Privacy Policy
Last updated: 7 October 2026 · For adults 18+
Your progress is personal. This policy explains what stays with you, what is processed to provide optional features, and how to exercise your rights.
1. Who is responsible
Mindreve: Quit Smoke AI operates Mindreve: Quit Smoking AI and is the data controller for the processing described here.
Privacy contact: support@mindreve.app. This policy covers the app and this official website. Third-party services have their own notices as well.
2. Data we use and why
| Category | Purpose and handling |
|---|---|
| Progress and habits | Quit date, smoking or vaping habits, spending inputs, triggers and slip entries provide your progress tools. Most of this information is kept on your device. |
| Anonymous app identifier | No account is required. An identifier supports app functionality and purchase entitlements. An identifier can be pseudonymous personal data even if it does not contain your name. |
| AI coach conversations | Messages and relevant context you choose to share are sent to Google Gemini through Firebase to generate replies. They are not processed exclusively on your device. |
| Optional selfie | Only with your explicit consent, a selfie is submitted for a one-time “Two futures” image transformation. Mindreve does not keep the submitted selfie. This feature is illustrative, not a medical prediction. |
| Purchase information | Apple and RevenueCat manage payment and entitlements. We receive entitlement and transaction information; we do not receive your complete payment card details. |
| Usage analytics | Anonymous usage analytics help us understand feature use and improve the app. Truly anonymised statistics are distinct from identifiers that can still be linked to a device. |
| Support requests | If you contact us, we use your email and what you send to answer the request. Please avoid unnecessary health details or selfies. |
3. AI, images and provider processing
The coach is optional habit support. Do not send information you would not want processed by an external AI service. Outputs may be inaccurate. Your inputs are not used to make legally significant automated decisions about you.
We ask for separate explicit consent before the selfie feature. Declining it does not stop you using other available features. Mindreve does not retain your submitted selfie or use it to identify you.
Our app-level handling does not imply that every AI provider has zero retention. Firebase AI Logic itself does not store content, but retention by the selected Gemini API provider and any enabled monitoring depends on the production configuration. The exact provider route, processing location and applicable retention details will be confirmed before this optional feature launches. See Firebase’s privacy information.
4. Legal bases and sensitive information
Where GDPR applies, we rely on providing the service you request for essential app functionality, consent for optional image processing and any processing that requires it, applicable legal obligations for records we must keep, and legitimate interests for proportionate security and support operations. Where health-related information is special-category data, we obtain explicit consent when legally required. Under KVKK, we use an applicable statutory processing condition or explicit consent as required, including for special-category data. You may withdraw consent prospectively by stopping an optional feature and contacting us; withdrawal does not affect processing already lawfully carried out.
5. Sharing, sale and international transfers
We do not sell your personal data or share it for cross-context behavioural advertising. Service providers process information needed to deliver their services: Google/Firebase for AI and supporting infrastructure, RevenueCat for entitlements, Apple for purchases, and Cloudflare for website delivery. We may disclose information when legally required or to protect rights and security.
Providers may process data outside your country. Where required, transfers must use an applicable lawful mechanism and safeguards, such as contractual clauses, an adequacy decision, or the mechanisms required by KVKK. Release-specific transfer and provider details will be reflected in this policy. We do not claim that a provider’s certification alone resolves all of our own obligations.
6. Retention and security
Local progress remains on your device until you remove it using available app or device controls. Device backups may have their own retention, and uninstalling the app does not cancel subscriptions or necessarily delete provider-held information. Selfies are processed once and not stored by Mindreve. Provider-side retention is described separately above.
Support correspondence is kept as needed to resolve the request and related obligations. Transaction and security records may be retained where required by law or necessary to handle a dispute. Retention periods and the final analytics configuration will be specified before release. We use reasonable technical and organisational measures, but no system can promise absolute security.
7. Your rights and deletion requests
Contact support@mindreve.app with “Privacy request” and tell us whether you want access, correction, deletion or another right. No Mindreve account is needed to request help. Include your anonymous app ID if available so we can locate relevant records; do not send a password, full payment details or a selfie. We may request proportionate identity verification. If we cannot link an anonymous record to you, we will explain that limitation and available options.
- EEA / UK: subject to applicable law, request access, correction, erasure, restriction, portability, or object to processing. Withdraw consent at any time. You may complain to your local data protection authority. Requests are ordinarily answered within one month; lawful extensions are explained. EU rights information.
- Türkiye / KVKK: under Article 11, ask whether data is processed, why and to whom it is transferred; request correction or qualifying deletion, notification of relevant recipients, object to adverse solely automated outcomes and seek compensation where applicable. We answer compliant requests within the statutory period, ordinarily 30 days. You may apply to the Personal Data Protection Board under applicable procedures. KVKK law.
- California: where CCPA/CPRA applies, request knowledge/access, correction, deletion, and limits on applicable sensitive information use; opt out of sale or sharing, and receive equal treatment when exercising rights. We do not sell or share for advertising and do not undertake that activity if a Global Privacy Control signal is enabled. Requests are ordinarily answered within 45 days, with any lawful extension explained. An authorised agent may act for you with appropriate verification. California rights information.
Some information may be retained under legal exceptions. We explain a refusal or limitation. Deleting data does not cancel an Apple subscription; cancel billing separately through Apple.
8. This website
The free calculator and timeline work in your browser. Their inputs are not uploaded, and we do not add advertising trackers to this website. The domain uses Cloudflare’s cookie-free Web Analytics for page-view and performance metrics; calculator inputs are not included. See Cloudflare Web Analytics information. Cloudflare may also process ordinary network data such as IP addresses and request metadata for delivery and security. External links, including Apple links, are governed by those services’ policies once you open them.
9. Adults only
Mindreve is intended only for people aged 18 and over. We do not knowingly collect personal data from children. Contact us if you believe a child has provided information so we can investigate and remove it where appropriate.
10. Changes
We publish material changes here and update the date. Where the law requires notice or renewed consent, we provide it before the relevant new processing.