Privacy Policy
This Privacy Policy for the Nichtraucher Pro app (internationally "Quit Smoking Pro") reproduces the privacy sections of the app's unified legal document. The terms are available at Terms of Use, account deletion at Delete Account and Data.
1. Overview and Scope
This notice explains how the "Quit Smoking Pro" app processes your data, what rights you have, and which rules apply to using it. It covers the privacy notice under the GDPR, the terms of use, and the imprint.
The app supports you in quitting smoking, shows progress and health-related information, and offers a community with posts, comments, and private messages. It does not replace medical care.
2. Controller and Contact
The controller under the GDPR is: Softwareentwicklung Ismail Turan-Atmaca (sole proprietor), Klare-Neuburger 16, 70619 Stuttgart, Germany.
Contact for all data-protection and usage questions: supportepiclappscom. No data protection officer has been appointed, as there is no legal obligation to do so.
3. Data We Process
Depending on how you use the app, we process the following categories of personal data:
- Account and access data: username, email address, password (stored only as a bcrypt hash), display name, language setting, guest identifier.
- Quit-smoking and health data: quit date, plan, cigarettes per day and per pack, price per pack, time per cigarette, tar, nicotine and carbon monoxide values, relapses with timestamp.
- Profile and social data: display name, profile picture, bio (unformatted text), visibility settings, friendships, blocks, reports.
- Community content: posts, comments, mentions, likes, favorites, and uploaded images.
- Private messages: message text, timestamps, read status, and image messages.
- Device and push data: push token, platform, app version, installation ID, device name and model, operating-system version, time of last activity.
- Purchase and billing data: product identifiers, store transaction identifiers, entitlement status (subscription, lifetime, gift), refund and revocation status.
- Reporting and moderation data: the reason you select and the free text you add when reporting, the result of the automated screening, moderation decisions taken and the reason for them, the notices sent to you about them, and any objection you file.
- Evidence data: your acceptance of this document with its timestamp and version, and your age confirmation with its timestamp (no date of birth).
- Technical data: IP address in server access logs, error logs, rate-limiting information.
- Advertising data (free accounts only): advertising ID and App Set ID, on iOS possibly device- or developer-scoped identifiers, IP address and the approximate location derived from it, ad and app interactions, and diagnostic and performance data. Google processes this as the advertising provider, not us; see section 25.
4. Purposes and Legal Bases
- Contract (Art. 6(1)(b) GDPR): providing the account, the core features, the community, private messages, and processing purchases and transactional emails (verification, password reset).
- Consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR): processing your health and quit-smoking data, push notifications, advertising on free accounts (together with Section 25(1) TDDDG, see section 25), and the planned analytics and crash-reporting services.
- Legitimate interests (Art. 6(1)(f) GDPR): operating and evaluating the server access logs including the IP address, security, abuse and fraud prevention, and moderation and enforcement of the community rules. Our legitimate interest is protecting users and the integrity and stable operation of the app.
- Legal obligation (Art. 6(1)(c) GDPR): retention of purchase and billing records under commercial and tax law (Section 257 HGB, Section 147 AO).
Obligation to provide data (Art. 13(2)(e) GDPR): username, email address, and password are required to hold a full account; without them a full account cannot be provided. Providing your health and quit-smoking data is voluntary and based on your consent; without it the core progress tracking cannot be used, but the app otherwise remains usable. Retaining billing records is a legal obligation.
5. Health and Quit-Smoking Data
Quit-smoking and health data (e.g. quit date, consumption profile, tar/nicotine/carbon-monoxide values, and relapses) are special categories of personal data under Art. 9 GDPR.
The legal basis for processing them is your explicit consent under Art. 9(2)(a) GDPR. You can withdraw this consent at any time with effect for the future; the lawfulness of processing carried out before withdrawal is not affected.
6. Account, Sign-in, and Email Verification
For a full account we process your username, email, and password. Passwords are stored only as a bcrypt hash, never in plain text. You can also create a guest account and later convert it into a full account.
For sign-in, sign-out, sign-out on all devices, email verification, and password reset we use security tokens. These tokens are stored only as a hash; the raw value is transmitted solely via an email link. Security-relevant endpoints are rate-limited.
7. Profile, Friends, Feed, Comments, Messages, and Reports
Profile details (display name, profile picture, visibility), friendships, blocks, posts, comments, mentions, likes, and favorites are stored on our servers to provide the social features. Public posts can be seen by other users.
Your bio is stored on our servers as plain text without formatting, HTML, or Markdown. It is visible to other users even when your profile is private.
Text and images from posts, comments, and messages are screened automatically by local moderation models on our own server. No content is transmitted to an external or third-party AI in the process. Content flagged as problematic or reported may be reviewed by authorized staff.
Private messages and image messages are stored on the server in readable form so they can be delivered and displayed. They are protected in transit by TLS and secured by access controls; there is no content encryption that would exclude the operator. The operator can technically access message content. Please do not share content that should not be stored on our servers.
Reports record who reported which post, comment, or person, the reason you select, and the optional note you add (see Section 3).
8. Images and Media Uploads
Profile pictures, feed images, and image messages are re-encoded as JPEG on upload, limited in size, and stripped of metadata (e.g. EXIF/location). They are stored on the app server, not with an external image service.
Delivery uses time-limited, signed links. No public cloud storage and no external CDN is used.
9. Push Notifications and Device Tokens
If you enable push notifications, we process a device token and technical details such as platform, app version, installation ID, device name and model, operating-system version, and the time of last activity in order to deliver notifications.
Delivery uses Firebase Cloud Messaging (Google) as a processor. You can disable push notifications at any time in the settings.
10. In-App Notifications
In the app we show notices for events such as friend requests, comments, likes, new messages, or gifts received. For this we store the event type, the triggering person, the reference (e.g. post or message), the time, and the read status.
The legal basis is the provision of the contractually owed features (Art. 6(1)(b) GDPR), supported by our legitimate interest in a coherent user experience (Art. 6(1)(f) GDPR).
11. Purchases, Subscriptions, Lifetime, Gifts, and Restore
For premium features we process product identifiers, store transaction identifiers, entitlement status (subscription, lifetime, gift), and refund, chargeback, and revocation status. We do not receive payment details such as card numbers; payment is handled by Apple or Google.
Purchases are verified server-side against the Apple and Google systems. Raw purchase proofs are stored only as a hash reference; one exception is the Google-issued purchase token, which is kept in readable form to map the subscription. Entitlements may be revoked on refund, chargeback, fraud, or store revocation. For the payment transaction, Apple and Google each act as independent controllers.
12. Information Stored on Your Device (TDDDG)
Under Section 25 TDDDG, the app stores information on your device that is strictly necessary to provide the service you expressly requested and is therefore exempt from consent (Section 25(2) No. 2 TDDDG): authentication tokens in secure device storage, the app state in local storage, and an installation ID as a device identifier.
No tracking or advertising cookies are used. On free accounts, and only after your consent, Google’s advertising SDK may additionally store and read information on your device, including advertising identifiers; this is governed by Section 25(1) TDDDG and described in section 25. With Premium none of that happens.
13. Recipients and Processors
We do not sell your data. To provide the app we use carefully selected service providers that process data on our behalf:
- Google (Firebase Cloud Messaging, Google Cloud Pub/Sub): delivering push notifications and processing purchase events. Processor.
- Apple and Google Play: handling and verifying in-app purchases. For the purchase itself, Apple and Google each act as independent controllers (seller of record).
- Resend (Plus Five Five, Inc., USA): sending transactional emails (verification, password reset). Processor.
- STRATO (STRATO AG, Germany): hosting the backend server and database in Germany. Processor.
- Internal moderation: content moderation runs with local models on our server. To handle reports, authorized people may view reported text and image previews.
- Google Ireland Limited (Google AdMob, Google User Messaging Platform): delivering the banner ads and managing advertising consent on free accounts. Here Google states that it acts as an independent controller rather than as our processor; recipients may additionally include ad buyers and advertising-technology providers engaged by Google (see section 25).
- Authorities: where we are legally required to, we pass data to competent authorities -- for example to law enforcement when there is a concrete suspicion of a criminal offence involving a threat to life or safety (Art. 18 of Regulation (EU) 2022/2065), or upon an official order. The legal basis is Art. 6(1)(c) GDPR.
Data-processing agreements under Art. 28 GDPR are in place with all processors.
14. International Transfers
The backend and database run in Germany. Some providers (Google, Apple, Resend) may process data in the United States. This also applies to advertising: Google Ireland Limited may transfer advertising data to affiliated Google companies and to engaged advertising-technology providers outside the EU. For these transfers, appropriate safeguards under Art. 46 GDPR are in place in the form of EU Standard Contractual Clauses, in part supplemented by certification under the EU-US Data Privacy Framework.
A copy of the Standard Contractual Clauses, or information on the safeguards in place, is available on request at the contact address given above.
15. Retention
- Account, profile, and health data: for as long as your account exists. On deletion they are immediately anonymized or removed.
- Sign-in and reset tokens: deleted on sign-out, expiry, or account deletion.
- Posts, comments, and messages: remain in anonymized form after account deletion (see section 16).
- Purchase and billing data: retained for up to 10 years in line with commercial and tax obligations (Section 257 HGB, Section 147 AO).
- Server logs: stored on the basis of our legitimate interest (Art. 6(1)(f) GDPR) for security and operational purposes for up to 60 days.
- Moderation decisions and the notices sent about them: kept for three years from the decision -- longer than the content they concern. They are the record that we acted and told you, and we need them to be able to substantiate a decision in a dispute. The same applies to reports. For content related to terrorism, the retention obligation in Art. 6 of Regulation (EU) 2021/784 applies in addition.
- Your acceptance of this document: stored with its timestamp and version, and it outlives account deletion, because otherwise it could no longer be evidenced.
Deletion and anonymization take effect on the live systems without undue delay. Any residual copies in backups are removed within the regular backup-rotation cycle.
16. Account Deletion, Anonymization, and Retained Content
You can delete your account at any time in the settings. On deletion we anonymize your account: username, display name, bio, email, password, and profile picture are removed, and your entire quit-smoking and health profile is erased. Sign-in, push, and reset tokens are fully deleted.
For community integrity, posts, comments, and messages you have already published remain in anonymized form (shown as "Deleted"). Purchase records subject to retention obligations are also kept. Not all content you created is therefore removed.
Residual copies in backups are removed within the regular backup-rotation cycle (see section 15).
You can also request deletion without the app installed, via our website.
Request deletion via the website
17. Your Rights
Under the GDPR you have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21).
To exercise your rights, contact supportepiclappscom. We answer requests free of charge and without undue delay, at the latest within one month; for complex requests this period may be extended by up to two further months, of which we will inform you. For security, we may verify your identity before acting.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority is the State Commissioner for Data Protection and Freedom of Information Baden-Wuerttemberg, Lautenschlagerstrasse 20, 70173 Stuttgart.
Supervisory authority LfDI Baden-Wuerttemberg
18. Right to Object
You have the right to object at any time, on grounds relating to your particular situation, to processing of your data that is based on our legitimate interests (Art. 6(1)(f) GDPR). This concerns in particular processing for the purposes of security, abuse prevention, and moderation (Art. 21 GDPR).
You can send your objection informally to supportepiclappscom. We will then no longer process the data concerned, unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise, or defend legal claims.
19. No Solely Automated Decisions
There is no solely automated decision in an individual case that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).
The automated moderation screens content and may withhold a post before a person has seen it. When that happens we tell you that the decision was automated and has not yet been reviewed by a person, and you can object. A person decides on an objection. Restricting an account and any active deletion by us require human review. Only if you do not object to an automated withholding is the withheld content removed automatically once the seven-day deadline expires (see section 28); your objection prevents that and leads to human review.
20. Withdrawing Consent and Settings
You can withdraw any consent you have given (e.g. for health data, push notifications, or the future analytics services) at any time. You control push notifications and the visibility of your profile in the app settings. You withdraw your advertising choice under “Privacy and advertising” in the settings; that choice is held by Google, not by us (see section 25). A withdrawal takes effect for the future and does not affect the lawfulness of prior processing.
21. Reporting Data Breaches
In the event of a personal-data breach, we notify the competent supervisory authority, where required, within 72 hours (Art. 33 GDPR).
Where the breach is likely to result in a high risk to your rights and freedoms, we inform you without undue delay (Art. 34 GDPR).
22. Security
We take appropriate technical and organizational measures to protect your data: encryption of transmission via TLS, storage of passwords only as a bcrypt hash, storage of tokens only as a hash, access controls, rate limiting, and stripping of metadata on image uploads.
No online service is completely secure. Private messages are stored on the server in readable form and are therefore accessible for operating the app; the operator can access them. They are protected in transit by TLS.
23. Minimum Age and Youth Protection
The app is intended for people aged 16 and over (Art. 8 GDPR together with the minimum age applicable in Germany). Age is self-declared. By using the app you confirm that you are at least 16 years old. We record that confirmation with its timestamp; we do not collect a date of birth.
We do not knowingly process data of people under 16. If we become aware that an account is held by a person under 16, we close that account and delete the associated data. Parents and guardians can contact us about this at supportepiclappscom.
Users aged 16 to 17 confirm that they have the consent of a parent or guardian required for the usage contract (Section 106 et seq. BGB).
To protect younger users, reporting, blocking, and moderation tools are available.
24. Analytics and Crash Reporting (planned)
Firebase Analytics and Firebase Crashlytics (Google) are planned for the future but are not currently active. At present there is no usage analytics and no crash reporting via these services.
Before these services are activated, we will inform you and - where required - obtain your consent. This notice will then be updated accordingly.
Independently of that, Google’s advertising SDK may process diagnostic and performance data (see the following section). That is not usage analytics by us; it is part of ad delivery.
25. Advertising and consent management
For free accounts, the app is funded in part by banner advertising from Google AdMob (Google Mobile Ads). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Depending on the processing, further Google companies, ad buyers, and advertising-technology providers engaged by Google may be recipients.
With an active Premium entitlement no advertising is shown. In that case no ad is requested either, and the advertising SDK is not started at all.
Before any ad is requested, the app refreshes your consent status through the Google User Messaging Platform (UMP). Where Google requires a consent message or privacy options for your region, the app presents the choices Google provides. An ad is requested only once the SDK reports that ads may be requested.
Refusing costs you nothing: the app remains fully usable. Depending on your choice, region, platform, and technical availability, Google may serve personalised, non-personalised, or limited ads. Non-personalised and limited ads are not data-free either: they may use IP address, coarse location, device and app information, interactions, fraud-prevention signals, and identifiers for delivery, frequency capping, measurement, and billing.
For the Mobile Ads SDK, Google names in particular the IP address and the approximate location derived from it, app and ad interactions such as app starts, touches, and ad views, diagnostic and performance data such as start time and hang rate, the advertising ID, the App Set ID, on iOS possibly device- or developer-scoped identifiers, and information about ads shown.
The purposes are ad delivery and personalisation, reach and performance measurement, billing, fraud prevention, security, and error diagnosis. Where legally required, consent and access to your device rest on Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Only where legally permitted may limited processing necessary for delivery, security, and fraud prevention rest on Art. 6(1)(f) GDPR; access to your device without consent occurs only within an exception under Section 25(2) TDDDG. Google states that Google and the app provider each act as independent controllers for certain advertising processing.
You can withdraw your consent at any time with effect for the future. Under "Privacy and advertising" in the settings you can reopen the privacy options provided by Google, as far as they are available to you.
Accepting this notice and the terms of use is not an advertising consent. You decide about advertising separately, in Google’s own message; a choice made there is recorded by Google, not by us.
On iOS, the app additionally requests App Tracking Transparency permission through Google’s consent message. If you decline, the app remains fully usable and no cross-app advertising identifiers are used. The advertising is not directed at children; the app is reserved for people aged 16 and over (see section 23).
Google: how data is used from partner sites
40. Status, Version, and Changes
Version 3.0.0, as of 2026-08-21. We may update this notice when the app or legal requirements change. For material changes we will ask for your agreement again.