This policy explains what data Unpuff collects when you use unpuff.net, why we collect it, and what rights you have. We try to keep things simple and minimal — we only collect what we need.
1. What we collect
- Account info: your email address and (optional) name.
- Onboarding answers: your reasons to quit, vaping habits, triggers, goals, and chosen quit date.
- Vaping tracker: dates, daily vape counts, and prices that you enter yourself.
- Course progress: which lessons you marked as completed.
- Payment data: processed entirely by Stripe. Card numbers never reach our servers.
- Technical data: IP address, browser, device type, and timestamps of your visits.
2. How we use it
- To provide and personalize your quit-vaping program.
- To process subscription payments and send receipts.
- To improve the product based on aggregated usage patterns.
- To run advertising campaigns (with hashed identifiers — see below).
- To respond to support requests.
3. Third-party services
We share specific data with these processors:
- Stripe (payments) — billing details, last 4 digits of card, country. Stripe is PCI-DSS compliant.
- Meta / Facebook (advertising) — we send hashed (SHA-256) email and event data via the Conversions API for ad attribution. Browser-side Facebook Pixel may set cookies.
- Amazon Web Services (hosting) — your data is stored on AWS servers in Frankfurt, Germany.
- Google (optional sign-in) — if you choose "Sign in with Google", we receive your name and email.
4. Cookies
We use a session cookie to keep you signed in and a preference cookie to remember your language. Meta Pixel may set advertising cookies. You can clear cookies anytime in your browser.
5. Your rights
If you're in the EU/EEA, UK, or California, you have the right to:
- Access the data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your account and data.
- Object to or restrict our use of your data.
- Opt out of advertising tracking.
- Receive a copy of your data in a portable format.
To exercise any of these rights, email support@unpuff.net with the subject "Privacy". We'll respond within 30 days.
6. Data retention
We keep your account data while your subscription is active and for up to 12 months after cancellation, after which it is deleted. Payment records are retained for 7 years to comply with tax and accounting laws.
7. Security
All connections use HTTPS. Database access is restricted to authorized personnel. Payment data never touches our servers — Stripe handles it directly.
8. International transfers
Our infrastructure is in the EU (Germany). Some processors (Stripe, Meta) may transfer data to the US under standard contractual clauses approved by the European Commission.
9. Children
Unpuff is intended for adults (18+). We do not knowingly collect data from minors. If you believe we've collected data from a minor, contact us and we'll delete it.
10. Changes
We may update this policy. Major changes will be sent by email. The "Last updated" date at the top reflects the latest revision.
11. Contact
For privacy questions:
Email: support@unpuff.net
Address: Unpuff, Ambelakion str 30, apt. 301, Limassol, Cyprus.