PRIVACY POLICY FOR VAPEFREE MOBILE APPLICATION

Last Updated: May 2026
Application ID: com.voidkin.vapefree
Developer: VoidKin Studio

IMPORTANT: PLEASE READ THIS PRIVACY POLICY CAREFULLY. BY DOWNLOADING, INSTALLING, OR USING THE VAPEFREE APPLICATION ("THE APP"), YOU EXPLICITLY CONSENT TO THE DATA PRACTICES DESCRIBED HEREIN. IF YOU DO NOT AGREE, DO NOT USE THE APP AND DELETE IT IMMEDIATELY.

DISCLAIMER: VapeFree is a motivational tool designed to help users reduce or quit their vape/puff habit. IT IS NOT A MEDICAL APPLICATION AND DOES NOT PROVIDE MEDICAL ADVICE. The Developer assumes absolutely no liability for health outcomes, data processing practices of third-party service providers, or any damages arising from the use of this App.

--- SECTION 1: DATA CONTROLLER ---

1.1. Identity of the Data Controller
VoidKin Studio ("we," "our," or "us") acts as the Data Controller for all personal data collected through the VapeFree application.

1.2. Contact Information
For all data protection inquiries, GDPR rights requests, or privacy concerns, contact our Data Protection Officer (DPO) at: support@voidkinstudio.com
We are legally mandated to respond to all valid data requests within 30 calendar days.

--- SECTION 2: CATEGORIES OF DATA WE COLLECT ---

We adhere to the principle of data minimization (GDPR Article 5(1)(c)), collecting only what is strictly necessary. Data collection varies based on your account status (Guest vs. Authenticated).

2.1. Personally Identifiable Information (PII) — Authenticated Users Only
If you sign in via Google Sign-In (powered by Firebase Authentication), we receive and store:

Your email address
Your display name (or nickname you set within the App)
A unique Firebase User ID (UID)
Your Google OAuth authentication token (session only; not permanently stored by us)

2.2. Vape/Puff Cessation and Health-Related Data (GDPR Article 9 — Special Category Data)
This data may be classified as health-related data under GDPR Article 9. By using the App, you grant EXPLICIT CONSENT for its processing.

Quit Date and Quit Time (the date/time you stopped vaping)
Quit Method ("quit" or "reduce" mode selection)
Daily Puff Count (tracked via the App's puff counter and background Home Screen widget addPuff callback)
Daily Puff Limit and Reduction Plan settings (for users in "reduce" mode)
Puff History (last 7 days of daily puff counts, stored locally)
Device Type ("puff" or "ecig") and associated cost details (item price, device puffs, monthly puffs)
Health Milestones (calculated recovery progress based on time since quit date — e.g., heart rate normalization, lung capacity improvements). These are general statistical estimates, NOT medical data.
Money Saved, Time Gained, and Life Gained calculations (mathematical projections based on user-provided data)
Slip-Up Logs: timestamps of relapses and their associated triggers (e.g., stress, alcohol, social, boredom, food)
Crisis Tool Usage Logs: timestamps and durations of breathing exercise sessions used during cravings
Current Streak (consecutive days without vaping)
Daily Check-In records

2.3. User-Generated Content (UGC)

Nickname: Your chosen display name, visible in the community.
Avatar Index: Your selected avatar identifier.
Quit Reason: Your personal reason for quitting, stored locally and synced to cloud for authenticated users.
Personal Notes: Free-text notes stored locally (free users) or synced to Firebase Firestore (premium users).
Community Messages: Text messages posted in the public community chat, stored in Firebase Firestore. Each message includes your nickname, streak, mentor status, language/channel, timestamp, and report count.
Celebration Messages: Achievement unlock announcements stored locally on your device.
Wishlist Items: Personal savings goal items (title + price), stored locally and synced for authenticated users.

2.4. Community Moderation and Ban Data

Report Count: Number of user reports on each community message.
Ban Status: ban_count (number of times banned) and ban_expiry (ban expiration date). This data is permanently synced to Firebase Firestore and CANNOT be circumvented by clearing app data or reinstalling.
Profanity Filter Results: We employ automated content filtering (multi-language profanity detection and link detection). Triggering this filter results in an immediate automated ban.

2.5. Premium, Subscription, and Referral Data

Premium Status (is_premium): Whether you hold an active premium subscription, verified via RevenueCat.
Premium Expiry Date: Expiration timestamp for time-limited premium access (e.g., earned via referrals).
RevenueCat Customer Info: Your entitlement status, managed by RevenueCat Inc. We use your internal User ID to identify you within RevenueCat's system.
Referral Code: A unique, cryptographically secure 6-character code generated for each user.
Referral Usage: Whether you have used a referral code and your mentor count (number of users who used your code).
Referrals Received: A Firestore sub-collection tracking incoming referral redemptions (timestamp and redeemer UID).

2.6. Achievements and Gamification Data

Unlocked Achievements: A list of achievement IDs you have earned (e.g., first_puff, money_100, streak_7).
Achievement Count: Total number of unlocked achievements, synced to cloud.

2.7. App Preferences and UI State

Language Preference (locale code, e.g., "en", "tr", "de", "ru", "vi", "th", "es", "pt", "fr")
Theme Preference (e.g., "light", "dark", "nebula", "aurora", "cosmic", "phoenix")
Nebula/Phoenix Theme Unlock Status (special themes earned through achievements)
Haptic Feedback Preference (enabled/disabled)
Onboarding Completion Status
Tutorial Viewed Status
Community Warning Viewed Status
Rate Prompt Count and Has Rated status
Premium Popup Last Shown timestamp
Daily Quote text and last displayed date

2.8. Technical, Device, and Diagnostic Data

Internal User ID: A unique identifier generated locally (based on timestamp) and persisted via SharedPreferences.
Device Timezone: Collected via the flutter_timezone package to schedule accurate local notifications.
Crash Reports: May be collected by Firebase/Google Analytics for stability improvements.

2.9. Advertising Data

Google Mobile Advertising ID (AAID): Collected by Google AdMob to serve banner and interstitial ads to FREE (non-premium) users only. Premium users see no ads.

--- SECTION 3: ANDROID PERMISSIONS AND THEIR PURPOSES ---

The App requests the following Android permissions. Each is strictly necessary for the stated purpose:

Permission	Purpose
`android.permission.INTERNET`	Sync user data to Firebase Firestore, load community messages, serve ads, verify subscriptions via RevenueCat.
`android.permission.ACCESS_NETWORK_STATE`	Check network availability before attempting cloud sync operations.
`android.permission.RECEIVE_BOOT_COMPLETED`	Re-initialize scheduled local notifications (daily quotes, health milestones, smart alerts, 7-day plan reminders) and Home Screen widget data after device restart.
`android.permission.VIBRATE`	Provide haptic feedback during UI interactions (can be disabled by user in Settings).
`android.permission.POST_NOTIFICATIONS`	Send local push notifications: daily motivational quotes, health milestone alerts, smart craving warnings, and 7-day plan unlock reminders.
`com.google.android.gms.permission.AD_ID`	Allow Google AdMob to access your Advertising ID for serving personalized ads (free users only).

--- SECTION 4: NOTIFICATION CHANNELS ---

The App uses the following distinct notification channels on Android:

Channel ID	Channel Name	Purpose
`daily_quote_channel`	Daily Quotes	Daily motivational affirmation at 10:00 AM local time.
`health_milestones_channel`	Health Milestones	Alerts when you reach a physical recovery milestone.
`smart_alerts_channel`	Smart Alerts	Preventative warnings 30 minutes before your statistically most dangerous craving hour (based on your slip-up history).
`seven_day_plan_channel`	7-Day Plan	Notifications for daily plan unlocks during your first week.
`immediate_channel`	Immediate Notifications	Achievement unlock celebrations.

--- SECTION 5: HOME SCREEN WIDGETS AND BACKGROUND PROCESSING ---

The App provides 4 Home Screen widgets that process data in the background:

Widget	Data Accessed	Purpose
PuffWidget	`puff_count`, `widget_title`	Display today's puff count; supports background `addPuff` increment via tap.
MinimalWidget	Quit date, elapsed time	Display days/hours since quitting (premium only; shows lock icon for free users).
SavingsWidget	Money saved calculation	Display total money saved (premium only).
HealthWidget	Life gained calculation, progress %	Display life gained and 24-hour progress bar (premium only).

Widget data is stored via the home_widget package using SharedPreferences and is accessible only by the App. Background processing occurs via a registered @pragma('vm:entry-point') callback for the PuffWidget's addPuff interaction.

--- SECTION 6: LAWFUL BASIS FOR PROCESSING (GDPR ARTICLE 6 & 9) ---

Data Category	Lawful Basis	Justification
Account/authentication data	Contractual Necessity (Art. 6(1)(b))	Required to provide cloud sync, community, and premium services.
Cessation/health-related data	Explicit Consent (Art. 9(2)(a))	You grant explicit consent during onboarding and first use.
Community messages & moderation	Legitimate Interest (Art. 6(1)(f))	Necessary to maintain a safe, abuse-free community environment.
Advertising data (AAID)	Explicit Consent (Art. 6(1)(a))	EU users are prompted for consent via Google UMP before personalized ads.
Crash/diagnostic data	Legitimate Interest (Art. 6(1)(f))	Essential for maintaining app stability and fixing bugs.
Notification scheduling	Contractual Necessity (Art. 6(1)(b))	Core feature of the cessation assistance tool.

--- SECTION 7: DATA SHARING AND THIRD-PARTY PROCESSORS ---

We DO NOT SELL, RENT, OR TRADE your personal data. Data is shared exclusively with essential, industry-leading service providers acting as Data Processors under GDPR Article 28:

Processor	Data Shared	Purpose	Privacy Policy
Google LLC (Firebase Authentication)	Email, name, UID	User authentication and identity	https://firebase.google.com/support/privacy
Google LLC (Cloud Firestore)	All synced user data	Cloud database storage and sync	https://firebase.google.com/support/privacy
Google LLC (Google AdMob)	Advertising ID (AAID)	Serving ads to free users	https://policies.google.com/privacy
Google LLC (Google Sign-In)	Google account profile	OAuth authentication flow	https://policies.google.com/privacy
RevenueCat Inc.	User ID, entitlement status	Subscription management and verification	https://www.revenuecat.com/privacy

All processors are bound by Data Processing Agreements (DPAs) and comply with applicable data protection regulations.

--- SECTION 8: DATA STORAGE ARCHITECTURE ---

8.1. Local Storage (SharedPreferences / Device)
Guest (unauthenticated) users' data is stored EXCLUSIVELY on their local device using Flutter's SharedPreferences. This includes all cessation metrics, notes, preferences, puff history, slip-ups, crisis usages, wishlist, achievements, and UI state. This data is never transmitted to any server.

8.2. Cloud Storage (Firebase Firestore)
Authenticated users' data is synced to Google's Firebase Firestore servers. The synced data includes:

Nickname, referral code, mentor count, premium status, quit date, quit method, current streak, unlocked achievements, theme unlocks, ban status
For PREMIUM users only: slip-up logs and crisis usage logs (sensitive health data is NOT uploaded for free authenticated users)
Community messages are stored in the community_messages Firestore collection (publicly readable within the App)
User profiles are stored in the users Firestore collection (private; governed by Firebase Security Rules ensuring users can only read/write their own document)

8.3. Temporary Storage
Screenshots generated by the progress sharing feature are saved to the device's temporary directory and are not uploaded to any server. They are shared via the system share sheet using the share_plus package.

--- SECTION 9: DATA SECURITY MEASURES AND LIMITATION OF LIABILITY ---

9.1. Encryption

In Transit: All data between your device and Firebase/Google servers is encrypted using industry-standard TLS/SSL (HTTPS) protocols.
At Rest: Data stored in Firestore is encrypted at rest by Google Cloud's default encryption mechanisms.

9.2. Access Controls

Firebase Security Rules strictly enforce that each user can only read and write their own document in the users collection.
Community messages are publicly readable but writable only by authenticated users.
Referral sub-collections use scoped write access.
Referral codes are generated using Random.secure() for cryptographic unpredictability.

9.3. Ban Enforcement Security
Ban status is verified directly from Firebase Firestore on every community screen access, preventing circumvention via local data clearing or app reinstallation.

9.4. LIMITATION OF LIABILITY FOR DATA SECURITY
WHILE WE IMPLEMENT ROBUST SECURITY MEASURES, NO DIGITAL SYSTEM IS IMPENETRABLE. THE DEVELOPER SHALL NOT BE HELD LIABLE FOR:

Data breaches, unauthorized access, or data loss caused by third-party providers (Google LLC, RevenueCat Inc.) or their infrastructure failures.
Data loss resulting from device theft, malware, or user negligence.
Temporary or permanent unavailability of cloud services beyond our control.
Any damages arising from the interception of data during transmission, despite our use of encryption.

--- SECTION 10: DATA RETENTION AND DELETION ---

10.1. Active Accounts
Your cloud data is retained for as long as your account remains active. Local data (SharedPreferences) persists on your device until the App is uninstalled or device storage is cleared.

10.2. Community Messages
The App retains only the most recent 12 messages per language channel in Firestore. Older messages are automatically and permanently deleted by the App's cleanup routine.

10.3. User-Initiated Account Deletion
You may permanently delete your account at any time using the "Delete Account" button in Settings. This action:

Immediately and irreversibly deletes your user document from the Firebase users collection
Deletes your Firebase Authentication account
Clears all local SharedPreferences data on the device
This action is FINAL and CANNOT be undone. No backup or recovery is possible.

10.4. Community Content After Deletion
Upon account deletion, your previously posted community messages may remain in the database but will be effectively orphaned (no longer linked to an active account). They will be naturally purged when they fall outside the 12-message retention window.

10.5. Anonymized/Aggregate Data
We may retain fully anonymized, aggregated statistical data (e.g., total app installs, average quit duration) indefinitely for internal analytics. This data cannot be traced back to any individual.

--- SECTION 11: COOKIES, LOCAL STORAGE, AND TRACKING ---

11.1. The App does NOT use browser cookies.
11.2. We use SharedPreferences (Android's key-value local storage) to persist your settings, progress data, cached community messages, and session state.
11.3. We use WebView to display external pages (Terms of Service at vapefree-terms.netlify.app, Privacy Policy at vapefree-privacy.netlify.app). These third-party sites may have their own cookie and tracking policies over which we have no control.

--- SECTION 12: INTERNATIONAL DATA TRANSFERS ---

Your data may be transferred to and processed on servers located in the United States or other jurisdictions by Google LLC. We ensure these transfers comply with GDPR Chapter V requirements via:

Google's Standard Contractual Clauses (SCCs)
Google's compliance with the EU-U.S. Data Privacy Framework
RevenueCat's adherence to applicable international data transfer frameworks

--- SECTION 13: CHILDREN'S PRIVACY ---

13.1. The App is intended for users aged 18 and above, or the legal age of majority in their jurisdiction.
13.2. We do not knowingly collect personal data from children under 18.
13.3. If we become aware that we have inadvertently collected data from a minor, we will immediately delete such data.

--- SECTION 14: YOUR RIGHTS UNDER GDPR ---

As a data subject, particularly within the EU/EEA, you are guaranteed the following rights:

14.1. Right of Access (Article 15)
You may request a complete copy of all personal data we hold about you.

14.2. Right to Rectification (Article 16)
You may correct inaccurate data (e.g., quit date, puff counts, nickname) directly through the App's settings and profile screens.

14.3. Right to Erasure / "Right to be Forgotten" (Article 17)
You have the absolute right to demand deletion of all your personal data. Execute this via the "Delete Account" button in Settings, which irreversibly purges your data from Firebase Authentication and Firestore.

14.4. Right to Restriction of Processing (Article 18)
You may request that we temporarily halt processing of your data.

14.5. Right to Data Portability (Article 20)
You may request your data in a structured, commonly used, machine-readable format (e.g., JSON).

14.6. Right to Object (Article 21)
You may object to data processing based on legitimate interests or direct marketing (ads).

14.7. Right to Withdraw Consent (Article 7(3))
You may withdraw your consent for health data processing or personalized advertising at any time. Note: Withdrawing consent for health data processing will render the App's core features unusable, necessitating account deletion.

14.8. Right to Lodge a Complaint
You have the right to lodge a complaint with your local Data Protection Authority (DPA) if you believe your data rights have been violated.

To exercise any of the above rights, contact: support@voidkinstudio.com

--- SECTION 15: YOUR RIGHTS UNDER CCPA (CALIFORNIA RESIDENTS) ---

If you are a California resident, you additionally have the right to:

Know what personal information is collected, used, shared, or sold.
Delete personal information held by us.
Opt-out of the sale of personal information. NOTE: We do NOT sell your personal information.
Non-discrimination for exercising your CCPA rights.

--- SECTION 16: CHANGES TO THIS PRIVACY POLICY ---

We reserve the absolute right to update, modify, or replace this Privacy Policy at any time at our sole discretion. Any changes will be effective immediately upon posting. Your continued use of the App following changes constitutes your binding acceptance of the updated policy.

--- SECTION 17: GOVERNING LAW ---

This Privacy Policy shall be governed by and construed in accordance with the laws of the jurisdiction in which the Developer resides, without regard to its conflict of law principles.

BY CONTINUING TO USE VAPEFREE, YOU AFFIRM THAT YOU HAVE READ, UNDERSTOOD, AND EXPLICITLY CONSENTED TO EVERY DATA COLLECTION, PROCESSING, AND SHARING PRACTICE DESCRIBED IN THIS COMPREHENSIVE PRIVACY POLICY.