Privacy Policy

1. Who We Are

VapeShift is a quit-vaping app published on Google Play by Rizon Labs ("we", "us"). Questions and requests go to vapeshiftapp@gmail.com.

2. What Stays on Your Device

Without an account, the things you type or log are saved in the app's storage on your phone and aren't uploaded to us. That includes your first name, quit date, vape type, nicotine strength, spending, savings goals, cravings, puffs, slips and their notes, daily check-ins, and pledges. The only exception is the limited analytics details described in section 5.

The in-app coach is scripted and runs on your device. The home screen widget, reminders and Craving Radar alerts are also created on your device. The optional back-tap shortcut reads the motion sensor on your device, and those readings are not stored or sent anywhere.

The app does not request location, camera, microphone or contacts permissions.

3. What Leaves Your Device

VapeShift connects to these outside services:

These services also receive your IP address as a normal part of any internet connection. All of them are reached over encrypted connections (HTTPS). Each handles data under its own privacy terms, including Google, RevenueCat and Supabase.

4. Ads and Your Advertising ID

VapeShift shows banner, full-screen, app-open and rewarded ads through Google AdMob. Google's ad software uses your Android advertising ID and the data listed above to deliver and measure ads, and to prevent fraud. It can estimate your general location from your IP address. Ads may be personalised where the law and your choices allow it.

We don't put your name, cravings, slips or other entries into ad requests. Ad providers can tell that a request came from VapeShift, a quit-vaping app.

Your choices:

• In the EEA, UK, Switzerland and other regions where it's required, the app asks for your consent to ads. You can change your choice in Settings under "Manage ad privacy".
• On Android, you can reset or delete your advertising ID in your device settings, usually under Privacy → Ads.
• VapeShift Pro removes ads.

5. Usage Analytics

VapeShift includes Google Firebase Analytics so we can see which features help and where people get stuck. When active, it records events such as onboarding steps, screens and features opened, paywall views and purchases, and lessons or pledges completed.

Some events carry details about your quit journey: nicotine strength, vape type, a dependence band, projected savings, how long ago a slip happened, a check-in mood, and plan or streak numbers. Searches typed into Quit Tools are also sent as text, so please don't type personal details there. Firebase also collects an app-instance ID, your advertising ID, a masked IP address for coarse location, and app lifecycle and in-app purchase events on its own.

We don't attach your name, email or account ID to analytics. This data isn't anonymous, though, because it's linked to the app-instance ID.

To turn it off: switch off "Usage analytics" in Settings, under Privacy. This option is in app versions after 1.1.1, so update the app if you don't see it.

6. Purchases

VapeShift Pro, tips and themes are sold through Google Play. Google processes your payment, and we never see your card details. We use RevenueCat to check what you've bought. RevenueCat receives a random ID created by the app, along with your purchase and subscription details. We don't send it your name or email.

7. Optional Account and Cloud Sync

You only need an account for Buddy, Community and cloud backup. Supabase stores it for us. If you create one:

• Account details: your email, password, name and username are stored. Your password is handled by Supabase's sign-in service.
• Progress backup: while you're signed in, the app automatically uploads a copy of your saved progress shortly after it changes. This includes your profile, cravings, slips and notes, check-ins and reflections, savings goals, pledges, and other saved app data.
• Puff log: if you use the puff tracker while signed in, each puff's time and trigger are stored so that your devices stay in step.
• Taper groups: if you use the puff tracker while signed in, the app reports whether you met today's goal. The app shows your group totals only, such as how many people hit their goal.
• Notifications: if you allow them, your push token is stored so we can send buddy messages and progress summaries.

Signing out stops the uploads but doesn't delete what's already stored. See section 11 to delete it.

8. What Other People Can See

• Community: other users see your posts, username, days clean and reactions. Don't post anything you want to keep private.
• Buddy: your buddy sees your name, username and days clean. Once paired, the app automatically nudges your buddy when you resist a craving or log a puff, and you can send messages.
• Accountability partner: signed-in users can look up an account by username. If you add a partner, they're told so. If you choose to notify them of a slip, the message includes your name and how long your streak was.

9. Referrals, Links and Sharing

Referrals: the app creates a random ID, not tied to your name, to count invites. It's sent to Supabase when the Progress screen loads your invite count, when you send an invite, and when you enter a code.

Quit Tools: product links open in your browser and pass through our link service on Netlify to Amazon. They may be affiliate links, so we may earn a commission. Amazon's own privacy terms apply once you're there.

Sharing and backups: if you share a card or save a backup file, it goes where you send it. A backup file contains your full progress and isn't encrypted, so keep it somewhere safe. Android may also include app data in your device's Google backup, depending on your device settings.

AI: AI features are switched off. VapeShift doesn't send your data to any AI provider. If that changes, we'll update this policy first.

10. How Long We Keep Data

• On your device: until you reset the app or uninstall it.
• Account and cloud data: until you ask us to delete it. We don't delete inactive accounts automatically.
• Analytics: event-level data for up to 14 months.
• Purchases: as long as needed to provide what you bought and to meet tax and accounting rules. Google and RevenueCat also keep their own records.
• Ads: under Google's own retention practices.

11. Deleting Your Data and Account

To delete your VapeShift account: email vapeshiftapp@gmail.com from your account's email address, with the subject "VapeShift account deletion". We'll delete your account, profile, cloud backup, puff log, taper group reports, buddy data, nudges, Community posts and reactions within 30 days, and tell you when it's done.

We may keep limited records where the law requires it or to prevent fraud. Purchase records held by Google and RevenueCat are kept under their own rules. Analytics and advertising data aren't linked to your account, so we can't find them from your email.

To delete data on your phone: use "Reset all progress" in Settings, or uninstall the app.

Reset, sign-out and uninstalling do not delete your cloud account. Deleting your account doesn't cancel a subscription either. To cancel, go to Payments & subscriptions in Google Play.

12. Your Rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your data, and to object to or limit how it's used. Email us and we'll respond within 30 days. You can also complain to your local data protection authority.

If you're in the EEA or UK, we rely on your consent for personalised ads, and for account data you choose to give us, including health-related quit data. We rely on performing our agreement with you to provide the app and purchases, and on our legitimate interests for improving it and preventing fraud. You can withdraw consent at any time.

We don't sell your data for money. Some US state laws treat personalised advertising as a "sale" or "sharing" of data. You can opt out using the advertising choices in section 4.

Our service providers may process data in countries other than yours, including the United States, where privacy laws may differ.

13. Security

Data sent by the app travels over encrypted connections. No system is perfectly secure, so we can't guarantee that data will never be exposed. Please use a unique password for your account.

14. Children's Privacy

VapeShift is intended for adults aged 18 and over. We don't knowingly collect data from anyone under 18. If you believe a child has created an account, email us and we'll delete it.

15. Changes to This Policy

If we change this policy, we'll update the date at the top of this page. For significant changes, we'll also give notice in the app or its release notes.

16. Contact