Legal

Privacy Policy

Effective date: July 23, 2026Last updated: July 23, 2026

QuitIt is a recovery tool. The information you put into it — urges, slips, journal entries, the shape of a habit you are trying to break — is among the most sensitive information a person can record. This policy explains exactly what we collect, what we do with it, and what we will never do with it.

1. Who we are

QuitIt ("QuitIt", "we", "us", "our") provides the QuitIt mobile application for iOS (the "App") and this website. We are based in Ontario, Canada, and our handling of personal information is governed by Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA"). For the purposes of the EU and UK General Data Protection Regulation ("GDPR"), QuitIt is the data controller for personal data processed through the App.

You can reach us about anything in this policy — including to exercise your rights — at quititadmin@gmail.com.

This policy applies to the App and this website. It does not apply to Apple's own handling of your Apple Account, payment, and App Store data, which is governed by Apple's Privacy Policy.

2. Summary

• You can use QuitIt without an account. Signing in is optional and is never required to use the core app.
• Your recovery data is stored on your device by default. If you do not create an account, your logs, journal entries, and analytics never leave your phone through us.
• If you enable an account, your recovery data is encrypted on your device before it is uploaded. Our backup provider stores it as ciphertext we cannot read.
• We never sell your personal information and we do not use it for advertising.
• Subscriptions are handled entirely by Apple. We never see or store your payment card details.
• You can delete your account and data at any time from inside the App or by emailing us. See Account Deletion.

3. Information we collect

3.1 Recovery data you create in the App

This is the information you enter yourself as you use QuitIt:

• Progress and streak data — clean-day records and the dates that define your progress.
• Urge logs — the time of an urge, its intensity, and any trigger, mood, or context you tag.
• Relapse (slip) logs — the date and time of a slip and any notes or tags you add.
• Journal entries — free-form text and mood you choose to write.
• Onboarding answers — your responses to the optional self-assessment questions shown when you first set up the App, and the supportive severity score derived from them.
• Preferences and settings — goals, reminders, blocking mode, and display choices.

By default this data is stored only in the App's local database on your device. It is included in your device backups if you have iCloud Backup or encrypted local backups enabled — those backups are controlled by Apple and by you, not by us.

3.2 Account data (only if you choose to sign in)

Creating an account is optional. If you create one, we process:

• Account identifiers — your email address, a unique user ID, and, if you sign in with Google, the basic profile information Google returns to complete sign-in (name, email address, and the fact that the sign-in succeeded). We do not receive your Google password.
• Authentication metadata — session tokens, sign-in timestamps, and the IP address recorded by our authentication provider for security and abuse prevention.
• Encrypted backup payloads — your recovery data, encrypted on your device with a key held in your Apple Keychain before upload. We store the resulting ciphertext. We do not hold your encryption key and cannot read these payloads.

3.3 Subscription data

Premium subscriptions are sold and billed by Apple through the App Store. We receive from Apple only what is needed to unlock your features: a subscription status, product identifier, purchase and expiration dates, and an opaque transaction identifier. We never receive or store your card number, bank details, billing address, or Apple Account password.

3.4 Diagnostic and technical data

We process limited technical information to keep the App working: crash reports, error logs, App version, device model, and operating system version. Where this is provided through Apple's App Analytics, it is aggregated by Apple and shared with us only if you have consented to share analytics with developers in your iOS settings. Diagnostic data is not used to build a profile of you and is not combined with your recovery data.

3.5 Support correspondence

If you email us, we process your email address, the content of your message, and any information you choose to include, in order to answer you.

3.6 What we do not collect

• We do not collect your precise location.
• We do not collect your contacts, photos, microphone, or camera data.
• We do not collect your browsing history, and QuitIt's content-blocking features do not send us a record of the sites you visit or attempt to visit.
• We do not use third-party advertising or tracking SDKs, and we do not ask for permission to track you across other companies' apps and websites.

4. Sensitive data and consent

Information about sexual behavior and about health-related habits is "special category" data under Article 9 of the GDPR and "sensitive personal information" under California law. We treat all of your recovery data — urge logs, relapse logs, journal entries, and onboarding answers — as sensitive, regardless of where you live.

In the EEA and UK, we rely on your explicit consent (Article 9(2)(a) GDPR) to process this data. You give that consent by choosing to enter it into the App, and you can withdraw it at any time by deleting the relevant entries, deleting your account, or deleting the App. Withdrawal does not affect processing that already took place.

We use sensitive personal information only to provide the features you asked for. We do not use or disclose it to infer characteristics about you, and we do not use it for any purpose that would require offering a "Limit the Use of My Sensitive Personal Information" right under the CPRA.

5. How and why we use your information

We do not use your data to train machine-learning or artificial-intelligence models. QuitIt's insights are produced by rule-based logic that runs on your device.

6. Legal bases for processing (GDPR)

• Explicit consent — Article 6(1)(a) and Article 9(2)(a): for your recovery data, journal entries, and onboarding answers.
• Performance of a contract — Article 6(1)(b): to provide the App, maintain your account, and deliver premium features you have purchased, under our Terms of Service.
• Legitimate interests — Article 6(1)(f): to keep the App secure, prevent fraud and abuse, and fix defects. We balance these interests against your rights, and they never extend to advertising or profiling.
• Legal obligation — Article 6(1)(c): where we must retain or disclose information to comply with the law.

7. We never sell your data

We have never sold, rented, or traded personal information, and we will not. Specifically, in the preceding twelve months and going forward:

• We do not sell personal information as that term is defined by the California Consumer Privacy Act, as amended by the CPRA.
• We do not share personal information for cross-context behavioral advertising.
• We do not sell or share the personal information of minors, and we do not knowingly process data from anyone under 17.
• We do not monetize your recovery data in any form, including in aggregated or de-identified form sold to third parties.

If this ever changed, we would update this policy, notify you in the App before the change took effect, and — where the law requires it — obtain your consent first.

8. Where your data lives

On your device. QuitIt is local-first. Your logs and journal entries are written to a database on your iPhone and are protected by iOS file-system encryption and your device passcode.

In the cloud, only if you sign in. If you enable an account, your recovery data is encrypted on your device using AES-GCM before it is uploaded. The encryption key is generated on your device and stored in your Apple Keychain. Our hosting provider stores only opaque ciphertext, and access is restricted at the database level so that no account can read another account's rows. Because we do not hold your key, we cannot read your backups, and neither can our provider.

9. Sharing and service providers

We disclose personal information only in the limited circumstances below. Every provider is bound by a contract that requires them to process data only on our instructions and prohibits them from using it for their own purposes.

We may also disclose information where we are legally required to do so — to comply with a valid legal process, to enforce our Terms of Service, or to protect the rights, safety, or property of our users or the public. We will challenge requests we believe to be overbroad or unlawful, and where we are permitted to notify you of a request affecting your data, we will.

If QuitIt is ever involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We would notify you in the App and by email before your information became subject to a materially different privacy policy, and you would be able to delete your account first.

10. Community features

If QuitIt offers community features and you choose to use them, the content you post — messages, group posts, and your chosen display name — is shared with the other users you send it to or post it for. Please do not post information you would not want another person to see. Community content is not end-to-end encrypted in the same way as your private recovery data, because it must be delivered to other people and moderated for safety. You can report abusive content and block other users from within the App; we review reports and may remove content or suspend accounts under our Terms of Service.

11. Third-party content

QuitIt's motivational feed may embed videos hosted by third parties such as YouTube. When a video loads, the host may set cookies and receive your IP address and technical information about your device under its own privacy policy. We do not send your recovery data to video hosts, and we do not receive information about you from them. External links on this site and in the App are governed by the privacy policies of the sites they lead to.

12. How long we keep data

• On-device recovery data — kept until you delete it or delete the App. Deleting the App removes its local database from your device.
• Account and encrypted backups — kept while your account is active, and deleted within 30 days of your deletion request. Encrypted backups in routine infrastructure snapshots are overwritten on our provider's rolling cycle, no later than 90 days after deletion.
• Subscription and transaction records — retained as long as required by tax and accounting law, typically up to 7 years. These records contain no recovery data.
• Support correspondence — retained for up to 24 months after your issue is resolved.
• Diagnostic data — retained for up to 12 months.

13. Your privacy rights

The sections that follow set out the extra rights that apply in Canada, the EEA and UK, and California. Regardless of where you live, you can:

• Access your data — export a complete copy of your recovery data from within the App at any time.
• Correct your data — edit or remove any individual entry in the App.
• Delete your data — delete your account and its data from within the App. See Account Deletion.
• Withdraw consent — stop using optional features, sign out, or delete the App.
• Ask us anything — email quititadmin@gmail.com.

We will never discriminate against you for exercising a privacy right. We will not deny you service, charge you a different price, or give you a lower quality of service because you asked us to delete your data.

To verify a request made by email, we will ask you to send it from the email address associated with your account, and we may ask for one additional piece of information that matches our records. We do not ask for government identification. An authorized agent may submit a request on your behalf with written proof of authorization.

14. Additional rights in Canada

We are a Canadian organization and PIPEDA applies to everything we do with your personal information. Under PIPEDA and the ten fair information principles in its Schedule 1, you have the right to:

• Know why we collect information before or at the time we collect it — that is what section 5 of this policy is for;
• Give and withdraw consent. Because recovery data is sensitive, we rely on your express consent for it, not implied consent. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice; we will tell you what withdrawal means for the service before we act on it;
• Access your information and be told how it has been used and to whom it has been disclosed;
• Challenge the accuracy of your information and have it corrected;
• Challenge our compliance with these principles by contacting us first, and then by complaining to the Office of the Privacy Commissioner of Canada.

We respond to PIPEDA access requests within 30 days, and at no cost to you. If we need an extension permitted by the Act, we will tell you within the first 30 days, explain why, and tell you about your right to complain to the Commissioner.

Accountability. Our privacy officer can be reached at quititadmin@gmail.com. We remain accountable under PIPEDA for personal information transferred to a service provider for processing, and we use contractual means to give it a comparable level of protection while it is in their hands.

Processing outside Canada. Our service providers store and process information in the United States and other countries, which means that information may be accessible to the courts, law enforcement, and national security authorities of those countries under their laws. This is why your recovery data is encrypted on your device before it leaves it — see section 8.

Breach reporting. Where a breach of security safeguards creates a real risk of significant harm, we will report it to the Privacy Commissioner and notify affected individuals as soon as feasible, and keep records of breaches as PIPEDA requires.

Quebec residents have additional rights under Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25, including the right to data portability and the right to be informed when information is used to render a decision based exclusively on automated processing. QuitIt makes no such decisions.

Marketing email. We do not send marketing email. If we ever do, it will comply with Canada's Anti-Spam Legislation ("CASL"): we will obtain your consent first, identify ourselves, and include a working unsubscribe link in every message. Service messages about your account, security, or a purchase are not marketing and will continue regardless.

15. Additional rights in the EEA and UK

If you are in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to:

• Obtain restriction of processing in certain circumstances;
• Object to processing carried out on the basis of our legitimate interests;
• Receive your data in a portable, structured, machine-readable format — the App's export produces JSON for exactly this purpose;
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. QuitIt does not make such decisions; its insights are suggestions you are free to ignore;
• Lodge a complaint with your supervisory authority. In the UK this is the Information Commissioner's Office; in the EEA it is the authority in your country of residence.

We respond to rights requests within one month, extendable by two further months for complex requests, in which case we will tell you within the first month.

16. Additional rights in California

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, California residents have the right to know, delete, correct, and opt out of sale or sharing, and the right to limit the use of sensitive personal information.

We do not sell or share personal information, so there is nothing to opt out of. We use sensitive personal information only for the purposes permitted under CCPA §7027(m) — providing the service you requested — so the right to limit does not apply. We offer the "Do Not Sell or Share My Personal Information" position as our default and permanent practice rather than as a setting you must find.

Categories of personal information we have collected in the preceding twelve months, using the CCPA's categories: identifiers (email address, user ID); commercial information (subscription status); internet or network activity (diagnostic and error data); and sensitive personal information (data concerning sex life or sexual orientation, and health-related information, in the form of your recovery logs). We collected each category from you directly, or from Apple and our authentication provider as described above. We disclosed identifiers, commercial information, and encrypted payloads to the service providers listed in section 9 for business purposes only. We disclosed no category to any third party for money or other valuable consideration.

We respond to California requests within 45 days, extendable once by a further 45 days with notice.

17. International transfers

We are based in Canada, and we and our service providers may process your information in Canada, the United States, and other countries whose data-protection laws differ from those where you live.

Where we transfer personal data out of the EEA or UK, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable). The EEA benefits from the European Commission's adequacy decision for Canada in respect of organizations subject to PIPEDA. In every case these legal mechanisms sit on top of a technical one that matters more: your recovery data is encrypted on your device before transfer, and is unreadable in transit and at rest by anyone without your key.

18. Children

QuitIt is rated 17+ on the App Store and is intended for adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 17. If you believe a child has provided us with personal information, email quititadmin@gmail.com and we will delete it promptly. Parents and guardians can use Apple's Screen Time and Ask to Buy controls to manage what is downloaded and purchased on a child's device.

19. Security

We protect your information with measures appropriate to its sensitivity, including end-to-end encryption of recovery data using AES-GCM with keys held only on your device, TLS for all data in transit, row-level access rules that isolate each account's data at the database layer, least-privilege access for the small number of people who administer our systems, and no plaintext storage of recovery data on our servers at any point.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify the relevant supervisory authority within 72 hours where required, and we will notify you without undue delay where the breach is likely to result in a high risk to your rights and freedoms.

20. Changes to this policy

We may update this policy to reflect changes to the App or the law. When we do, we will revise the "Last updated" date above. For material changes — a new purpose for your data, a new category of recipient, or anything that reduces your protections — we will give you notice in the App before the change takes effect, and we will obtain your consent where the law requires it. Previous versions are available on request.

21. Contact us