PRIVACY POLICY FOR THE APP “SMOKESTOP”

Last updated: February 20, 2026

1. Controller

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Leo Lober
Suevenstr. 9, 50679 Cologne
Germany
Email: leo47733@icloud.com

2. General Information on Data Protection

Protecting your personal data is very important to us. We process personal data exclusively within the framework of the statutory provisions, in particular the GDPR.

3. Purpose of the App and Medical Disclaimer

The app “SmokeStop” is designed to support you in reducing or quitting smoking. It offers features for self‑observation, motivation and behavioural support.

⚠️ Important Notice:

This app is intended solely for general lifestyle purposes, motivation and self‑management. It does not constitute medical treatment, diagnosis, therapy or health advice. If you have health concerns, please consult a doctor.

4. Legal Bases for Processing

Your personal data is processed on the following legal bases:

Art. 6 (1) lit. b GDPR (performance of a contract): Provision of the app functions.
Art. 6 (1) lit. a GDPR (consent): For analytics services (see section 7).
Art. 6 (1) lit. f GDPR (legitimate interest): Ensuring the security and stability of the app (fraud prevention, error analysis, log files).

5. Processed Data

a) Account Data

Email address
Display name / nickname
User ID

b) Usage and Progress Data

Quit start date
Number of cigarettes smoked or avoided
Progress values (streaks, level)
Calculated statistics (e.g. money saved)

c) Community Data (optional)

Published posts and comments
Likes and bookmarks
Report and block actions (which user reported/blocked what)
Timestamps and user assignment

To ensure a respectful and safe environment in our community, we offer the following functions: users can report posts and comments via an integrated “Report” button. Reported content will be reviewed promptly and removed if it violates our community guidelines. Users can also block other users to prevent further interaction. For any questions or complaints regarding community content, you can always contact us at leo47733@icloud.com.

d) Local App Data (device only)

Vision board images and texts

⚠️ Vision board content is stored exclusively locally on your device and is not uploaded to our servers or processed in the cloud.

e) Technical Data

IP address
Device type and operating system
App version
Time of use

6. Logging by Firebase Services

We use Google Firebase as a technical platform. In the course of operating these services, the provider Google Ireland Limited automatically collects and stores technical log data (so‑called log files) relating to accesses and events.

This includes in particular:

App usage events (via Firebase Analytics)
Technical information about app crashes (via Firebase Crashlytics)
Performance data such as load times (via Firebase Performance Monitoring)
Meta‑information about API calls (e.g. time, type of request to Firestore or Authentication)

Processing by us is based on our legitimate interest (Art. 6 (1) lit. f GDPR) in ensuring stable, secure and improvable operation of our app.

The log data is stored by Google as our processor under Art. 28 GDPR. The storage period depends on the standard retention periods of the respective Firebase services. For example, Crashlytics data is usually retained for 90 days, and Performance data for 60 days. The log data is not merged by Google with your other user data (such as your progress).

7. Analytics (Firebase Analytics)

The app uses Firebase Analytics from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, to collect anonymised usage statistics (e.g. feature calls, session duration).

When you first use the app, you will be informed about this analytics function and can give your consent. Processing only takes place on the basis of your consent under Art. 6 (1) lit. a GDPR. You can withdraw your consent at any time with effect for the future in the app settings.

The collected data cannot be directly attributed to a specific person and is not merged with other data sources.

8. Use of Processors

For technical provision we use:

Google Firebase: For hosting, database and analytics (provider: Google Ireland Limited).
RevenueCat: For managing in‑app purchases and subscriptions (provider: RevenueCat, Inc., USA).

Processing is based on data processing agreements in accordance with Art. 28 GDPR.

9. Data Transfers to Third Countries

Through the use of our processors, data may be processed outside the EU/EEA.

Google Firebase (Google Ireland Limited): For data transfers to the USA, Google has joined the EU‑US Data Privacy Framework (DPF). The European Commission has issued an adequacy decision for the USA under the DPF, ensuring an adequate level of data protection.
RevenueCat (RevenueCat, Inc., USA): Data transfer to the USA is based on Standard Contractual Clauses of the European Commission (SCCs), which provide appropriate safeguards for data protection.

10. Your Rights

You have the following rights towards the controller regarding your personal data:

Right of access under Art. 15 GDPR
Right to rectification under Art. 16 GDPR
Right to erasure under Art. 17 GDPR
Right to restriction of processing under Art. 18 GDPR
Right to data portability under Art. 20 GDPR
Right to withdraw consent under Art. 7 (3) GDPR
Right to object to processing under Art. 21 GDPR
Right to lodge a complaint with a supervisory authority under Art. 77 GDPR

How to exercise your rights: You can delete your user account and all associated personal data directly in the app under Profile > Settings > Delete Account. For any other requests (e.g. access, rectification or data portability), please contact us by email at leo47733@icloud.com. We will process your request without undue delay, and at the latest within one month.

11. Storage Duration

Your personal data is stored only as long as necessary for the purpose of processing or as required by statutory retention periods (e.g. tax law).

Account data and usage data are stored until you delete your account. After account deletion, the data will be erased within 30 days, unless statutory retention obligations prevent erasure.

12. Changes to this Privacy Policy

We reserve the right to adapt this privacy policy to reflect changes in the legal situation or in the service. The current version is always available at this URL.