name or email. This transfer is based on your explicit consent. If you don't consent, nothing is sent.
6. How long we keep it
| Data | Kept for |
|---|---|
| Health data | While your consent stands and your account exists. Deleted from our servers when you withdraw consent or delete your account. |
| Unused accounts | Anonymous accounts not opened for 12 months and not linked to an Apple or Google account are deleted with all their server data. Data on your device is not affected. |
| AI request records | 90 days. |
| Account ID, preferences, notification token, purchase status, consent records | While your account exists. Deleted when the account is deleted. |
| Analytics events, if added | 24 months. |
| Emails to us | As long as needed to handle your request and show that we did. |
When an account is deleted we keep only a one-way hash of the account ID and the date, as proof that the deletion was done. Deleting the app removes the data on your device.
7. Your rights
Under the GDPR (articles 15 to 22) and the KVKK (article 11) you can ask us to:
- tell you whether we process your data and give you a copy (access),
- correct inaccurate data (rectification),
- delete your data (erasure),
- limit how we use it (restriction),
- give it to you in a machine-readable format (portability),
- stop processing based on legitimate interest (objection),
- not subject you to decisions made only by automated processing that significantly affect you; the AI plan is a suggestion you can change, not such a decision,
- tell you which third parties received it, and compensate damage caused by unlawful processing (KVKK).
Write to privacy@quitbloom.com. We reply free of charge within 30 days. Because accounts are anonymous, we may ask for information to confirm the request is yours. You can also complain to the Turkish Personal Data Protection Authority (KVKK) or to the data protection authority in your EU country.
8. Withdrawing consent and deleting your data
You can withdraw consent at any time without giving a reason. When you do, your health data on our servers is deleted and no new health data is sent. You can keep using the app; your plan will be prepared on your device. Withdrawal does not affect processing done before it.
To delete your account and all your data, see Delete account and data.
9. Security
Data is encrypted in transit. On our servers, access rules ensure each account can only read its own data, and supporters can never read health records. Apart from the display name you may choose for a supporter invitation, our database holds no names, emails or free text.
10. Children
Quitbloom is not intended for anyone under 18. We don't knowingly collect data from children. If you believe a child has used the app, write to us and we will delete the data.
11. Changes
We will update this policy when the app or our providers change, and change the effective date above. If a change needs new consent, we will ask you in the app.