Puffkin
Privacy Policy
The short version
- No account. Your puffs, plan and settings are stored only on your phone.
- No ads, no analytics, no tracking, and we never sell your data.
- Payments go through Apple or Google; we never see your card details.
- We only get personal data if you email us, and we use it only to help you.
- Delete everything in the App: You → Start over → Delete all my data.
1. Who we are
Puffkin ("Puffkin", "we", "us") is an app that helps adults cut down and quit vaping. It is operated by [LEGAL NAME OF THE APP OPERATOR], [POSTAL ADDRESS], [COUNTRY], which is the controller of the personal data described in this policy.
This policy covers the Puffkin apps for iOS and Android (the "App"), this website (the "Site") and our email support. Questions or requests: puffkin@evtsoy.com.
2. Data that stays on your phone
Puffkin has no account and no server that stores your data. Everything you enter is saved only in the App's storage on your device. We cannot see it, access it or recover it.
| What | Details |
|---|---|
| Puff log | The time of each puff you log, and any you undo. |
| Your plan | Starting puffs per day, plan length, start date, quit date, daily limits and any pace changes. |
| Profile | The name or nickname you give Puffkin. |
| Money | What you spend on vaping per week and your currency, used to calculate savings. |
| Reasons for quitting | The reasons you picked during setup (for example "Health" or "Save money"). |
| Preferences | Roast level, go-easy days, sounds, haptics, reminder times and share-card settings. |
| Progress | Milestones earned, streaks and the quit-day checklist. |
Your puff log and quit plan relate to your nicotine use, which some laws treat as health-related information. That's one reason it never leaves your device unless you choose to share it.
Device backups
If you back up your phone (for example with iCloud, Google backup or a computer), your operating system may include the App's data in that backup. Backups are controlled by Apple or Google and your device settings, not by us.
Reminders
Morning, evening, milestone and check-in reminders are scheduled locally on your device. Their text is generated on your phone. Puffkin only sends notifications if you allow them in your device settings, and you can turn them off at any time.
Share cards
When you share a roast, the image is created on your device and passed to the app you choose (for example Messages or Instagram). Whatever you post is then governed by that app's privacy policy. You can hide your numbers on share cards in You → Puffkin.
3. Data we receive
We only receive personal data in these situations:
When you email support
We receive your email address, your message and anything you attach (such as a screenshot or your device model). We use it only to answer you and fix problems. Support email is stored by our email provider, [EMAIL PROVIDER, e.g. Google Workspace].
When you buy a subscription
Purchases, free trials, renewals and refunds are processed by Apple (App Store) or Google (Google Play). They handle your payment details and billing information under their own privacy policies; we never receive your name, payment card or billing address. The App receives only what it needs to unlock features: whether you have an active subscription, which plan, and when it renews or expires.
When you visit this website
The Site uses no cookies, analytics, advertising or tracking scripts. Like any website, our host (Vercel) automatically processes technical data such as your IP address, browser type and the pages requested, to deliver the Site and protect it from abuse. Fonts and images are served from our own domain.
4. What we don’t do
- We don't sell or rent your personal data, and we don't "share" it for cross-context behavioral advertising.
- We don't show ads, and we don't use advertising identifiers (IDFA / Advertising ID).
- We don't track you across other companies' apps or websites.
- We don't use analytics or tracking SDKs in the App or on the Site.
- We don't collect your location, contacts, photos, microphone or camera data.
- We don't use your data to train AI models.
5. How we use data, and our legal bases
Where the GDPR, UK GDPR or similar laws apply, we rely on these legal bases:
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the App's features on your device | On-device data (section 2) | Performance of our contract with you (these are processed by your device; we never receive them) |
| Unlocking and managing your subscription | Subscription status from Apple / Google | Performance of a contract |
| Answering support requests | Your email and message | Our legitimate interest in helping you and improving the App; contract where it concerns your purchase |
| Sending reminders | Reminder settings (on device) | Your consent, given through your device's notification permission. You can withdraw it at any time. |
| Running and securing the Site | Server logs | Our legitimate interest in keeping the Site available and secure |
| Meeting legal obligations | Support emails, if needed | Legal obligation |
6. Service providers
These providers process limited data on our behalf or as independent controllers, only for the purposes listed:
| Provider | Purpose | Data |
|---|---|---|
| Apple (App Store) | Processing purchases, subscriptions, free trials and refunds on iOS. | Purchase and subscription status. Apple handles your payment details; we never see them. |
| Google (Google Play) | Processing purchases, subscriptions, free trials and refunds on Android. | Purchase and subscription status. Google handles your payment details; we never see them. |
| RevenueCat | Validating purchases and keeping your subscription status in sync across reinstalls. | A random app user ID, purchase receipts and subscription status. No name, email or puff data. |
| Expo (EAS Update) | Checking for app updates and downloading them. | Platform, app runtime version, the ID of the update already on the device, and the IP address of the request. No name, email or puff data. |
| [EMAIL PROVIDER, e.g. Google Workspace] | Hosting our support mailbox. | Support emails you send us. |
| Vercel | Hosting this website. | Standard server logs (IP address, browser, pages requested). |
We may also disclose information if required by law, to protect the rights and safety of our users or others, or as part of a merger or sale of the App. In a sale, this policy (or one at least as protective) will continue to apply.
7. How long we keep data, and deleting it
- On-device data stays on your phone until you delete it. In the App: You → Start over → Delete all my data. Deleting the App also deletes it. Copies in device backups remain until those backups are replaced or deleted.
- Support emails are kept for up to 24 months after your request is resolved, then deleted, unless the law requires us to keep them longer. You can ask us to delete them sooner at puffkin@evtsoy.com.
- Purchase records are kept by Apple or Google under their own policies. We keep no copy of them.
- Website server logs are kept by our host for a short period under its own retention policy.
Puffkin has no user account, so there is no account to delete. To cancel a subscription, see Support; cancelling does not delete your on-device data, and deleting your data or the App does not cancel your subscription.
8. Your rights
Depending on where you live (for example the EU, UK, California and other US states, Canada, Brazil or Australia), you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict processing, to withdraw consent, and not to be discriminated against for exercising these rights.
Most of your data is on your device, where you can view, change and delete it yourself. For data we hold (support emails), email puffkin@evtsoy.com. We respond within 30 days, and may need to verify that the request comes from you, for example by replying from the same email address. You can use an authorized agent where the law allows.
You also have the right to complain to your local data protection authority. We'd appreciate the chance to address your concern first.
9. Age requirement
Puffkin is intended only for adults aged 18 or older, or the legal age to buy nicotine products where they live, whichever is higher. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has sent us personal data, contact puffkin@evtsoy.com and we will delete it.
10. Security
On-device data is protected by your phone's own security, such as your passcode and device encryption, so keep your device locked. The Site is served over HTTPS. Support email is stored with a reputable provider using encryption in transit. No system is perfectly secure, but we deliberately collect as little as possible so there is little to protect.
11. International transfers
Our service providers may process data in countries other than yours, including the United States. Where required, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or the provider's certification under an applicable data privacy framework.
12. Changes to this policy
If our practices change, for example if we add a feature that sends data off your device, we will update this policy and the "Last updated" date before the change takes effect. For significant changes we will also tell you in the App. We will never start sending your puff data off your device without telling you first.
13. Contact
[LEGAL NAME OF THE APP OPERATOR], [POSTAL ADDRESS], [COUNTRY]
Email: puffkin@evtsoy.com