Privacy Policy
We built iQuit on a simple belief: recovery is private. This policy explains, in plain English, what we collect, what we do with it, what we never do, and the rights you have over your data.
1. What we collect
Account information.
- Your email address (or Apple/Google account identifier if you use Sign in with Apple/Google).
- A display name and optional avatar you choose.
- A randomly-generated user identifier we use internally.
Recovery data.
- The addictions you choose to track and your quit date(s).
- Daily check-in answers (sober yes/no, mood, craving intensity).
- Journal entries and Evening Reflection answers you write.
- Embers (in-app currency) ledger entries.
- Chat history with Sam, our AI companion.
Social data — only if you use Circles or post on the Feed.
- Posts, comments, and reactions you create.
- The Circles you join and messages you send inside them.
Device & technical data.
- Device type and operating system version.
- Push notification token (only if you grant notification permission).
- IP address (used solely for security and abuse detection — never sold or shared).
Subscription data. A RevenueCat customer ID and your current entitlement status. We do not receive your credit card information — that stays with Apple or Google.
2. What we never collect
- We never collect your contacts, photos, location, calendar, microphone, or camera unless you explicitly use a feature that requires it (e.g. picking an avatar, voice journaling).
- We do not sell your personal data to anyone. Ever.
- We do not use your data to train third-party AI models for advertising.
- We do not run ads inside iQuit.
3. How we use what we collect
We use the data above only to:
- Operate the app and sync your progress across your devices.
- Generate Sam's responses, including reading your recent Evening Reflections so the conversation feels continuous.
- Detect potential crisis situations and surface hotline information.
- Send the daily reminder, milestone, and recovery support notifications you opted into.
- Process subscription purchases and refunds via RevenueCat.
- Investigate bugs, security issues, and abuse.
- Improve the app — in aggregate, anonymized form only.
4. Who we share data with
We share only the minimum data necessary with these service providers:
- AI providers (DeepSeek and/or OpenAI) — your message text plus a short personalized context, to generate Sam's replies and transcribe voice notes. Our provider agreements prohibit using your prompts to train their public models.
- RevenueCat — your user ID and subscription status, to manage subscriptions.
- Google Firebase — your push notification token, to deliver notifications; avatar images you upload, for storage.
- Resend — your email address, to deliver account verification, password reset, and security notification emails.
- Our cloud host (Railway / DigitalOcean) — runs our servers and encrypted database backups.
- Sentry — app crash diagnostics with personal information stripped, to find and fix bugs.
We do not share your data with advertisers, data brokers, or any party not on this list.
5. Your rights
- Access your data — every feature in the app already shows you yours.
- Export your data — email hello@iquitx.com and we'll send a JSON archive within 30 days.
- Delete your account — Settings → Delete my account. This wipes your account and every row associated with you across all our databases within 30 days. AI conversation history goes immediately.
- Withdraw consent for analytics or notifications any time in Settings.
EU/EEA, UK, California, and Brazil residents have additional rights under GDPR, UK-GDPR, CCPA, and LGPD respectively. To exercise them, email hello@iquitx.com; we respond within statutory windows.
6. Security
- All data in transit is encrypted with TLS 1.2 or higher.
- Passwords are hashed with bcrypt before storage.
- Database backups are encrypted at rest.
- Authentication uses short-lived JWTs (15 minutes) with rotating refresh tokens (30 days).
- We perform periodic security review and follow responsible-disclosure practice. Reports: hello@iquitx.com.
7. Children's privacy
iQuit is rated 17+ on the App Store and is intended for users 13 and older. We do not knowingly collect data from children under 13. If you believe a child has signed up, please email us and we will remove the account.
8. International transfers
iQuit's primary servers are in the United States (DigitalOcean). If you use the app outside the US, your data is transferred to and processed in the US under the same protections described above.
9. Crisis-content disclaimer
iQuit may detect language that suggests an immediate crisis and respond by surfacing hotline information. iQuit is not a substitute for emergency or medical care. If you are in danger, call your local emergency number or a crisis hotline immediately.
10. Changes to this policy
If we make material changes to this policy we will surface a notice in-app and via email before the change takes effect. The effective date at the top of this page tracks the most recent revision.
Contact
Questions, requests, or complaints: hello@iquitx.com
Support: support@iquitx.com