The short version: Quitopotamus collects only what it needs to run your account — your email address, your habit names, and your daily W/L logs. We do not sell your data, share it with advertisers, or display it publicly. You can delete your account and all associated data at any time.
1. Who We Are
Quitopotamus ("we," "our," or "us") operates the Quitopotamus mobile application and website (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Service.
If you have questions about this policy, contact us at [email protected].
2. Information We Collect
Information you provide directly
- Account information: When you register with email, we collect your email address and a hashed version of your password. We never store passwords in plain text.
- Sign in with Apple: If you create an account using Sign in with Apple, Apple provides us with a unique Apple user ID, and either your real email address or an Apple-generated private relay address (your choice). We do not receive your Apple ID password or any other Apple account data. If you choose to hide your email, Apple routes our messages through a relay address.
- Sign in with Google: If you create an account using Sign in with Google, Google provides us with a unique Google user ID, your email address, and your display name. We do not receive your Google account password or any other Google account data. This data is governed by Google's Privacy Policy in addition to ours.
- Habit data: The names of habits you create and your daily W/L log entries.
- Pre-launch waitlist: If you sign up to be notified about our launch via our website, we collect your email address solely to send you a one-time launch notification. You will not receive further emails unless you create an account.
Information collected automatically
- Push notification tokens: If you opt in to reminders, we store a device push token to deliver notifications. You can revoke this permission in your device settings at any time.
- Basic usage data: Timestamps of log entries and app interactions needed to provide the Service (e.g., which week a log belongs to).
- Subscription identifiers: If you purchase a subscription, RevenueCat provides us with a pseudonymous customer ID (a randomly generated identifier) that we store alongside your account to manage your subscription status. This ID is not linked to your payment method.
- Website analytics: When you visit our website (quitopotamus.com), we collect anonymized usage data — such as pages visited, referrer, browser type, and country — using Umami Analytics. This data is aggregated and cannot be used to identify you. No cookies are set, and no personal information is collected or shared.
A note on habit data sensitivity
Habit names you enter may be personal in nature (e.g., tracking substance use, health behaviors, or mental health habits). We treat this data with the same care as any other personal information — it is never shared with third parties for any purpose other than operating the Service, and it is never used for advertising or profiling.
Information we do NOT collect
- Your phone number or physical address
- Your name, unless provided automatically by Google Sign-In as your display name (see above)
- Location data
- Contact lists, photos, camera, or microphone
- Behavioral tracking or advertising identifiers
- Financial or payment card information (handled entirely by Apple App Store or Google Play)
3. How We Use Your Information
We use the information we collect solely to:
- Create and manage your account
- Store and display your habits and W/L logs
- Send push notifications you have opted into
- Send transactional emails (e.g., password reset) — we do not send marketing emails without your explicit consent
- Send a one-time launch notification to users who opted in via our pre-launch waitlist
- Detect and prevent fraud or abuse
- Comply with legal obligations
We do not use your data to build advertising profiles, train AI models, or for any purpose beyond operating the Service.
4. How We Share Your Information
We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:
Service providers
We use a small number of third-party services to operate the platform. These providers process data only on our behalf and under strict confidentiality agreements:
- Database & server hosting (DigitalOcean): Your account and habit data is stored on servers hosted by DigitalOcean. DigitalOcean has no independent right to use your data.
- Transactional email: We use a third-party email provider solely to send password-reset and account emails. We share only your email address for this purpose.
- Form processing (pre-launch waitlist): We use Formspree to process waitlist sign-up submissions on our website. Formspree receives your email address in order to deliver it to us. See Formspree's privacy policy for details.
- Push notifications (Expo): We use Expo Push to deliver notifications. Expo routes messages through Apple Push Notification Service (APNs) on iOS and Firebase Cloud Messaging (FCM) on Android. Only your device push token and notification content are transmitted; no habit data is included. Push notifications are opt-in and can be disabled at any time in your device settings.
- Subscription billing (RevenueCat): In-app subscription purchases are managed by RevenueCat. RevenueCat receives a pseudonymous user ID and purchase receipt data from Apple or Google to verify and manage your subscription status. RevenueCat does not receive your name, email address, or habit data. Payment processing itself is handled entirely by Apple App Store or Google Play — we never see your payment details.
- Sign in with Apple / Sign in with Google: If you authenticate using Apple or Google, those platforms process your sign-in credentials and provide us with the limited profile data described in Section 2. We do not share your habit data back to Apple or Google.
- Website analytics (Umami): We use Umami Analytics to collect anonymized, cookieless website traffic data. Umami does not collect personal information and is fully GDPR compliant. No data is shared with advertisers or used for behavioral tracking.
Legal requirements
We may disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Quitopotamus, our users, or the public.
Business transfers
In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you via email or in-app notice before your data becomes subject to a different privacy policy.
5. Data Retention
We retain your account data for as long as your account is active. If you delete your account, all personal information — including your email address, habit names, and log history — is permanently deleted from our systems within 30 days.
Anonymized, aggregated statistics (e.g., total number of app users) that cannot be linked back to you may be retained indefinitely.
6. Your Rights and Choices
Depending on where you live, you may have rights regarding your personal information. Regardless of jurisdiction, we honor the following for all users:
- Access: You can view all habit and log data you have entered directly within the app.
- Correction: You can edit or delete individual habits and log entries in the app at any time.
- Deletion: You can delete your entire account and all associated data directly from the app (Settings → Delete Account). You can also request account deletion by emailing [email protected] — this web-based option is available even if you no longer have access to the app. We will process all deletion requests within 30 days. Deleting your account also removes any data held by RevenueCat on your behalf.
- Data portability: To request an export of your data, email [email protected].
- Push notifications: You can disable push notifications at any time in your device's notification settings.
- Marketing emails: We do not send marketing emails by default. If we introduce them, every email will include an unsubscribe link.
California residents (CCPA)
California residents have the right to know what personal information is collected, to request deletion, and to opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us at [email protected].
EEA / UK residents (GDPR)
If you are located in the European Economic Area or United Kingdom, your legal basis for processing is contract performance (to provide the Service) and legitimate interest (security and fraud prevention). You have the right to access, rectify, erase, restrict, or port your data, and to object to processing. You may also lodge a complaint with your local supervisory authority. Contact us at [email protected] to exercise these rights.
7. Data Security
We implement industry-standard technical and organizational measures to protect your information:
- All data transmitted between the app and our servers is encrypted using TLS.
- Passwords are hashed using a strong one-way algorithm and never stored in plain text.
- Authentication tokens are short-lived and signed using industry-standard methods.
- Access to production data is restricted to authorized personnel only.
Internal administration
We operate a private, password-protected administration interface used solely for service operations — including customer support, abuse prevention, and monitoring the health of the platform. Through this interface, authorized personnel (currently limited to the business operator) may view account information such as your email address, authentication method, subscription status, habit names, and aggregate log counts. Individual daily log entries are not displayed. This access is read-only and governed by this Privacy Policy. We do not modify, export in bulk, or share your data through this interface.
No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at [email protected].
8. Children's Privacy
Quitopotamus is not directed to children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under the applicable age, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at [email protected].
9. Third-Party Links and Services
The Service may contain links to third-party websites or services (such as the App Store or Google Play). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any information to them.
10. International Data Transfers
Quitopotamus is operated from the United States. If you access the Service from outside the United States, your information may be transferred to and processed in the United States, where data protection laws may differ from those in your country. By using the Service, you consent to this transfer. Where required by applicable law (e.g., GDPR), we ensure appropriate safeguards are in place.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, notify you via email or a prominent in-app notice at least 30 days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.
12. Contact Us
If you have questions, requests, or concerns about this Privacy Policy or our data practices, please contact us:
- Email: [email protected]
- Response time: We aim to respond to all privacy inquiries within 30 days.