Privacy

The main points

What you log stays on your phone, unless you turn on sync or choose to share how your quit is going.
In a friend group, your group sees only what you choose, never your puff log or a slip. In the community totals nobody sees your name.
We never sell your data, and we never use it for ads.
If you got TaperØff in the UK, the app tells us how it's used, such as which screens are opened, but never what you log or anything about your quit. You can turn this off in You › Privacy and your data.
Nothing is shared unless you choose to share it. You can change every choice in You › Privacy and your data.
If you use a code, whoever gave it to you only sees totals for groups of 10 or more, never you.
If you choose to help Ulster University's research, the researchers only see totals for groups of 10 or more, never you.
You can export or delete your data at any time.
TaperØff is for adults 18 and over.

Who we are

TaperØff is made by Slipstitch Limited ("we", "us"), which also runs this website. We are responsible for your data (the "controller") under UK data protection law: the UK GDPR and the Data Protection Act 2018. For people in the European Union, the EU GDPR applies too. TaperØff is available in other countries, and wherever you live, this notice applies to you.

Slipstitch Limited, registered in Northern Ireland, company number NI744542. Registered office: 108 Stoneypath, Londonderry, Northern Ireland, BT47 2AF.

For anything about privacy, email quit@taperoff.io. We haven't appointed a Data Protection Officer. Write to the same address and the right person will answer.

What stays on your phone

This is kept on your phone, and on your watch if you use one. We don't receive it unless you turn on sync:

every puff, vape or slip you log, your cravings and what set them off, and your plan;
your reasons and your commitment;
your go-tos, including the people you pick to call or text (we only keep the names and numbers you choose, never your whole contacts list);
the answers you give when you set up, such as how often you vape and how soon after waking;
nicotine replacement and stop smoking medicines you record;
your check-in answers (unless you agree to share them, with a code or on their own: see below).

Some things stay on your phone even with sync on, and are never sent to us:

your reason photos and the focus point you choose for each one;
your answer about weight-loss or diabetes jabs;
anything from Apple Health or Health Connect. Only if you allow it, TaperØff reads your resting heart rate, heart rate variability, cardio fitness, sleep, and the steps on walks you take instead of vaping, to show them next to your progress. It saves breathing exercises as mindful minutes, and a walk you start from a craving as a walking workout: on iPhone from your Apple Watch, on Android from your Wear OS watch, saved to Health Connect (you can also choose to save how you felt after a craving). For that walk, your Wear OS watch uses its activity sensors only while the 5 minutes run; nothing it measures is kept, read by the app or sent anywhere. What TaperØff reads from Health stays in the app on your phone: it is never synced, backed up or sent to us. What it saves to Health is kept by Health, under your Apple or Google settings;
the microphone in Clear the air. It only measures how loudly you blow, while that screen is open. Nothing is recorded, kept or sent.

Coaching notes are chosen on your phone from a fixed set of messages. Nothing you log is sent to an AI service to do it.

Your phone's own backup, and your watch

On Android, the app's data is part of your phone's own Google backup, so restoring that backup to a new phone brings your plan with it, even without an account. That backup is held by Google under your Google account, not by us. On iPhone, the app's data isn't part of iCloud backups. To bring your plan to a new iPhone, sign in and turn on sync.

If you use TaperØff on an Apple Watch or a Wear OS watch, your phone and watch swap entries directly over Apple's or Google's connection between your own paired devices. That doesn't pass through any server of ours.

What can leave your phone, and when

Each of these only happens if you choose it.

Signing in (Apple, Google or an email code)

What leaves your phone: your email address (or Apple's private relay address), which ways you sign in, a name for each signed-in device if you give one, when you signed in, and your choices about sync and email. We store only a fingerprint of each sign-in token, never the token itself. If you sign in with Apple, we also keep the token Apple gives us for TaperØff, so that when you delete your account we can tell Apple to end TaperØff's access to your Apple ID.
Who sees it: us, to sign you in and bring Plus back on a new phone.
How to stop: delete your account in You › Account and sync › Delete my account.
Why: to sign you in, restore your plan, keep Plus on all your devices, and send the emails the service needs: sign-in codes, a welcome, a reminder before a free trial ends, and a confirmation when you delete your account.
Lawful basis: contract. We need it to give you the account you asked for.
Kept: until you delete your account, or until it has been unused for 24 months (see "How long we keep it").

Once you're signed in, you stay signed in on that phone until you sign out, delete the app, or don't use the app for 90 days.

Sync, off unless you turn it on

What leaves your phone: your plan and everything you log in TaperØff: puffs, skips and slips, cravings and what set them off, your go-tos and if-then plans, your quit day and waking hours, strength steps, nicotine replacement and stop smoking medicines, check-in answers, your reasons and commitment, badges, pods, your devices and what vaping costs you. Never your photos, your jab answer, or anything from Apple Health or Health Connect.
Who sees it: it's stored on our servers in the EU, so your devices stay in step and a new phone can restore it.
How to stop: turn sync off in You › Account and sync. We erase the synced copy we hold, and nothing more is sent. Your phone keeps everything.

What you log about vaping is health information under UK GDPR Article 9. So making an account doesn't turn sync on: the app asks you separately, before the first sync, and explains what it sends.

Lawful basis: your explicit consent (UK GDPR Articles 6(1)(a) and 9(2)(a)).
Kept: until you turn sync off or delete your account.

We don't use your synced log to market to you, to profile you, or for advertising, and we never share it with an employer or service. The few people who run TaperØff can technically reach what we store, and only look at your account's data to fix a problem you've asked us about.

Help improve TaperØff

Help improve TaperØff is one switch in You › Privacy and your data. It covers two things.

How the app is used: that something happened in the app, such as "the app was opened", "a plan was created", "the Plus page was shown" or "a free trial started", with the platform, app version, phone model and language, under a random number made on your phone. Reinstalling the app makes a new one. Never what you log, a craving, a slip, an answer you give or anything else about your quit, and nothing that names your account. PostHog stores it for us in the EU.
Daily counts: a count of things that happened in the app each day, such as "the craving button was opened" or "the app was opened before noon". No time of day, and nothing that names your account or your phone. Only we see them, as totals.
When it's on: if you got TaperØff from the UK App Store or Google Play, how the app is used is sent from the start, and the daily counts wait until you say yes. Everywhere else, both wait until you say yes.
How to stop: turn it off in You › Privacy and your data, and nothing more is sent.
Lawful basis: in the UK, how the app is used rests on our legitimate interest in knowing which parts of TaperØff help people and where they get stuck. We've weighed that against your privacy by leaving out everything about your quit and anything that names you, and UK law allows it with this notice and a switch to turn it off. Everywhere else, and for the daily counts, it rests on your consent.
Kept: how the app is used, 12 months. Daily counts are kept as anonymous totals; because they can't be linked to you, we can't pick out or delete your share of them.

A code from an organisation

You may get a code from an employer, a university or a stop smoking service. When you use it, you tick a box to agree to share how your quit is going, without your name. A code gives you TaperØff Plus for up to 52 weeks.

What leaves your phone: the milestones you reach (starting your plan, halving your puffs, getting to a quarter of where you started, your quit day, and finishing the plan); your answers to a few short check-ins (a month in, on your quit day, then 4 weeks, 12 weeks, 6 months and a year after it); and, only if you choose to tell us, why you stopped using TaperØff. If you used your code on or after 24 October 2026, also your freedom check, only as how many of its 4 answers moved towards needing it less, never the answers themselves. These are sent under a random programme number, never your name. Never your puffs, cravings, reasons, devices, spending, health data, name or email.
Who sees it: the organisation sees totals only, for groups of 10 or more, and every total is rounded to the nearest 5. Any figure covering fewer than 10 people is hidden. If you're signed in when you use the code, we link your place to your account so a new phone keeps it. That link is ours alone: the organisation never sees it.
How to stop: turn off "Share how my quit is going" in You › Privacy and your data. What you shared is deleted, and the free Plus from the code ends. You can carry on with the free app or buy Plus.
Why: so the organisation that paid for your place can see whether its programme is working.
Lawful basis: your explicit consent (UK GDPR Articles 6(1)(a) and 9(2)(a)).
Kept: until you stop sharing, or 90 days after the programme ends. A record that a place was used stays, with nothing about you in it.

If you don't have a code, you can tell us where you'd like to get one (through work, a university or college, a stop smoking service, a health service, or somewhere else). That sends one anonymous count for the day, once from each phone, and nothing else: nothing that identifies your account or your phone, and no free text.

Share how your quit is going, to help us learn what works

If you don't have a code, we ask you once, at your first check-in (about 30 days into your plan, or on your quit day if that comes sooner). It's off unless you say yes, and your check-ins work either way.

What leaves your phone: your check-in answers and the milestones you reach, as listed above for codes, without your name. No weekly word, never your puff log. They're sent under a random number that isn't linked to your account.
Who sees it: us, only as totals, to see whether TaperØff helps people stop.
How to stop: turn it off in You › Privacy and your data. What you shared is deleted.
Lawful basis: your explicit consent (UK GDPR Articles 6(1)(a) and 9(2)(a)).
Kept: until you turn it off. If nothing new arrives for 24 months, we delete it.

Saying yes here doesn't cover research with a university. That is asked separately, below.

Help Ulster University's research, off unless you say yes

Ulster University is studying what helps people stop vaping. On its own screen, separate from any code and from the choice above, we ask whether you'd like to help. It's off unless you say yes, and saying no changes nothing in the app.

What leaves your phone: how you're stopping (for example Taper down or Cold turkey); whether you had stopped before; your answer about GLP-1 medicines, and which one if you said; the milestones you reach; your check-in answers, including 6 months and a year after your quit day; and your freedom check, only as how many of its 4 answers moved towards needing it less. They're sent under a random number that isn't linked to your account, a code or your phone. Never your puffs, cravings or what set them off, your reasons, notes, messages or photos, Apple Health or Health Connect data, your name, email or devices.
Who sees it: we hold the answers. Ulster University's researchers only receive totals for groups of 10 or more, each rounded to the nearest 5. Any figure covering fewer than 10 people is hidden, and no one, including the researchers, can see one person's answers.
How to stop: turn it off in You › Privacy and your data. What you shared is deleted straight away.
Why: to learn what helps people stop vaping, including whether people on a GLP-1 medicine find it easier.
Lawful basis: your explicit consent (UK GDPR Articles 6(1)(a) and 9(2)(a)).
Kept: until you turn it off. If nothing new arrives for 24 months, we delete it.

Share my progress

What leaves your phone: a few lines you see in full before you send them: how many days since you started, how your plan is going (such as the day of your plan, or days vape-free), and money kept. Never your log, times or cravings.
Who sees it: only the people you send it to, through your phone's share sheet. It never passes through us.
How to stop: you choose each time.

Quit together: a friend group

Quit together and Everyone on TaperØff are in test versions of the app now. They come to the App Store and Google Play versions in a later update, and this notice says so when they do.

A friend group is two to six people who invite each other with a link. It needs a TaperØff account and Plus. In each group you choose what it sees, on the screen where you join, and you can change it at any time without anyone being told.

What leaves your phone: the name you choose for that group (your own or a made-up one); how far through your plan you are, such as "Day 13 of the plan", "3 of 5 breaks today" or your days vape-free, unless you choose milestones only; the latest milestone you reached and when; your quit day only if you tick it; the high fives and encouragement notes you send (one of five we wrote, kept for two days); a request for help when you ask for one (who it's to, and whether you'd like a message or a call); and, when you open someone's request for help, that you have seen it, so they can be told. Never today's numbers, your puff log, your reasons, photos, notes, triggers or what helps you.
Who sees it: the people in that group, and us only to run it. Your group never sees a slip.
Notes on your phone: if you allow them, your phone's notification token and its time difference from UTC (so quiet hours work) come to us, and Apple or Google deliver the notes. A note never says "vaping" or "vape-free", in case someone else sees your screen.
How to stop: pause sharing, change what the group sees, or leave the group, in the group's settings. Leaving deletes what you shared with that group from our server straight away. Deleting your account deletes every group's copy.
Lawful basis: your explicit consent (UK GDPR Articles 6(1)(a) and 9(2)(a)).
Kept: while you're in the group. Requests for help are deleted after 24 hours. An invite link works once and stops working after 7 days.

Everyone on TaperØff and community groups

Anyone can look at the day's anonymous totals: how many people are quitting, how many said they were vape-free today, and so on. Being counted, and getting high fives, are two separate choices, and both are off until you say yes.

What leaves your phone if you say "Count me in the totals": once a day, when you open the app, how long you've been at it as a range (such as "first week"), whether you were vape-free today, the cravings you got through today and your vape-free days so far. Someone who doesn't open the app isn't counted as vape-free.
If you say "Send me high fives": the milestones you reach, and the high fives you send.
How it's sent: under a random number that isn't linked to your account or your name. If you turn on notes about high fives, your phone's notification token is kept with that number so the note can reach you. If you joined with an organisation's code, it also says which organisation, so its community group can show its own totals.
Who sees it: everyone, only as totals, and only for groups of 20 people or more. How many high fives you got goes only to you. An organisation never sees you, only the same totals.
How to stop: turn both off in You › Together. What you sent is deleted.
Lawful basis: your explicit consent (UK GDPR Articles 6(1)(a) and 9(2)(a)).
Kept: each day's report is deleted within 2 days, once it's added into that day's totals. The totals are kept, with nothing about you in them. If nothing arrives for 400 days, the random number is deleted too.

Share a summary

What leaves your phone: a one-page summary that you see in full before you send it: how you're stopping, your starting point, the last 7 days, the trend, days within your plan, your main triggers, your vape and its strength, nicotine replacement and medicines, and your quit day.
Who sees it: only the person you send it to, such as a doctor, nurse or stop smoking adviser. It's made on your phone and never passes through us.
How to stop: you choose each time.

Export my log, and Import a log

What leaves your phone: a file of everything on your phone, readable, or as a spreadsheet.
Who sees it: only wherever you save or send it.
How to stop: you choose each time.
Importing: Import a log reads a file you pick and adds what isn't already on your phone. It happens on your phone, nothing is sent to us, and nothing already there is replaced or removed.

Buying Plus

Payments are taken by Apple or Google; we never see your card details. If you're signed in when you buy or restore, the app sends us the store's signed record of the purchase, and we check it with Apple or Google. We keep which product you have, when it renews or ends, whether you're in a free trial, and refunds. Without an account, the purchase is checked on your phone and nothing about it reaches us.

Why: so Plus works on every phone you sign in on, and so renewals, cancellations and refunds take effect.
Lawful basis: contract.
Kept: linked to your account until you delete it. After that, a record of the purchase itself, with nothing that identifies you, is kept for up to 6 years for our tax and accounting records. Apple and Google keep their own records under their own policies.
How to stop: manage or cancel Plus in your Apple or Google account.

Emails from TaperØff, only if you opt in

It's off unless you switch it on in You › Account and sync. If you do, we may email you now and then: a note if the app hasn't synced for a few days, and 3 emails in the month after Plus ends (a week, 2 weeks and 4 weeks after). No tracking pixels, and every email has a one-click unsubscribe link.

Quit-day letters are a separate switch in You › Account: three short emails, the day before your quit day, on the day, and a week after. They're off unless you turn them on. To send them, the app gives us one date, your quit day, and nothing from your log. Turning them off, or the unsubscribe link in any of them, removes the date, and we delete it anyway once the last letter's days have passed.

Lawful basis: your consent (UK GDPR and the Privacy and Electronic Communications Regulations).
Kept: your choice is kept with your account. We keep a note of which emails we've sent so we never send one twice.

Crash reports

When the app stops unexpectedly, it sends us a crash report through Sentry so we can find and fix the fault, and our server reports its own faults the same way, without the content of any request. The app also sends a short diagnostic note when something goes wrong without a crash. A report carries the device model, system version, app version and where in the code it stopped. It never carries anything you have recorded, nothing from your account, no screenshots, and nothing that identifies your phone to us.

Lawful basis: our legitimate interest in keeping the app working, which we've weighed against your privacy by keeping the reports this small.
Kept: 90 days.

If you've chosen to share analytics with Apple or Google in your phone's settings, they may also pass us anonymous crash reports and usage statistics under their own policies; you can turn that off in those settings.

The launch list, only if you sign up on this website

Before TaperØff is in the app stores, you can ask on this website to be told when it is. We keep your email address, which phone you chose, which version of the sign-up wording you agreed to, and when you signed up.

Why: to send you one email when TaperØff is in your phone's app store. Nothing else.
Lawful basis: your consent (UK GDPR and the Privacy and Electronic Communications Regulations), given by ticking the box.
How to stop: use the unsubscribe link in the email, or write to quit@taperoff.io, and we delete your address.
Kept: until that email has gone, then deleted. If we never send it, we delete your address 12 months after you last signed up.

If you email us

We get your email address and what you write, and use them to reply. Lawful basis: our legitimate interest in answering you. We keep the conversation only as long as we need it to help you.

This website

This site has no advertising and no tracking cookies. The savings calculator runs entirely in your browser; what you type into it is never sent to us. Your light or dark theme choice is kept in your browser's local storage. Like any website, the host sees your IP address and the pages you ask for, and uses them to deliver the pages and protect the site from attacks.

Why we use it

Your consent. How your quit is going is health information, so we only send it when you've agreed: sync, a code, sharing how your quit is going, helping Ulster University's research, a friend group, or the community totals. You can take your consent back at any time, and that doesn't change what was done before.
To give you what you asked for. Signing in, sync and Plus need your email address and whether you've paid.
To make the app better. Help improve TaperØff (above says when it's on), and small crash reports.

We never sell your data. We never use it for ads. We never share anything that could identify you with an employer, university or health service. We don't make decisions about you by automated means that have legal or similarly significant effects.

Where it's stored and who helps us

Accounts, synced data, purchases, shared check-ins and milestones, research answers, usage counts and the launch list are stored by Cloudflare, in its EU jurisdiction. Requests are handled by Cloudflare's network close to you, which can be outside the EU, but the data is stored in the EU. Everything travels over an encrypted connection (TLS) and is encrypted at rest. It is not end-to-end encrypted: we can technically read synced data, and we limit who can. The security page explains how we protect it.

A few companies help us run TaperØff. They can only use your data to do that job for us.

Cloudflare: runs our servers and database (stored in the EU), sends our email, and hosts this website.
Resend: sends sign-in codes and other email where we don't send it through Cloudflare.
Sentry: receives crash reports and diagnostic notes, in the EU.
PostHog: receives how the app is used, under Help improve TaperØff, and the website's page and button counts described above, in the EU.
Apple and Google: Sign in with Apple and Sign in with Google, the App Store and Google Play, payments for Plus, TestFlight, and your phone's backups. If you allow notes from a friend group or about high fives, Apple's push service or Google's Firebase Cloud Messaging delivers them. Their own privacy policies apply.
Forward Email and Google: deliver email sent to quit@taperoff.io.

Where a provider processes data outside the UK, we rely on the safeguards UK law requires, such as adequacy regulations or the International Data Transfer Addendum.

How long we keep it

On your phone: until you delete it or delete the app. Deleting your data explains how.
When you turn sync off, we erase your synced plan and log; your account stays.
When you delete your account, we erase your account, your synced plan and log, your sign-ins, the link to your purchases, and any programme reports you sent, straight away, and email you to confirm. Copies in our provider's database recovery backups expire within 30 days.
If an account is unused for 24 months (no sign-in and no sync), we email you at least 30 days before deleting it. Signing in or syncing once keeps it. An account with Plus still running isn't deleted this way.
Sign-in codes expire after 10 minutes. Sign-ins end after 90 days unused.
A code's shared answers go when you stop sharing, or 90 days after the programme ends.
Sharing how your quit is going goes when you turn it off, or 24 months after the last answer arrives.
A friend group: what you shared goes when you leave the group or delete your account; requests for help after 24 hours.
The community totals: each day's report within 2 days, once it's counted; the totals are kept, with nothing about you in them.
Research answers go when you turn it off, or 24 months after the last answer arrives. The researchers' totals hold nothing about any one person.
Your quit day for quit-day letters goes when you turn them off, unsubscribe, or 10 days after the quit day.
How the app is used goes after 12 months. Usage counts are kept as anonymous totals.
Crash reports go after 90 days.
The launch list: your address goes once the launch email has been sent, or 12 months after you last signed up if it never is.

Your choices and rights

All your choices are in You › Privacy and your data: sharing on or off, Help improve TaperØff, export your log, or delete everything. "Delete everything" removes your plan and history from your phone and your watch. If sync is on, it also deletes the copy on our servers, and this can't be undone.

You also have the right to:

see the data we hold about you (You › Account and sync › Export my account data gives you a copy);
have it corrected;
have it deleted;
get a copy to take elsewhere;
object to how we use it, or ask us to limit it;
take back your consent at any time.

To ask, email quit@taperoff.io, from the address on your account if you have one. We'll reply within 1 month. We may ask you to confirm it's you before we act.

If you live in the United States

What we hold and why is the same wherever you live, and so is everything above. State privacy laws, such as California's, give you the right to know what personal information we hold, to get a copy, to have it corrected or deleted, and not to be treated differently for using those rights. You can use them the same way: in the app, or by writing to quit@taperoff.io. We'll confirm it's you and answer within 45 days. If we turn a request down, you can appeal by writing to us with "Appeal" in the subject.

We don't sell your personal information, and we don't share it for cross-context behavioral advertising. We use sensitive information, such as your synced log, only to give you the service you asked for. So there is nothing to opt out of, and we treat a Global Privacy Control signal as a request not to sell or share, which we already honor.

Your plan and log are health information. Our consumer health data policy explains how we handle it under Washington, Nevada and Connecticut law, how we ask for consent, and how to withdraw it.

Age, changes and complaints

Age: TaperØff is for adults 18 and over. We don't knowingly collect data from anyone younger.
Changes: if we change this notice in a way that matters, we'll tell you in the app, and by email if you have an account, before it takes effect.
Complaints: please tell us first at quit@taperoff.io. You can also complain to the data protection regulator where you live. In the UK, that's the Information Commissioner's Office, at ico.org.uk or on 0303 123 1113. In Ireland, it's the Data Protection Commission, at dataprotection.ie.