Consumer health data
This policy is for people in the United States, and covers the health information we hold under Washington, Nevada and Connecticut law. We never sell it, never use it for ads, and hold it only when you choose to send it to us.
Draft, pending legal review. This text describes how we intend TaperØff to work. It is not yet a binding document.
Who we are
TaperØff is made by Slipstitch Limited ("we", "us"). This policy sits alongside our privacy notice, which covers everything we hold for everyone. Where this policy is more specific about health information, this policy applies. For anything in it, write to quit@taperoff.io.
Slipstitch Limited, registered in Northern Ireland, company number NI744542. Registered office: 108 Stoneypath, Londonderry, Northern Ireland, BT47 2AF.
What we mean by consumer health data
Washington's My Health My Data Act, Nevada's consumer health data law and Connecticut's data privacy act protect information that is linked to you and says something about your physical or mental health, including the fact that you're trying to change a health habit. Nicotine use, cravings, nicotine replacement and stop smoking medicines are all health information. So, we think, is the plain fact that someone has a TaperØff account. We treat all of it as consumer health data.
What stays on your phone
TaperØff works in full on your phone, with or without an account. What you log there stays on your phone and in your phone's own backup unless you choose to send it to us (below); anything the app reads from Apple Health or Health Connect always does. We don't receive it, so we don't collect it. The savings calculator on this website runs in your browser and sends us nothing.
What we collect, and only when you choose
Your synced plan and log, if you turn on sync
With sync on, the app sends us a copy of what it records, so your devices stay in step and a new phone can restore it. That copy includes:
- your plan: the route you chose, where you started, how long the plan runs, your quit day and your waking hours
- your puffs and skips, slips, and any strength steps you planned or took
- your cravings, what set them off, and the go-tos you tried
- nicotine replacement you logged and any stop smoking medicine you said you use
- the reasons you wrote, your pods or disposables, and what vaping costs you
- your answers to check-in questions, the badges you've earned, and the names of your devices
Photos you add to your reasons, and anything from Apple Health or Health Connect, are never synced.
Programme reports, if you join a programme and agree
If your employer, college or quit service gives you a code and you agree to take part, the app sends us a weekly word for how it went against your plan, the milestones you reach, your answers to a few check-in questions, and, only if you choose to tell us, why you stopped using TaperØff. Your puffs, cravings, reasons and times of day are never part of a report.
Your account and purchases, if you make an account
Your email address, how you sign in, your choices about sync and email, and, if you buy TaperØff Plus while signed in, which product you have and when it renews or ends. Because they show that you use a quit-vaping app, we treat these as consumer health data too.
What you write to us
If you email us about your health or your plan, we hold what you write so we can answer.
What we don't collect
We don't collect your location, contacts, browsing history or advertising identifiers, and we don't set up geofences of any kind. If you say yes to Help improve TaperØff, the app sends a daily tally of events with no identifier, nothing that names your account, and no time of day, and tells PostHog how the app is used (which screens and buttons, never what you log or anything about your quit) under a random number made on your phone; crash reports carry the device model and app version and nothing you've recorded. We keep both in a form that can't reasonably be linked to you, we don't try to link them, and we'd require anyone we gave them to not to try either.
Where it comes from
- You, through the app, when you turn on sync, join a programme, make an account or write to us.
- Apple or Google, when you sign in with them (your email address and an account id) and when you buy or restore Plus (the store's signed record of the purchase).
- Your organisation, only as the code it gave you. It never sends us anything about you.
Why we use it
- To keep your devices in step and restore your plan on a new phone.
- To sign you in and keep Plus working on every phone you use.
- To give an organisation that paid for your place group totals about its programme.
- To answer you when you write to us, and to fix a problem you've asked us about.
- To keep the service secure and meet our legal obligations.
We don't use your health data for advertising, to build a profile of you, or to decide what to market to you. We don't analyse synced logs to study how people use the app. If we ever wanted to, we would ask you first, separately.
How we ask for consent
Before anything is collected, the app shows you what it will send, why, who handles it, and how to stop. Each choice is its own: making an account doesn't turn on sync, turning on sync doesn't join a programme, and agreeing to our terms is never taken as consent to any of them. You can say no and the app keeps working on your phone. You can withdraw consent at any time in the app, or by writing to us.
Who we share it with
We don't sell consumer health data, and we don't share it with anyone for their own use. The companies below process it for us, only on our instructions and under contract.
- Cloudflare runs our servers and stores accounts, synced logs and programme reports, in its EU jurisdiction. It also sends our email.
- Resend sends email for us: sign-in codes, a reminder before a free trial ends, and marketing email only if you opt in.
- Sentry receives crash reports and diagnostic notes, which carry nothing you've recorded.
- PostHog receives how the app is used, only after you say yes, in the EU, and nothing you've recorded.
- Forward Email and Google deliver and hold email you send to quit@taperoff.io.
- Google Cloud passes Google Play's purchase notifications to our server.
Apple and Google run the app stores and sign-in. To check a Plus purchase we send them the purchase record they issued; we don't send them anything you've logged.
Organisations that run a programme see totals across everyone taking part, never you, and any figure covering fewer than 10 people is hidden. They never see your name, your email or your log. We require them not to try to identify anyone from those totals.
We'll disclose information to a court, a regulator or the police only when the law requires it, and we'll tell you first unless the law forbids it.
Your rights
Whichever state you live in, you can:
- See what we hold. You → Account → Export my data gives you everything we hold for your account. We've shared your consumer health data with no third parties beyond the processors listed above; if that ever changes, your copy will name them and how to reach them.
- Withdraw consent. Turn sync off in You → Account, and we erase your synced plan and log. Stop sharing in You → Your programme, and we erase the reports you've sent.
- Delete it. You → Account → Delete account erases your account, synced data and programme reports straight away. Copies in our provider's recovery backups expire within 30 days. We tell the processors above to delete what they hold for you.
- Correct it. Change it in the app, or ask us to.
Or write to quit@taperoff.io from the address on your account. Someone you've authorised can write for you, with proof that you've authorised them. We'll ask you to confirm it's you, and we'll answer within 45 days. If we need longer, we'll tell you why within those 45 days, and take no more than 45 more. It's free, twice in any 12 months.
If we say no
If we turn down a request, we'll tell you why. You can appeal by replying, or by writing to quit@taperoff.io with "Appeal" in the subject. Someone who didn't make the first decision will answer in writing within 45 days. If we still say no, you can complain to your state's Attorney General:
- Washington: atg.wa.gov/file-complaint
- Nevada: ag.nv.gov
- Connecticut: portal.ct.gov/ag
How long we keep it
- Synced plan and log: until you turn sync off or delete your account.
- Programme reports: until you stop sharing, or 90 days after the programme ends.
- Your account: until you delete it, or until it has been unused for 24 months, after a warning email.
The privacy notice has the full list, and the security page says how we protect it.
Changes
If we want to collect a new kind of health data, or use it for a new purpose, we'll ask for your consent in the app first. We'll post any change to this policy here before it takes effect.