Privacy Policy

Fewlaps SL ("Fewlaps", "QuitNow", "we", "our" or "us") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, store, use, share and transfer data that identifies you or is associated with you ("personal information").

QuitNow helps people quit smoking. The QuitNow app (the "App") shows your progress since you quit: the time that has passed, the cigarettes you have not smoked, the money you have saved, and how your health improves. It also offers tools to get through cravings, a course, live sessions with experts, and a community of people who are quitting too. QuitNow is not a medical service and does not replace the advice of a doctor or other health professional.

This Privacy Policy applies to the App, to QuitNow for Business, and to our website at www.quitnow.app (the "Site"), together the "Service". Please read it before you use the Service.

1. Who is responsible for the use of your personal information

1.1. Fewlaps SL, Carrer de Dos de Maig 277, 1-1, 08025 Barcelona, Spain, is the controller of the personal information we hold about you in connection with your use of the Service. This means that we decide how it is used and we are responsible for it. You can contact us at core@quitnow.app. 

2. Personal information we collect from you and how we use it

2.1. This section lists every kind of personal information we may hold about you, where it comes from and what we use it for. Some of it you give us directly. Some is collected automatically when you use the Service. Some is collected by third-party services built into the App. Section 4 describes in general terms who we share personal information with; here we also name the specific providers involved.

2.2. Using QuitNow without an account. You can use the App without creating an account. If you do, the quit details you enter stay on your device and are not stored on our servers. The information described in 2.14 (usage data, crash reports and advertising) is still collected, because it comes from the App itself.

2.3. Account information. When you create an account, we store:

1. your nickname, your email address and your password. We store the password only in hashed form, never the password itself;

2. if you sign up or log in with Google, Facebook or Apple, the identifier that service gives your account, and the name and email address it shares with us. With Apple, this can be a private relay address;

3. your language, your currency, and the country we detect from your IP address when you sign up;

4. the platform (Android, iOS or web) and App version you signed up with, and the dates you signed up and activated your account;

5. whether your account is activated, banned or has QuitNow PRO.

2.4. Your quit data. This is the date of your last cigarette, how many cigarettes you smoked a day, how many come in a pack, and what a pack costs. If you have an account, we keep a copy on our servers. That lets you restore your progress on another device, and lets others see it according to your visibility settings (2.5).

2.5. Your profile. Everything here is optional: a profile picture, a short bio, and a location that you type yourself (we never take it from your device). You choose who can see your profile: only you, your buddies, or everyone. Profile pictures are stored with Amazon Web Services in the European Union (Ireland).

2.6. Community.

1. For messages you post in the community chat, we store the text, the date and the chat room, which depends on the language. Everyone in that room can see them, together with your nickname and profile picture.

2. When someone mentions you, we record the mention so we can notify you. 

3. For reports you file about other members, we store who you reported, the reason, the message concerned, any comment you add, and the platform you used.

4. We also store reports other members file about you, and any moderation action taken on your account, such as a temporary or permanent ban. When we ban or unban an account, a message in the chat announces it with the account's nickname. 

5. Some bans are automatic: an account can be banned without a person reviewing it first, for example when it receives many reports, when its nickname or email address matches patterns we block, or when it uses a device linked to a banned account. If you think an automatic ban is wrong, write to core@quitnow.app and a person will review it. 

2.7. Buddies. We store the buddy invitations you send and receive, whether they were accepted, and when. Your buddies can see your quit progress.

2.8. Devices and sign-in sessions.

1. Each time you sign in on a device, we record:

   • the device name and operating system;

   • an identifier the App generates for that installation;

   • your IP address;

   • the approximate location (city, region and country) that our network provider, Cloudflare, derives from that IP address;

   • when the session started;

   • when it was last used, and the approximate location at that time.

2. We use this to:

   • show you your active sessions and let you close them remotely;

   • alert you by email and push notification when a new device signs in to your account;

   • stop banned users from coming back;

   • investigate abuse.

3. To send you push notifications, we store your device's push token, name, and platform. Notifications are delivered through Google Firebase Cloud Messaging and, on iPhone, Apple's push notification service.

2.9. Purchases. We never see or store your card details.

1. Apple or Google process purchases made in the App Store or Google Play. We manage subscriptions with RevenueCat. RevenueCat receives:

   • a random identifier we create for you (not your name or email);

   • your purchase history from the store;

   • some details that do not identify you, such as which screen led to the purchase and which version of our purchase screen you saw.

2. Stripe processes purchases made on our Site. It receives your email address and that same random identifier. You enter your payment details directly with Stripe.

3. We store your RevenueCat and Stripe customer identifiers and whether you have QuitNow PRO.

2.10. Promo codes and gift cards. When you redeem a code, we record when you did it, which campaign and organisation it belongs to, and the approximate location (city, region and country) derived from your IP address. The organisation that issued the code can see that it was redeemed, when, from which country, and the random identifier described in 2.9. It never sees your name, nickname or email address.

2.11. Live sessions.

1. If you send a question during a live session, we send its text to OpenAI to correct typos and summarise it. The text, the summary, and the approximate location (city, region, and country) from your IP address then go to our team's internal messaging tool, so the expert can answer. Questions are not linked to your account.

2. Live sessions are streamed through YouTube, so YouTube (Google) may collect information when you watch them, under its own privacy policy.

2.12. When you contact us. If you use the contact form on our Site, we receive your name, email address and message through our team's internal messaging tool. If you email us, we keep the conversation.

2.13. Business accounts. If you use QuitNow for Business, we store:

• your name and email address;

• your password, in hashed form;

• the organisation you belong to and your role in it;

• the invitations you send and receive, including the email addresses of the people you invite.

2.14. Information collected automatically.

1. By our servers.

   • Every request the App makes to our servers passes through Cloudflare. Cloudflare protects our servers and tells us the approximate location of your IP address.

   • In our diagnostic logs we never store your IP address. We store only a keyed hash of it, which lets us tell requests from the same address apart but cannot be turned back into the address.

   • Those logs also record your account ID (a number, never your nickname or email), country, App version and platform. Our logging provider, Better Stack, processes them.

   • To block disposable email addresses, we may send the domain of your email address (for example gmail.com) to OpenAI, never the full address.

   • To check that requests come from a genuine copy of the App, we use Google Play Integrity on Android and Apple App Attest on iPhone and iPad.

2. By the App, through third-party services.

   • Google Firebase Analytics: which features and screens you use, and events such as finishing the setup (including the cigarettes per day, cigarettes per pack, pack price and currency you entered), buddy requests and purchases, plus information about your device and the App. We do not send Firebase your account ID, nickname or email.

   • Amplitude: for some users and features, such as live sessions, similar usage events, how many times you have opened the App, your subscription status and your account ID. Never your nickname or email. Amplitude stores this data in the EU.

   • Firebase Crashlytics: crash reports with your device model, operating system version, what the App was doing when it crashed, and your account ID.

   • Firebase Remote Config: lets us change settings and test variations of the App, using an identifier for your installation.

   • Advertising, in the free version: Google AdMob shows ads, working with Meta Audience Network and Liftoff Monetize. These networks collect your device's advertising identifier, IP address, device information and how you interact with the ads. Ads are personalised only if you allow it: on iPhone through Apple's tracking prompt, and where the law requires it through a consent form you can reopen from the App settings. Section 10 explains how to limit your advertising identifier.

   • We also tell RevenueCat which ads were shown to you, whether you tapped them and how much they earned, linked to the random identifier described in 2.9. 

3. Device permissions. The App only asks for these when you use the feature that needs them:

   • camera: to take a profile picture or scan a gift card QR code;

   • photos: to choose a profile picture or save an image you want to share;

   • calendar: to add a live session;

   • contacts: only to add a quitline's phone number to your contacts, when you choose to. We do not read or upload your address book;

   • notifications.

2.15. How we use this information. We use it:

1. to provide the Service: your account, syncing your progress, the community, buddies, purchases, and promo codes and gift cards;

2. to keep the Service safe: moderating the community, stopping spam, fake accounts and banned users, and spotting unusual sign-ins;

3. to send you service messages: activating your account, recovering your password, sign-in alerts, purchase receipts, confirming an account deletion, and answering you when you contact us;

4. to understand and improve the Service: usage statistics, crash reports and testing new versions of the App;

5. to show ads in the free version;

6. to meet our legal obligations and be able to show what we did. We keep a record of moderation actions and of every personal data download.

2.16. If you choose not to provide some personal information, we may not be able to provide those parts of the Service to you or answer your requests.

2.17. We may link the information you give us with the information we collect automatically. This lets us provide a consistent experience however you use the Service.

2.18. We may anonymise and aggregate any of the personal information we collect, so that it no longer identifies you. We may use anonymised information to test our IT systems, for research and data analysis, to improve the Service and to develop new products and features. We may also share anonymised, aggregated information with others.

3. Data retention

3.1. Unless this section says otherwise, we keep the information described in section 2 for as long as you have an account.

3.2. When you delete your account (see section 8):

• we delete your nickname, email address, name, password, bio, location, quit data, social login identifiers and profile picture;

• we erase your community messages, remove your buddies, end every session and delete your push tokens;

• we ask RevenueCat and Stripe to remove your personal data, and we cancel any subscription on our Site.

3.3. Some information remains after you delete your account:

• a record under your account ID that no longer contains your name, nickname or email address. It holds your language, currency, country, sign-up date and platform, and the random identifiers used with RevenueCat and Stripe;

• the codes you redeemed, the reports you filed, and the identifiers of the devices you signed in from;

• the moderation records about the account;

• if the account was banned, a hash of its email address, so that address cannot be used to sign up again.

3.4. The third-party services named in section 2 keep information for these periods:

• Google Analytics for Firebase: event-level usage data is deleted after 2 months. Data linked to your installation of the App is deleted 14 months after you last use it. After that, only aggregated reports that do not identify you remain.

• Firebase Crashlytics: crash reports are deleted after 90 days.

• Amplitude: usage events are deleted 12 months after they are recorded.

• Better Stack: diagnostic logs are deleted after 6 months.

3.5. We may need to keep some personal information for longer if the law requires it.

4. Recipients of personal information

4.1. We may share your personal information with the following:

1. Live session experts: If you send a question during a live session, the expert who answers it receives its text and the approximate location described in section 2.11, not your name or your account. 

2. Other service providers and advisors: We may share your personal information with third-party vendors and other service providers that perform services for us or on our behalf, which may include providing professional services, such as legal and accounting services, mailing, email, or chat services, fraud prevention, cloud or web hosting, or providing analytic services. Section 6.2 names the main ones.

3. Advertising partners: In the free version of the App, Google AdMob and its partners Meta Audience Network and Liftoff Monetize receive your device's advertising identifier, your IP address, information about your device and how you interact with the ads. They use it to show you ads and to measure them (see section 2.14). They process this information under their own privacy policies: Google, Meta and Liftoff. Ads are personalised only if you allow it, and section 10.5 explains how to change your choice.

4. Third parties at your request: For example, you may have the option to share your content with other users of the Service.

5. Affiliates: Other companies owned by or under common ownership as QuitNow, including our subsidiaries (i.e., any organization we own or control) ultimate holding company (i.e., any organization that owns or controls us), and any subsidiaries it owns. These companies will use your personal information in the same way as we can under this Privacy Policy.

6. Purchasers and third parties in connection with a business transaction: Your personal information may be disclosed to third parties in connection with a transaction, such as a merger, sale of assets or shares, reorganization, financing, change of control, or acquisition of all or a portion of our business.

7. Law enforcement, regulators, and other parties for legal reasons: We may share your personal information with third parties as required by law or if we reasonably believe that such action is necessary to (i) comply with the law and the reasonable requests of law enforcement; (ii) detect and investigate illegal activities and breaches of agreements, including our Terms of Service; and/or (iii) exercise or protect the rights, property, or personal safety of QuitNow, its users or others.

8. Organisations that issue promo codes: When you redeem a code, the organisation that issued it can see that it was redeemed, when, from which country, and a random identifier that is not your name, nickname or email address (see section 2.10). 

5. Marketing and advertising

5.1. From time to time we may contact you (by email or via push notifications) with information about our products and services, including sending you marketing messages and asking for your feedback on our products and services.

5.2. For some marketing messages, we may use personal information we collect about you to help us determine the most relevant marketing information to share with you.

5.3. If you are an EEA or UK-based user, we will only send you marketing emails if you have given us your consent to do so.

5.4. You can withdraw your consent at a later date by clicking on the unsubscribe link at the bottom of our marketing emails or by updating your preferences via the App settings. You can also disable push notifications via the App settings.

6. Protecting, storing, and transferring your personal information

6.1. We apply appropriate technical and organisational measures to protect your personal information against accidental or unlawful destruction, loss, alteration or damage. The personal information we store ourselves is kept on secure servers at our hosting provider. We will never send you unsolicited emails or call you asking for your password, your card details or your identity documents. 

6.2. Fewlaps is based in Spain. Some of the service providers named in section 2 store or process personal information in other countries:

1. Inside the European Economic Area:

   • DigitalOcean hosts our servers and database, in Amsterdam, the Netherlands;

   • Amazon Web Services stores profile pictures and sends our emails, in Ireland;

   • Better Stack stores our diagnostic logs, in Frankfurt, Germany;

   • Amplitude stores usage data in its EU data centre.

2. Outside the European Economic Area, mainly in the United States:

   • Google: Firebase (Analytics, Crashlytics, Cloud Messaging and Remote Config), AdMob, Play Integrity, YouTube and Sign in with Google. We also use Gmail to send our emails when Amazon's service is unavailable;

   • Apple: push notifications on iPhone, Sign in with Apple and App Attest;

   • Meta: Facebook login and Meta Audience Network;

   • Liftoff: Liftoff Monetize ads;

   • RevenueCat: in-app subscriptions and ad revenue tracking;

   • Stripe: payments on our Site;

   • Slack: our team's internal messaging tool;

   • Cloudflare: its global network handles every request to our servers;

   • OpenAI: the processing of text described in 2.11 and 2.14.

6.3. When personal information leaves the European Economic Area or the United Kingdom, we make sure it is protected in one of the ways the law allows:

1. the destination has been recognised as offering an adequate level of protection. For the United States, this applies to companies certified under the EU–US Data Privacy Framework and, for users in the United Kingdom, its UK Extension; or

2. the provider has signed the standard contractual clauses adopted by the European Commission, together with the UK Addendum for users in the United Kingdom.

You can ask us which safeguard applies to a provider, and for a copy of it, by writing to core@quitnow.app.

7. Your control over your information

7.1. Profile and Data Sharing Settings. You may update your profile information, such as your profile photo, location, and bio, and may change some of your data sharing preferences (e.g., your visibility settings) by accessing the "Preferences" in the App.

7.2. How to control your communications preferences. You can stop receiving promotional email communications from us by clicking on the “unsubscribe link” provided in such communications. We make every effort to promptly process all unsubscribe requests. You may not opt-out of service-related communications (e.g., account verification, transactional communications, changes/updates to features of the Service, technical and security notices).

7.3. Modifying your information. If you have any questions about reviewing or modifying information, you can contact us directly at core@quitnow.app. 

8. Delete your data

8.1. To delete your account on QuitNow, open the app and go to Home > Preferences > Account details > Delete account. The application will request your password in case you logged in with your email and password, or just a confirmation dialog in case you signed up with a social login like Facebook, Google, or Apple ID.

8.2. In case you can't use the app, delete your account by filling the form in https://goodbye.quitnow.app.

9. Disclosures for EEA users

9.1. Your rights with regard to your personal information.

9.2. If you are accessing the Service from the EEA or the UK, in accordance with applicable privacy law, you have the following rights in respect of your personal information that we hold:

1. Right of access. The right to obtain: (i) confirmation of whether, and where, we are processing your personal information; (ii) information about the categories of personal information we are processing, the purposes for which we process your personal information, and information as to how we determine applicable retention periods; (iii) information about the categories of recipients with whom we may share your personal information; and (iv) a copy of the personal information we hold about you.

2. Right of portability. You have the right, in certain circumstances, to receive a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format that supports re-use, or to request the transfer of your personal information to another person.

3. Right to rectification. You have the right to obtain rectification of any inaccurate or incomplete personal information we hold about you without undue delay.

4. Right to erasure. You have the right, in some circumstances, to require us to erase your personal information without undue delay if the continued processing of that personal information is not justified.

5. Right to restriction. You have the right, in some circumstances, to require us to limit the purposes for which we process your personal information if the continued processing of the personal information in this way is not justified, such as where the accuracy of the personal information is contested by you.

6. Right to withdraw consent. If you have provided consent for the processing of your personal information, you have the right to withdraw your consent. If you withdraw your consent, this will not affect the lawfulness of our use of your personal information before your withdrawal.

7. If you have a QuitNow account, you can exercise your rights of access and portability yourself, at any time, without writing to us. In the App, go to Home › Preferences › Account details › Download your data. You will get a zip file with your data as readable text files, the same data in JSON format (a structured, machine-readable format), part of it also in the HL7 FHIR format used for health data, and your profile picture. It includes:

• your account and profile;

• your quit data;

• the devices registered to receive notifications;

• your buddies;

• the codes you redeemed;

• the reports you filed;

• every community message you wrote.

For anything the file does not include, such as your sign-in history, or if you have a QuitNow for Business account, write to us at core@quitnow.app.

9.3. You also have the right to object to any processing based on our legitimate interests where there are grounds relating to your particular situation. There may be compelling reasons for continuing to process your personal information, and we will assess and inform you if that is the case. You can object to marketing activities for any reason.

9.4. If you wish to exercise one of these rights, please contact us using the contact details at the end of this Privacy Policy.

9.5. You also have the right to lodge a complaint to your local data protection authority. 

9.6. If we have reasonable doubts about who is making a request, we may ask for information to confirm your identity. Writing to us from the email address of your account is usually enough. 

10. Cookies

10.1. Our Service uses cookies and similar technologies such as pixels and Local Storage Objects (LSOs) like HTML5 (together "cookies") to distinguish you from other users. This helps us to provide you with a good experience and allows us to monitor and analyze how you use and interact with our Service so that we can continue to improve our Service. It also helps us and our advertising partners to determine products and services that may be of interest to you, in order to serve you targeted advertisements.

10.2. Although we do our best to honor the privacy preferences of our users, we are unable to respond to Do Not Track signals set by your browser at this time.

10.3. We use the following types of cookies:

1. Strictly necessary cookies. These are cookies that are required for the operation of our Service. They include, for example, cookies that enable you to log into your account.

2. Analytical/performance cookies. They allow us to recognize and count the number of visitors and to see how visitors move around our Service when they are using it. This helps us to improve the way our Service works, for example, by ensuring that users are finding what they are looking for easily.

3. Functionality cookies. These remember your choices, such as your language or region, so you don't have to make them again each time you visit. If you would like to find out more about cookies and other similar technologies, please visit www.allaboutcookies.org. Section 10.5 explains how to control the identifiers the App uses on your phone. 

10.4. The cookies we use are designed to help you get the most from the Service but if you do not wish to receive cookies, most browsers and devices allow you to change your cookie settings. Depending on your mobile device and operating system, you may not be able to delete or block all cookies. Please note that if you choose to refuse all cookies you may not be able to use the full functionality of our Service. These settings will typically be found in the "options" or "preferences" menu of your browser.

10.5. On your phone, the App does not use browser cookies. Instead, it uses your device's advertising identifier and other identifiers stored on your device (see section 2.14). You can control them as follows:

1. iPhone and iPad. The App asks for your permission before it can use your advertising identifier. You can change your answer at any time in Settings › Privacy & Security › Tracking (Settings › Privacy › Tracking on older versions of iOS).

2. Android. You can delete your advertising ID, so apps can no longer use it to personalise ads. Depending on your device and Android version, this is under Settings › Google › All services › Ads › Delete advertising ID, or Settings › Privacy › Ads.

3. In the App. Where the law requires your consent for personalised ads, for example in the EEA and the UK, the App shows you a consent form when you first use it. You can change your choice at any time in Home › Preferences › Manage data tracking › Manage ad preferences.

If you refuse or limit personalised ads, you will still see ads in the free version of the App, but they will not be personalised. Limiting your advertising identifier does not stop the analytics and crash reports described in section 2.14, which use other identifiers created for your installation of the App.

11. Tracking technologies used in our emails

11.1. Our emails may contain tracking pixels that identify if and when you have opened an email that we have sent you, how many times you have read it and whether you have clicked on any links in that email. This helps us measure the effectiveness of our marketing email campaigns, make the emails we send to you more relevant to your interests, and to understand if you have opened and read any important administrative emails we might send you.

11.2. Most popular email clients will allow you to block these pixels by disabling certain external images in emails. You can do this through the settings on your email client – these generally give you the option of choosing whether emails will display "remote images", "remote content" or "images" by default.

11.3. Some browsers also give you the option of downloading and installing extensions that block pixels and other tracking technologies.

12. Links to third-party sites

12.1. The Service may, from time to time, contain links to and from third-party websites, including those of other users, our partner networks, advertisers, partner merchants, news publications, retailers, and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for their policies. Please check the individual policies before you submit any information to those websites.

13. Our policy towards children

13.1. The Service is not directed at persons under 18 and we do not knowingly collect personal information from any persons under 18. If you become aware that your child has provided us with personal information, without your consent, then please contact us using the details below so that we can take steps to remove such information and terminate any account your child has created with us.

14. Changes to this policy

14.1. We may update this Privacy Policy. When we make a significant change, we will tell you by email or in the App before it applies, and update the "last modified" date at the end of this page.

15. Notice to you

15.1. If we need to provide you with information about something, whether for legal, marketing, or other business-related purposes, we will select what we believe is the best way to get in contact with you. We will usually do this through email or by a notification within the App. The fact that we may send notices to you will not stop you from being able to opt-out of certain types of contact as described in this Privacy Policy.

16. Contacting us

16.1. Please contact core@quitnow.app if you have any questions, comments, or requests regarding this Privacy Policy.

16.2. This Privacy Policy was last modified on October 13, 2026.