Privacy Policy
NicoQuit (store name "NicoQuit: Quit Snus & Vape"), for Android and iOS, published by Kirolabs.
Package / bundle identifier: io.kirolabs.nicoquit
Last updated: 30 September 2026
*Deutsche Fassung: siehe „Datenschutzerklärung“ weiter unten auf dieser Seite.*
---
1. The short version
- There is no account. No sign-up, no login, no password, no email address. NicoQuit has no server of its own.
- Your quitting data stays on your device. Every use you log, every craving, check-in, journal entry, your reasons for quitting and your plan are stored in a database inside the app on your phone. Kirolabs never receives them and cannot recover them.
- Usage analytics are off unless you say yes. During onboarding the app asks whether it may send anonymous usage events. Until you agree, nothing is sent. You can change your mind at any time in Settings → Privacy & data.
- A few services do receive technical data: Firebase Crashlytics (crash reports, can be switched off), Firebase Remote Config (app configuration), and RevenueCat with Apple or Google if you buy NicoQuit Pro. No advertising, no advertising ID, no sale of data.
- You can delete everything yourself in Settings → Privacy & data → Delete all data.
NicoQuit is not a medical device. See section 9.
---
2. What stays on the device
NicoQuit helps you cut down or stop using nicotine pouches, snus, vapes and cigarettes. All of it is calculated on your device. The app stores the following in a local SQLite database in its own private storage on your phone:
- your profile and plan: the products you use (type, strength such as mg per pouch or mg/ml, pack size and price), your goal, plan mode, quit date, daily allowance and taper steps;
- your logs: each use with its time, product and amount, including entries you edited or backdated;
- your cravings: time, intensity, duration, triggers (for example stress, coffee, alcohol, after meals, work or study, social situations, boredom, driving) and whether you gave in;
- your daily check-ins, mood, journal entries, notes and reasons for quitting;
- your progress: streaks, savings, achievements, milestones reached and program progress;
- your settings, including reminder times and your privacy choices.
None of this is uploaded, synced or shared between devices, and Kirolabs cannot read it. There is no NicoQuit account to restore it from: if you delete the app or lose your phone, it is gone. We cannot restore it for you, because we never had it.
Operating system backups. Depending on your device settings, Android Backup or an iCloud device backup may include the app's data as part of a whole-device backup. Google and Apple create, encrypt, store and delete those backups under their own privacy policies, not this one, and Kirolabs cannot access them. You can turn off backup for NicoQuit in your device settings.
Exported files. If you use CSV export (NicoQuit Pro), the app creates a file with your logs and totals. It only leaves the app when you share or save it through the system share sheet. After that, whoever holds the file (your email provider, cloud drive or the person you sent it to) is responsible for it. Kirolabs is not part of that transfer.
Notifications. Reminders are local notifications scheduled by the app on your device. NicoQuit does not use push notifications, and no notification content is sent through any server.
---
3. What leaves the device, and who receives it
The app sends data only to the services below. For each one: what it is, what it sends, what it never sends, and how to switch it off. Nothing else is sent anywhere.
3.1 Firebase Analytics (Google) — only with your consent
What it is for: seeing, in aggregate, where people get stuck, for example whether onboarding is completed, whether the SOS tools are opened and whether the paywall works, so we know what to fix.
Off until you agree. Onboarding asks whether you want to share anonymous usage statistics. If you do not agree, analytics collection stays disabled and no analytics events are sent. You can switch it on or off at any time in Settings → Privacy & data → Usage analytics.
What it sends when switched on: anonymous event names with a few coarse parameters, such as onboarding_completed, product_type_selected (for example "pouch" or "vape"), log_created with a count, sos_opened, paywall_viewed and purchase_completed. Firebase also collects standard technical data: app version, operating system version, device model, language, a country or region derived from the IP address, session and engagement timings, and a resettable Firebase app instance ID generated for this installation. Firebase may record in-app purchases automatically, with product, price and currency, as reported by the store.
What it never sends: your journal text, reasons for quitting, notes or any other text you typed; the exact amount and time of individual uses; your craving details; your quit date; your name or email address (the app never asks for them). Kirolabs does not use analytics data for advertising and does not sell it.
3.2 Firebase Crashlytics (Google)
What it is for: finding out when and where the app crashes so we can fix it.
What it sends: the stack trace (where in the code the crash happened), app version, operating system version, device model, free memory and disk space, the orientation and similar technical state at the time of the crash, and a Crashlytics installation identifier used to group repeated crashes.
What it never sends: your logs, cravings, journal, reasons, notes, plan or anything else you entered.
How to switch it off: Settings → Privacy & data → Crash reports. It is on by default because crashes in a quitting app tend to happen at the worst possible moment and we want to fix them quickly.
3.3 Firebase Remote Config (Google)
What it is for: changing app configuration without a new release, for example which features are part of NicoQuit Pro (never the ones listed as free forever in our Terms of Use), default plan values, emergency switches, and a minimum version that must be installed if a build is found to put your data at risk.
What it sends: a standard request with the Firebase app instance / installation ID, app ID, app version, platform, language and country. It only downloads configuration and keeps the last copy so the app works offline.
What it never sends: anything you have logged or written. Remote Config cannot be switched off, because it is how we stop a build that we have found to be unsafe for your data.
3.4 Purchases: RevenueCat, Apple App Store and Google Play
If you buy NicoQuit Pro, Apple or Google processes the payment. RevenueCat (RevenueCat, Inc.) validates the purchase and tells the app whether Pro is active.
RevenueCat receives: an anonymous app user ID it generates for this installation, the store receipt or purchase token, product ID, purchase and expiry dates, platform, store country and currency, app and operating system version and your IP address. The app contacts RevenueCat to check Pro status even if you have never bought anything, because that is how it finds out. No account is created and the ID is not linked to your name or email.
Kirolabs never sees your card number, name or billing address. Apple and Google keep those under their own privacy policies. RevenueCat never receives your logs, cravings, journal or anything else you enter. See RevenueCat's privacy policy (https://www.revenuecat.com/privacy).
3.5 Ratings
After a while the app may show Apple's or Google's own rating prompt. Your rating and any review go to the store under the store's policy.
3.6 Support email
Our support address is labskiro@gmail.com. If you write to us, we receive your email address and whatever you choose to send, and keep it as long as we need to help you and keep a short record of the issue. We do not use your address for marketing or add it to any list.
3.7 What the app does not do
- No advertising and no advertising SDK.
- No advertising identifier: the Android advertising ID permission is removed from the app, and on iOS the app does not use the IDFA and never shows a tracking prompt.
- No tracking across other companies' apps or websites.
- No push notifications, no location, no contacts, no camera, no microphone, no photo library.
- No sale or rental of personal data, ever.
- The app does not sell, promote or link to any nicotine product.
---
4. Children
NicoQuit is not directed at children under 13, or under 16 in the European Economic Area, and we do not knowingly collect data from them. The app has no account or profile, so it cannot identify any user of any age. If you are a young person and struggling with nicotine, please talk to a parent, a doctor or a school counsellor as well. If you think a child has emailed us, contact us and we will delete the message.
---
5. Your rights and the legal basis
If you are in the European Economic Area, the United Kingdom or Switzerland, data protection law (GDPR) gives you the rights below. Most of them you can exercise yourself, immediately, in the app.
Controller. Kirolabs (contact in section 10) is the controller for the analytics, crash and configuration data in sections 3.1 to 3.3, for purchase status handled through RevenueCat in section 3.4, and for support emails. Google (Firebase) and RevenueCat process that data for us as processors. Apple and Google as app stores handle payments under their own responsibility.
Legal basis.
- Usage analytics: your consent (Art. 6(1)(a) GDPR, and § 25(1) TDDDG for access to your device). Because the fact that you use a quitting app, and the types of product you track, could be regarded as information about your health, we treat this consent as your explicit consent under Art. 9(2)(a) GDPR as well. You can withdraw it at any time in Settings → Privacy & data. Withdrawal does not affect processing that happened before.
- Crash reports: our legitimate interest in a stable, working app (Art. 6(1)(f) GDPR). You can object at any time by switching crash reports off in Settings.
- Remote Config: necessary to provide the app as intended and keep it safe to use (Art. 6(1)(b) and (f) GDPR).
- Purchases and Pro status: necessary to provide what you bought (Art. 6(1)(b) GDPR).
- Support emails: our legitimate interest in answering you (Art. 6(1)(f) GDPR).
Access and portability. Everything the app holds about you is visible in the app itself. NicoQuit Pro can export your logs as a CSV file. We cannot give you a copy of your quitting data ourselves, because we do not hold one.
Erasure. Settings → Privacy & data → Delete all data permanently erases every log, craving, check-in, journal entry, reason, plan and setting from the device. You can also delete single entries, or uninstall the app. The analytics and crash data we receive is not linked to your name, email or any account, so we usually cannot tell which records are yours (Art. 11 GDPR); it is deleted automatically when its retention period ends (section 6). If you contact us, we will do what we can.
Rectification. You can edit or delete any entry in the app at any time.
Objection and withdrawal. Use the toggles in Settings → Privacy & data.
Complaint. You can complain to a data protection supervisory authority, in particular in the country where you live.
Transfers outside the EU. Google and RevenueCat may process data in the United States. Transfers rely on the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's standard contractual clauses.
---
6. Retention
- Data on your device is kept until you delete it (single entries or "Delete all data") or uninstall the app.
- Firebase Analytics event data is kept for the retention period set in our Google Analytics property and then deleted automatically. The default is 2 months; the maximum is 14 months. Aggregated reports may be kept longer.
- Crashlytics crash reports are kept for 90 days.
- Remote Config request data is handled by Google for delivering the configuration and is not stored by us.
- Purchase records at RevenueCat and Apple or Google are kept as long as needed to provide Pro and to meet accounting and tax obligations.
- Support emails are kept as long as needed to resolve your issue. We delete them on request.
---
7. Security
Your data sits in the app's private storage, which the operating system keeps separate from other apps and encrypts when your device is locked with a passcode. Firebase and RevenueCat are contacted over encrypted HTTPS connections.
The strongest protection is how NicoQuit is built: no Kirolabs server holds a copy of your logs, cravings or journal, so there is nothing of yours on our side to breach. Please protect your device with a passcode, because anyone who can unlock your phone can open the app.
No method of storage is perfectly secure, and we do not claim otherwise.
---
8. Changes to this policy
If we change this policy, we will update the date at the top, and tell you in the app before a significant change takes effect.
One commitment will not change: Kirolabs will not start sending your logs, cravings, check-ins, journal entries or reasons for quitting to Kirolabs or anyone else without your explicit action. If we ever offer something like cloud sync or an account, it will be optional, off unless you turn it on, explained before you do, and this policy will be updated first.
---
9. Not medical advice
NicoQuit is a self-help tool. It is not a medical device and not a substitute for advice, diagnosis or treatment from a doctor, pharmacist or quit-support service. Nicotine amounts shown in the app are estimates based on product labels, not measurements of how much nicotine your body absorbs. Health milestones are general information, not a statement about your own health. In an emergency, call your local emergency number.
---
10. Contact
Questions about this policy, your data or the app:
labskiro@gmail.com
https://kirolabs.io/contact
Terms of Use: https://sites.google.com/view/nicoquit-terms