Privacy policy

1) Information We Collect

2) On-device Storage, Accounts and Cloud Processing

Core tracking data is stored locally using the device’s app storage. The App also creates or reuses an anonymous Supabase session so cloud-backed features can work, and may back up or synchronize selected profile, plan and daily-log data to Supabase. Linking an email, Apple or Google sign-in preserves the same account where supported.

Removing the App may remove local data that was not synchronized. Installing the App again does not guarantee that local progress can be recovered.

3) How We Use Information

• Provide tracking, quit plans, statistics, personalization, community, support, notifications, purchase access and restoration.
• Generate AI Coach replies and vape-scan results when you request those features.
• Measure use, improve reliability and product design, attribute campaigns, prevent abuse and fraud, moderate community content and enforce our Terms.
• Comply with law, exercise legal rights and protect users and the Services.

Where applicable, our legal bases include performing our contract with you, our legitimate interests in operating and securing the Services, consent where required, and compliance with legal obligations.

4) AI Features

The AI Coach and Scan Your Vape features send the content described above to OpenAI through Supabase Edge Functions. AI output can be inaccurate and is not medical advice. Do not submit information or images that you do not want processed by these providers. Avoid including another person’s confidential or identifying information.

5) Analytics, Attribution, Cookies and Local Storage

• The App uses Amplitude for product analytics. Events can be associated with a stable guest identifier and, where available, a Supabase account identifier. Some released App builds may sample Amplitude Session Replay for up to 10% of sessions, recording on-screen interactions and displayed content for product diagnostics. The website does not use Session Replay.
• On iOS App builds where campaign attribution is enabled, we use AppsFlyer to measure installs and campaign performance, analyze a limited conversion funnel, and help prevent attribution fraud. AppsFlyer may process an AppsFlyer installation ID, our pseudonymous guest/RevenueCat customer ID, IDFV and other device, App and network data available to the configured SDK—including IP address and an approximate IP-based region—campaign or referral information, App launches, and limited events about onboarding, paywalls, plan selection, purchase attempts and restores. RevenueCat also sends AppsFlyer subscription-lifecycle events, product identifiers, price or revenue in USD, renewal status and the identifiers needed to match those events. The iOS integration covered by this Policy keeps IDFA disabled unless the user authorizes tracking through Apple’s App Tracking Transparency (ATT) framework. AppsFlyer may use IDFA only after that authorization; if the user does not authorize it, IDFA remains disabled. Android does not include AppsFlyer. We do not send AppsFlyer your name, email, phone number, precise GPS location, vaping, nicotine, craving, journal or AI Coach data, images, or free text.
• On novapeapp.org, a necessary local-storage entry remembers your privacy choice. Google Analytics 4 and Amplitude load only after you accept analytics. You can change that choice through Cookie preferences in the website footer.
• The website does not use analytics consent to control analytics inside the mobile App. You may contact us to exercise an applicable objection or privacy right concerning App analytics.

6) Community and Public Content

Community content is intended to be public within the App. Other users can see and may copy what you publish. We process reports and moderation status to protect the community. When we fulfill a verified deletion request, we process the account and its directly associated community records. Posts may remain marked as deleted, and some community records may remain where needed to preserve conversation integrity or meet safety or legal needs. Copies made by other users while content was public are outside our control.

7) Purchases and Subscriptions

Apple App Store or Google Play processes your payment. RevenueCat processes purchase identifiers, receipts, subscription status and entitlement information so we can grant and restore premium access. Store and provider privacy terms also apply.

8) When We Disclose Information

We do not sell personal information or show third-party behavioral ads. We disclose information only as needed to:

• Operate the Services with processors listed below and authentication providers you choose.
• Process purchases with Apple, Google and RevenueCat.
• Comply with law, valid legal process, protect safety or rights, investigate abuse, or complete a business transfer with appropriate safeguards.

9) Retention and Deletion

We keep information only for as long as reasonably necessary for the purposes described above, including while an account is active, to provide purchases, moderate the community, resolve disputes, prevent fraud and meet legal obligations. Exact periods vary by data type and provider. Local data remains on your device until you reset it, delete it, clear app storage or remove the App.

To request account and cloud-data deletion, use the Delete account page or email novapteam@gmail.com. If your account has a linked email, write from that address; for an anonymous or guest account, say that it is a guest account so we can provide appropriate verification steps. We may need additional information to verify the request. Deletion does not cancel a store subscription; cancel it separately in Apple or Google account settings. Some records may remain where law, security, fraud prevention or a provider’s backup cycle requires it.

10) Your Rights and Choices

• Depending on your location, you may request access, correction, deletion, restriction, objection, withdrawal of consent or a portable copy of eligible information.
• You can refuse camera and notification permissions in device settings, clear Coach history within that feature, reset local progress from the App, and manage website analytics through Cookie preferences.
• Contact novapteam@gmail.com to submit a request. You may also complain to your local data-protection authority. We do not discriminate for exercising a privacy right.

11) Security

We use reasonable technical and organizational safeguards, including encrypted transport and access controls. No system is completely secure, and you are responsible for protecting your device and account credentials.

12) International Transfers

We and our providers may process information in Argentina, the United States and other countries. Where required, we rely on recognized transfer mechanisms and contractual safeguards.

13) Children and Age

The Services are not directed to children under 13. Users aged 13 to the age of legal majority should use the Services only with permission from a parent or legal guardian where required. A store content rating does not mean the Services are designed for children. If you believe a child under 13 provided personal information, contact us so we can investigate and delete it.

14) Changes and Contact

We may update this Policy as the Services or law change. We will post the new effective date and provide additional notice when required.

Questions, complaints or privacy requests: novapteam@gmail.com

Appendix – Service Providers

• Supabase — authentication, database, storage and Edge Functions.
• OpenAI — AI Coach and vape-image processing when requested.
• Amplitude — App product analytics, including Session Replay sampled in some App builds, and consented website analytics without Session Replay.
• AppsFlyer — campaign attribution and limited conversion analytics in enabled iOS builds, fraud prevention, and subscription-lifecycle and revenue measurement through RevenueCat.
• RevenueCat — subscription and entitlement management.
• Apple App Store and Google Play — purchases, receipts and store services.
• Apple Push Notification service and Firebase Cloud Messaging — push delivery when enabled.
• Google Analytics 4 — website analytics after consent.
• Apple and Google — optional account sign-in when selected.