This Privacy Policy ("Policy") describes how I12Y Ltd ("Company", "we", "us", or "our") handles data when you use the ZyQuit application ("App"). ZyQuit is a behavioural coaching app for people who are quitting nicotine pouches. We designed it to work without accounts, without your name, and without your email address, and this Policy explains exactly what that means in practice. We act in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, and other applicable data protection laws.
The short version. The App has no sign-up and no user accounts. Everything you log — pouches, resisted cravings, your plan — is stored on your device. Nothing leaves your device at all unless you choose to pair with a partner, and even then we receive only counters for the day, tied to a random identifier that is not linked to you as a person. We do not run advertising, we do not sell data, and we do not track you across other apps or websites.
The following is stored locally on your iPhone using Apple's on-device storage and is not transmitted to us:
If you delete the App, this data is deleted with it. We cannot recover it, because we never had it.
If, and only if, you choose to pair with a partner, the following is sent to our server:
Your partner sees the same kind of information about you that you see about them: today's count against today's limit, whether the day is on plan, and the shared streak. Your partner does not see your intake answers, your spending, or your history beyond what is needed for the shared streak.
When you start a trial or subscribe, Apple processes the payment and RevenueCat, acting for us, records an anonymous subscriber identifier and your subscription status (plan, active or expired, trial or paid). We never receive your name, card, or Apple ID. This is what lets the App know that your subscription is active and lets "Restore" work on a new device.
To understand which parts of the App work and where people get stuck, the App sends anonymous usage events — for example, that a screen was opened, a plan was created, a pouch was logged, SOS was used, or an invitation was created. Events are tied to a random installation identifier generated by the App; they contain no name, email, contacts, precise location, or advertising identifier, and we do not collect your IP address or device identifiers assigned by Apple, such as the identifier for vendors (IDFV), with them. Analytics data is processed for us by Amplitude, Inc. (USA) under Standard Contractual Clauses. You can switch analytics off at any time in Settings → "Share anonymous usage data".
Records of nicotine use may be considered data concerning health under Article 9 of the GDPR. We treat this information accordingly.
ZyQuit provides behavioural coaching only. It is not a medical device, it does not provide medical advice, diagnosis, or treatment, and it does not claim to treat nicotine dependence. Speak to a qualified healthcare professional about your health.
The App makes no automated decisions producing legal or similarly significant effects. Your plan is arithmetic based on the answers you gave; you can change it at any time.
Partner Mode data is stored on servers located in the European Union. We apply appropriate technical and organisational measures:
No method of transmission or storage is completely secure; we cannot guarantee absolute security. If a personal data breach is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours and affected users without undue delay, as required by Art. 33–34 GDPR.
Retention. Partner Mode data is kept while the pair is active. When either side unlinks the pair, the pair and its reports are deleted from our server. The device record itself (random identifier, token hash, timestamps) is retained while you use Partner Mode and deleted after 12 months without activity. Unused invitation codes expire automatically. Local data on your device lives until you delete it or remove the App.
Server logs are rotated within 30 days. Server backups are overwritten within 30 days, so deleted pair data disappears from backups within that period.
We use as few third parties as the App can function with. Each acts as a processor or independent controller as indicated:
We do not sell, rent, or trade data. We do not use data for advertising. There are no advertising networks and no data brokers.
Under the GDPR and comparable laws you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), withdrawal of consent, and the right to lodge a complaint with a supervisory authority.
Because the App has no accounts, most of these rights you exercise directly and immediately:
For anything else, write to privacy@zyquit.com. Note that we cannot identify you from a Device Identifier alone, so for requests about server data we may need the identifier from your device to locate anything at all — and if you have already unlinked, only an anonymous device record remains, which is deleted after 12 months of inactivity.
ZyQuit concerns nicotine use and is intended only for adults of legal age to purchase nicotine products in their jurisdiction, and in no case under 18. We do not knowingly process data from minors. If you believe a minor has used the App, contact privacy@zyquit.com.
The App uses no cookies and no cross-app or cross-site tracking technologies. It stores settings, its last known pair status, and the random installation identifier used for the anonymous analytics described in Section 2.4 locally on your device using Apple's standard storage, and it keeps your server token in the iOS Keychain. None of this is used to profile you or to follow you across other apps or websites.
The App sends local reminders on your device if you allow notifications; these are generated on the device and no data is sent to us. We do not send marketing messages — we have no address to send them to.
We may update this Policy to reflect changes in the App or in legal requirements. Material changes will be announced in the App before they take effect, and the "Last updated" date above will change. Continued use after that date means you accept the updated Policy.
Data Controller: I12Y Ltd Registration number: HE 442933 Registered address: Nicosia, Cyprus
Privacy inquiries: privacy@zyquit.com
General support: support@zyquit.com
You also have the right to complain to the Office of the Commissioner for Personal Data Protection of Cyprus or to your local supervisory authority. UK residents may complain to the Information Commissioner's Office (ico.org.uk). This Policy is governed by the laws of the Republic of Cyprus.
Residents of California and other US states with comprehensive privacy laws have rights to know, delete, correct, to data portability, and to non-discrimination. We do not sell personal information and do not share it for cross-context behavioural advertising, so no opt-out is required.
Self-reported nicotine use may be sensitive personal information; we use it only to provide the App and Partner Mode, never for inference or advertising, so no "Limit the Use" opt-out is needed.
To exercise these rights, see Section 8 or contact privacy@zyquit.com. We respond within 45 days of a verifiable request.
If you reside in Ukraine, your data is additionally protected by the Law of Ukraine "On Protection of Personal Data" (No. 2297-VI), including the right to know where data is stored, to protection against unlawful processing, and to complain to the Ukrainian Parliament Commissioner for Human Rights. Partner Mode data is stored within the European Union as described in Section 6.
If you reside in Canada, PIPEDA and applicable provincial legislation apply. We obtain meaningful consent before processing, limit collection to the purposes in Section 4, and maintain safeguards proportionate to the sensitivity of the data. Complaints may be directed to the Office of the Privacy Commissioner of Canada.
If you reside in Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles apply. We collect only what Section 2 describes, and only for the purposes in Section 4; we do not use your data for direct marketing, and the only overseas recipients are the processors listed in Section 7. You may ask for access to or correction of your data as described in Section 8. Complaints may be directed to us at privacy@zyquit.com and, if unresolved, to the Office of the Australian Information Commissioner (oaic.gov.au).