Privacy Policy
In short:
- If you do not create an account, your counter, metrics and past attempts stay on your device (and in your iPhone's iCloud backup). They do not reach us.
- An account is only for the friends leaderboard and watcher features. If you create one, the data listed below is sent to our servers.
- No ads, no tracking, no advertising identifier, and no third-party analytics or ad SDK in the app. If you have an account and make a purchase, your purchase records are sent from our servers to RevenueCat for revenue reporting only. We do not sell your data.
- You can delete your account yourself in the app (Profile > Account & Subscription).
1. Controller and contact
This policy applies to the iPhone app Breathe In and to this website. The controller of your personal data is Mehmet İlyas İnce (Miselylab). For any privacy question or request, write to miselylab@gmail.com.
2. Data processed only on your device
The following data is kept on your device so the app can work, even if you never create an account. No network request is made for the counter, and this data is not sent to us unless you create an account:
- Your quit date and time, cigarettes smoked per day, cigarettes per pack, time to smoke a cigarette, pack price and price history, and currency.
- Statistics of past attempts (start and end, duration, money saved, cigarettes not smoked, time saved).
- Your name (optional) and your notification preferences.
- Local notifications for recovery stages, milestones and daily motivation. These are created on your device and do not come from a server.
This data is kept in a file in the app's storage. For iCloud backup, see this section.
3. Data sent if you create an account
Creating an account is optional and is done with Sign in with Apple. When you create an account and use the related features, the following data is sent to our servers (Google Firebase / Google Cloud):
| Data | When | Purpose |
|---|---|---|
| Sign-in credentials (the identifier Apple provides with Sign in with Apple) and the email address Apple shares with us (it may be Apple's private relay address) | When you create an account | Signing in, recognizing the account |
| Your name (entered by you; it is not taken from Apple) | When you save a name | Showing your name to friends and watchers, using it in notifications |
| Share code (a random 12-character code) | When the account is created | Adding friends and watchers |
| Account start time (server time) | When the account is created | Points calculation (points count from the moment the account is created) |
| Slip and reset events ("continue" and "reset") with server time | When you choose in the "I smoked" flow | Points and streak, notifying your watcher |
| Points summary (points, streak and the parameters used to calculate them) and the start of your current attempt | With the account | Friends leaderboard |
| Friendship, watcher, pending request and block records (including share codes and a snapshot of names of the people involved) | When you send, accept or block | Providing social features |
| Watcher data: cigarettes per day, cigarettes per pack, time to smoke a cigarette, currency, price records, the start of your current attempt and past attempts | Only while you have an active watcher | Letting your watcher see your counter and metrics |
| Push target: Firebase Installation ID (FID) and platform | If you have an account and allowed notifications | Delivering friend and watcher notifications to your device |
| Time zone and app language | When the account is created and when they change | Applying quiet hours (22:00-09:00) in the recipient's time |
| Subscription status: Premium end time, transaction identifier, environment (live or test) and a random purchase identifier tied to your account | After a purchase or restore | Linking and verifying Premium for your account |
| Report records: reporter, reported person, reason (inappropriate name, harassment, fake account, other) and a snapshot of the name | When you report someone | Preventing abuse (Apple guideline 1.2) |
If you create an account and buy Premium, some of your purchase records are also sent from our servers to RevenueCat for subscription and revenue reporting; section 5 lists what is and is not sent.
Some of this data indirectly shows your effort to quit smoking and may be considered health information. For that reason we process it only when you create an account and use the related feature, and only to provide that feature.
As with every internet service, when your device connects to our servers your IP address and connection details are technically processed by Google and Apple infrastructure. Apple App Attest and Firebase App Check are used to verify that requests come from a genuine device and app; this is not used to examine your identity or usage habits.
4. Who can see your data
- Your friends: Friends you both accepted see your name, points, streak and time smoke-free in the leaderboard. They do not see your slip or reset events.
- Your watchers: A person is added as a watcher only if you accept their request. A watcher sees your name, counter, metrics, past attempts, points and streak, is notified when you reset or choose to continue after a slip, and receives periodic positive summary notifications without details while the relationship lasts. You can have at most 3 watchers and a watcher can watch at most 3 people. A watcher's access lasts as long as your Premium does and for 2 days after it ends; without Premium, your information is not visible to watchers. You can remove a watcher at any time.
- Other users: Someone who knows your share code can send you a friend or watcher request. When the request reaches you, the sender's name is visible to you; your data is not opened to the other side until you accept. You can decline, decline and block, and report the person. A blocked person is not told they were blocked.
- Us: As the developer, we may access server data to the extent needed to operate the app and review reports.
5. Service providers (processors)
- Google Firebase / Google Cloud: authentication (Firebase Authentication), database (Cloud Firestore), server functions (Cloud Functions), notification delivery (Firebase Cloud Messaging) and app verification (App Check). Firestore data and functions run in Europe, in the
europe-west1(Belgium) region. - Apple: purchases (App Store, StoreKit), Sign in with Apple, push notification service (APNs) and iCloud device backup. Apple processes your payment information; we never see your card or payment details. Apple tells us your subscription status and transaction identifier.
- RevenueCat, Inc. (USA): subscription and revenue reporting (sales dashboards and sale notifications for the developer). RevenueCat acts as our data processor under its data processing terms (DPA). The data is sent from our servers, not from the app; the app contains no RevenueCat SDK. RevenueCat does not decide whether you have access to Premium. Only if you have an account and make an in-app purchase (Premium), we send: your account identifier (the Firebase user ID, a random identifier); Apple-signed purchase transaction records (product, purchase and renewal dates, price and currency, store country, transaction identifiers, and the sandbox or production environment); and Apple's App Store server notifications about subscription events (renewal, cancellation, refund). We do not send your name, email address, health or smoking/quit data, counters, events, device identifiers or usage data to RevenueCat.
These providers' own privacy policies also apply. We do not share your data with any other third party.
6. Purposes and legal basis
- Account, social features and notifications: based on your explicit consent, to the extent needed to provide these features. Creating an account, using the feature and accepting a request express that consent. You can withdraw it by deleting your account or removing the feature (for example a watcher).
- Premium subscription: performance of the contract with you.
- Report records, security and abuse prevention: our legitimate interest and our obligations under app store rules.
- Legal obligations: where required.
We do not use your data for profiling, marketing or advertising beyond what is described above.
7. Ads, tracking and sale
- The app has no ads.
- The advertising identifier (IDFA) is not used and the app does not track you across other apps and websites. For that reason we do not ask for tracking permission.
- No third-party analytics, usage-measurement or advertising SDK is used in the app. Purchase records are sent from our servers to RevenueCat only for revenue reporting (section 5).
- We do not sell or rent your personal data.
- This website uses no cookies and loads no analytics or external trackers.
8. Notifications
Local notifications (recovery stages, milestones, daily motivation) are scheduled on your device and do not come from a server. Notifications from the server (friend and watcher requests, acceptance, removal, watcher updates) are sent only if you have an account and allowed notifications. You do not have to allow notifications; you can turn them off at any time in iOS Settings or under Profile > Notifications in the app. To keep details off your lock screen you can turn on "Hide details in notifications". Watcher notifications carry no details (for example "There is an update from <Name>").
9. Retention and deletion
- Data on your device stays until you delete it or remove the app.
- Server data is kept while your account is open. When you delete your account it is deleted immediately and removed from any backups within 30 days at the latest.
- Deleting your account: In the app go to Profile > Account & Subscription > Delete account. Your account, name, share code, points, slip and reset records, friendships, watcher relationships and watcher data, notification targets and subscription links are permanently deleted from the server; this cannot be undone. If you created your account with Sign in with Apple, the connection with Apple is revoked when you delete it. Your watchers and the people you watch are informed. When you delete your account, we also ask RevenueCat to delete your customer record.
- What is not deleted: (a) Report records are kept for 2 years to prevent abuse, then deleted. (b) Local tracking data on your device (counter, metrics, past attempts) is not removed by deleting your account; you can delete it in the app or by uninstalling the app. (c) Deleting your account does not cancel your Apple subscription; cancel it separately in App Store settings. (d) Copies in iCloud are in your own iCloud account and are subject to Apple's processes.
- Technical logs: Server logs kept to operate the service (Google Cloud) are deleted automatically after 30 days.
If you cannot access the app, you can send a deletion request to miselylab@gmail.com.
10. iCloud and backup
So that your tracking data is not lost when you move to a new phone, even without an account, the data file on your device is included in your iPhone's iCloud device backup automatically (if iCloud Backup is on). Apple keeps this backup in your iCloud account; we cannot access it. The app does not separately write your tracking data to iCloud.
11. International transfers
Firestore data and server functions run in Europe (europe-west1, Belgium). Some Google services such as authentication, notification delivery and app verification, and Apple services, run on global infrastructure, so your data may be processed in countries outside the European Economic Area and Türkiye. Such transfers are made with the appropriate safeguards offered by the providers (for example standard contractual clauses) and in line with applicable law. Google commits to processing the data under standard contractual clauses. RevenueCat, Inc. processes the purchase data we send it for revenue reporting in the USA. When you create an account, you give explicit consent to your data being processed outside Türkiye (in the European Union, the USA and, where needed, other countries) in this way; you can withdraw your consent by deleting your account.
12. Security
Data is encrypted in transit. The server database is protected by access rules: a user can reach only their own data and the data of people who were allowed to see it, and the client cannot write fields such as points or Premium status. App and server calls are verified with App Check. No system is completely secure; if a breach occurs we will make the notifications required by law.
13. Children
Breathe In is not directed to anyone under 16. If we learn that someone under 16 has created an account, we delete the account and its data. If you think your child has created an account, write to miselylab@gmail.com.
14. Your rights
Under Turkish Personal Data Protection Law No. 6698 (KVKK), article 11, and the EU General Data Protection Regulation (GDPR), you have the right to:
- Learn whether your data is processed, request information, and obtain a copy of your data (access, portability).
- Have incorrect or incomplete data corrected (you can correct your name and profile in the app).
- Have your data erased or destroyed (you can delete your account in the app).
- Restrict or object to processing, and withdraw your consent at any time.
- Learn which third parties your data was transferred to and ask that they be told about corrections or deletions.
- Object to a result against you produced solely by automated processing, and claim compensation for damage caused by unlawful processing (KVKK).
- Complain to a supervisory authority: in Türkiye the Personal Data Protection Board; in the EU, the data protection authority in your country.
Send your request to miselylab@gmail.com. To verify your identity we may ask you to write from the email address of your account or to include your share code. We respond to requests within 30 days at the latest.
15. Changes
We may update this policy as the app or the law changes. We will announce important changes in the app or on this page; the effective date of the current version is at the top of the page. This version took effect on October 4, 2026.