Privacy Policy

Quit Path, [Your registered business address], United Kingdom. Company number: [Company number, if you register a limited company].

For any privacy question or request, email privacy@quitpath.co.uk.

Account data: your email address, display name and password (stored only as a secure hash, never in readable form). If you sign in with Google, we receive your email address, name and profile picture from Google.

Quit data you enter: your quit date, how much you spent on vaping, puffs and nicotine per day, your written reasons for quitting, daily check-ins including mood ratings and notes, logged cravings including intensity and time, and any supporters you add (their name, email and relationship to you).

Billing data: your subscription status, plan, renewal date and a Stripe customer reference. We never see or store your full card number — Stripe processes card details directly.

Technical data: basic logs needed to run and secure the service, such as timestamps and error reports.

We do not use advertising trackers, we do not run third-party analytics profiling, and we never sell your data.

Information about your nicotine use, cravings and mood can be considered health data, which is a special category of personal data under UK GDPR and gets extra protection.

We process it only because you give us your explicit consent by entering it, and only to provide the service you have asked for: your dashboard, statistics, coaching and programme. You can withdraw that consent at any time by deleting the entries or your account.

To provide the service and your account — legal basis: performance of our contract with you.

To take payment and manage your subscription — legal basis: performance of our contract, and our legal obligations for tax and accounting records.

To keep the service secure and prevent abuse — legal basis: our legitimate interests in protecting the service and its users.

To store and display your health-related quit data — legal basis: your explicit consent.

To send service emails such as sign-up confirmation, password resets, receipts and important changes — legal basis: performance of our contract. Marketing emails are only sent if you opt in, and you can opt out at any time.

Supabase — our database, authentication and hosting provider, which stores your account and quit data.

Stripe — payment processing, billing, invoices and tax. Stripe is a separate controller for payment data under its own privacy policy.

Google — only if you choose to sign in with Google.

Lovable — the platform that hosts and serves the application.

We may also disclose data where we are legally required to. We do not sell your personal data or share it with advertisers.

Some of these providers process data outside the UK. Where that happens, transfers are protected by UK-approved safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Account and quit data: for as long as your account is open. If you delete your account, we delete your personal data within 30 days, except where we must keep records for legal reasons.

Billing records: kept for six years to meet UK tax and accounting requirements.

Security and error logs: typically kept for up to 90 days.

If your account stays inactive with no membership for 24 months, we may delete it after emailing you first.

Data is encrypted in transit and at rest by our infrastructure providers. Access to your quit data is enforced at database level: each record is tied to your account, so no other user can read it.

Passwords are hashed and never stored in a readable form. Access to production systems is limited to those who need it.

No system is completely secure. If a breach occurs that is likely to risk your rights and freedoms, we will notify the ICO within 72 hours and tell you where required.

You have the right to access a copy of your data, to have inaccurate data corrected, to have your data erased, to restrict or object to processing, to data portability, and to withdraw consent at any time.

To exercise any of these, email privacy@quitpath.co.uk. We will respond within one month. You can also delete your quit data and close your account from within the app.

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

The service is intended for people aged 16 and over. We do not knowingly collect data from anyone under 16. If you believe a child under 16 has given us data, contact us and we will delete it.

If we make a significant change, we will email you or show a notice in the app. The date at the top of this page always reflects the current version.