Privacy Policy

# Privacy Policy

**Last updated: July 24, 2025**

## Introduction

Welcome to CrushNic (“we,” “our,” or “us”). We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we handle your information when you use our CrushNic mobile application (the “App”) and website at [crushnic.com](https://crushnic.com).

## Information We Collect

### Information You Provide Directly

**Account Information:**
– Email address (for account creation and authentication)
– Password (encrypted and stored securely)
– Profile preferences and settings

**Quit Journey Data:**
– Quit date and quit status
– Personal motivation statements and reasons for quitting
– Selected personal goals (health, financial, lifestyle)
– Vaping product information (types, quantities, costs)
– Daily vaping costs and financial calculations

**Goal and Progress Tracking:**
– Financial goals and target amounts
– Personal achievement goals
– Goal descriptions and progress tracking
– Money saved calculations and statistics

**Craving and Log Data:**
– Craving intensity levels (1-10 scale)
– Trigger identification and descriptions
– Coping strategy notes and effectiveness
– Timestamps and session data
– Personal notes and reflections

### Information Collected Automatically

**Usage Analytics:**
– App usage patterns and session duration
– Feature usage statistics and interaction data
– Navigation patterns within the app
– Achievement unlock patterns and milestone tracking

**Device Information:**
– Device type, model, and operating system version
– App version and technical specifications
– Crash reports and error logs (anonymized)
– Performance metrics and optimization data

**Security and Authentication:**
– Login timestamps and session information
– Authentication token management
– Account security events and access logs

### Information We Do NOT Collect

We explicitly do not collect:
– Precise location data or GPS coordinates
– Contacts, address book, or phone directory information
– Photos, videos, or media files from your device
– Browser history or web browsing data
– Information from other apps on your device
– Social media profiles or external account information
– Biometric data or health records beyond what you explicitly provide
– Third-party advertising identifiers

## How We Use Your Information

### Core App Functionality

**Progress Tracking:**
– Calculate days, hours, and minutes since your quit date
– Track money saved based on your vaping costs and quit duration
– Generate health recovery milestones and achievements
– Provide personalized statistics and progress reports

**Goal Management:**
– Track progress toward financial and personal goals
– Calculate goal completion percentages and timelines
– Provide motivational milestones and achievement notifications
– Generate personalized recommendations and insights

**Craving Support:**
– Analyze craving patterns to identify triggers and trends
– Provide SOS breathing exercises and coping mechanisms
– Track coping strategy effectiveness over time
– Generate insights for improved quit strategies

**Data Visualization:**
– Create charts and graphs of your progress
– Generate achievement badges and milestone celebrations
– Provide financial savings visualizations
– Display health improvement timelines

### Service Improvement

**Analytics and Optimization:**
– Analyze app performance and identify technical issues
– Understand feature usage to guide development priorities
– Optimize user experience and interface design
– Generate anonymized usage statistics for research

**Technical Support:**
– Debug technical issues and app crashes
– Provide customer support and troubleshooting
– Improve app stability and performance
– Ensure compatibility across devices and operating systems

## Data Storage and Security

### Storage Infrastructure

**Supabase Backend:**
– All data is stored on secure Supabase cloud infrastructure
– Database servers located in secure, SOC 2 compliant data centers
– Regular backups and disaster recovery procedures implemented
– Data redundancy and high availability architecture

**Encryption Standards:**
– All data encrypted in transit using TLS 1.3 protocols
– Database encryption at rest using AES-256 encryption
– Authentication tokens secured with industry-standard methods
– End-to-end encryption for sensitive data transmissions

### Security Measures

**Access Controls:**
– Multi-factor authentication for administrative access
– Role-based access controls for development team
– Regular security audits and penetration testing
– Automated monitoring for suspicious activities

**Data Protection:**
– Regular security updates and vulnerability assessments
– Secure API endpoints with rate limiting and validation
– Protection against SQL injection and cross-site scripting
– Secure key management and rotation procedures

### Data Retention

**Active Accounts:**
– Data retained while your account remains active
– Regular cleanup of temporary files and session data
– Optimization of storage for performance and efficiency

**Account Deletion:**
– Complete data removal within 30 days of account deletion
– Secure deletion procedures to prevent data recovery
– Removal from backups within 90 days of deletion
– Confirmation of successful data purging provided

## Data Sharing and Disclosure

### We Do NOT Share Your Data

We absolutely do not:
– Sell your personal information to third parties
– Share data with advertising networks or marketers
– Provide data to data brokers or analytics companies
– Use your information for marketing purposes outside our app
– Share identifiable information with research organizations

### Limited Data Sharing

We may share data only in these specific circumstances:

**Legal Compliance:**
– When required by valid legal process or court orders
– To comply with applicable laws and regulations
– To respond to government requests or investigations
– To protect against legal liability or claims

**Service Providers:**
– With Supabase for secure data storage and infrastructure
– With Expo for app development and deployment services
– With Apple App Store and Google Play Store for distribution
– All service providers bound by strict confidentiality agreements

**Business Transfers:**
– In the event of a merger, acquisition, or business sale
– Data would be transferred under the same privacy protections
– Users would be notified of any ownership changes
– Option to delete data before transfer would be provided

### Anonymized Data

**Research and Development:**
– We may create anonymized, aggregated statistics
– No personally identifiable information included
– Used solely for app improvement and research purposes
– Helps us understand usage patterns and effectiveness

## Your Rights and Choices

### Data Access and Control

**Access Rights:**
– View all personal information we store about you
– Download a complete copy of your data in JSON format
– Review data usage and sharing practices
– Access detailed account activity logs

**Correction and Updates:**
– Modify any incorrect or outdated personal information
– Update your quit date, goals, and preferences at any time
– Correct errors in your craving logs and progress data
– Update contact information and account settings

**Data Portability:**
– Export your complete data in a structured, machine-readable format
– Includes all progress data, goals, logs, and preferences
– Compatible format for importing into other applications
– Available instantly through the app’s export feature

### Privacy Controls

**Notification Preferences:**
– Control all app notifications and reminders
– Customize frequency and types of motivational messages
– Opt out of progress updates and achievement notifications
– Manage email communications and updates

**Data Sharing Controls:**
– Opt out of anonymized analytics and research participation
– Control what data is included in app improvement studies
– Manage consent for specific data processing activities
– Withdraw consent at any time through settings

### Account Management

**Account Deletion:**
– Delete your account and all associated data permanently
– Two-step confirmation process to prevent accidental deletion
– Complete removal within 30 days of deletion request
– Option to export data before deletion

**Data Retention:**
– Control how long we retain specific types of data
– Request early deletion of specific data categories
– Manage backup and recovery preferences
– Set automatic data deletion schedules

## Children’s Privacy

### Age Restrictions

– The App is intended for users 18 years of age and older
– We do not knowingly collect information from minors under 18
– Users must confirm their age during account registration
– Parental controls and restrictions are not provided as the app is adult-focused

### Minor Protection

– If we discover a user is under 18, we will immediately delete their account
– Parents may contact us to report underage usage
– We implement age verification measures during registration
– Educational resources about vaping cessation are age-appropriate

## International Data Transfers

### Global Service Delivery

**Data Processing Locations:**
– Primary data processing occurs in secure U.S. data centers
– Backup and redundancy systems may be located internationally
– All international transfers comply with applicable data protection laws
– Adequate safeguards implemented for cross-border data transfers

**Legal Protections:**
– Standard Contractual Clauses (SCCs) for EU data transfers
– Adequacy decisions recognized where applicable
– Privacy Shield principles followed for U.S. transfers
– GDPR compliance maintained for all EU user data

## Third-Party Services

### Service Providers

**Supabase (Database and Authentication):**
– Secure data storage and user authentication services
– Privacy policy: [supabase.com/privacy](https://supabase.com/privacy)
– SOC 2 Type II certified infrastructure
– GDPR compliant data processing

**Expo (App Development Platform):**
– Mobile app development and deployment services
– Privacy policy: [expo.dev/privacy](https://expo.dev/privacy)
– Analytics and crash reporting services
– Performance monitoring and optimization

**Apple App Store and Google Play Store:**
– App distribution and update services
– Download and usage statistics
– Payment processing for subscriptions (when applicable)
– Device compatibility and security services

### Third-Party Integration

– No third-party advertising networks or trackers
– No social media integrations or data sharing
– No third-party analytics beyond essential app functionality
– Minimal third-party dependencies for enhanced privacy

## Cookies and Tracking

### Mobile App

– No cookies used within the mobile application
– Session tokens for authentication purposes only
– Local storage for app preferences and offline functionality
– No cross-app tracking or advertising identifiers

### Website (crushnic.com)

– Essential cookies for website functionality only
– No advertising or tracking cookies
– Session cookies for support form functionality
– Analytics cookies only with explicit consent

## Changes to This Privacy Policy

### Update Process

**Regular Reviews:**
– Privacy policy reviewed and updated annually
– Additional updates as needed for legal compliance
– Changes made to reflect new app features or functionality
– User feedback incorporated into policy improvements

**Notification of Changes:**
– Email notification to all registered users for significant changes
– In-app notification highlighting important updates
– Previous policy versions archived and available for reference
– Clear summary of changes provided with each update

**Continued Use:**
– Continued use of the app after changes constitutes acceptance
– Option to delete account if you disagree with updated terms
– Grace period provided for users to review changes
– Customer support available to answer questions about changes

## Legal Compliance

### Regulatory Compliance

**General Data Protection Regulation (GDPR):**
– Full compliance with EU data protection requirements
– Lawful basis for processing established for all data uses
– Data Protection Impact Assessments conducted regularly
– EU representative available for GDPR-related inquiries

**California Consumer Privacy Act (CCPA):**
– Comprehensive rights provided to California residents
– Clear disclosure of data collection and sharing practices
– Opt-out mechanisms for data sale (though we don’t sell data)
– Response to consumer requests within required timeframes

**Additional Jurisdictions:**
– Compliance with applicable laws in all service regions
– Regular legal review of privacy practices and procedures
– Adaptation to new privacy regulations as they emerge
– Consultation with privacy experts and legal counsel

### Your California Privacy Rights (CCPA)

**Right to Know:**
– Request specific pieces of personal information collected
– Understand categories of information collected and shared
– Learn about sources of information and business purposes
– Receive information about third parties who receive your data

**Right to Delete:**
– Request deletion of personal information we’ve collected
– Exceptions for legally required data retention
– Confirmation of deletion provided upon request completion
– Secure deletion procedures to prevent data recovery

**Right to Opt-Out:**
– Opt out of the sale of personal information (we don’t sell data)
– Control sharing with third parties for marketing purposes
– Manage consent for specific data processing activities
– Easy opt-out mechanisms available in app settings

**Right to Non-Discrimination:**
– Equal service and pricing regardless of privacy choices
– No penalties for exercising CCPA rights
– Same quality of service for all users
– Transparent pricing and service offerings

## Contact Information

### Privacy Inquiries

**Support Website:** [crushnic.com/support](https://crushnic.com/support)

### Business Address

Odiono LTD
20-22 Wenlock Road
London, N1 7GU
United Kingdom

## Effective Date

This privacy policy is effective as of July 24, 2025, and will remain in effect except with respect to any changes in its provisions in the future, which will be in effect immediately after being posted on this page.

—

*Your privacy is important to us. If you have any questions about this Privacy Policy, please don’t hesitate to contact us through the channels provided above.*