BreakLoop Privacy Policy

Effective date: August 29, 2026
Last updated: August 29, 2026

BreakLoop is designed so that your smoking and wellness information is used to provide the product to you — not to advertise to you.

We do not sell personal data. We do not rent personal data. We do not provide your smoking or wellness information to advertisers. We do not use your smoking or wellness information for targeted advertising. We do not use it to train AI or machine-learning models.

This Privacy Policy explains how BreakLoop handles information when you use the BreakLoop mobile application, website, accounts, beta program, Early Access purchase flows, and related services (collectively, the “Service”).

1. Who is responsible for your data

The data controller is the person or legal entity operating and publishing BreakLoop, identified in the Legal Notice (Impressum) on the BreakLoop website (the “Publisher”, “we”, “us”, or “our”).

Privacy contact: support@getbreakloop.app

The Publisher is established in Germany.

2. BreakLoop's privacy model

BreakLoop supports two broad ways of using the app:

Anonymous mode

If you use BreakLoop without creating an account, the smoking, onboarding, reduction-plan, progress, craving, reflection, pledge, exercise, and similar personal app data you enter is intended to remain stored locally on your device.

We do not upload that body of personal wellness data to the BreakLoop cloud merely because you use the app anonymously.

Anonymous mode may still use limited remote technical or billing services that are necessary to operate the Service, such as entitlement verification, offline premium leases, security, app configuration, purchase restoration, or diagnostics. For this reason, “anonymous” means no BreakLoop account is required; it does not necessarily mean that no technical identifier or personal data exists anywhere in the supporting infrastructure.

In particular, a pseudonymous billing identity may be retained so that eligible App Store subscriptions can be recognized or reused across anonymous BreakLoop identities where supported.

Signed-in mode

If you sign into BreakLoop, your app data is backed up and synchronized through BreakLoop's backend so that the Service can restore and provide your data across supported sessions and devices.

This may include all information you use within BreakLoop, including onboarding answers, smoking history, cigarette logs, cravings, triggers, emotions, reflections, pledges, reduction plans, plan progress, exercises, milestones, achievements, settings, preferences, and other present or future BreakLoop feature data.

3. Categories of information we process

Depending on how you use BreakLoop, we may process the following categories.

Account and identity information

This may include:

• email address;
• authentication-provider identifiers;
• BreakLoop account identifiers;
• sign-in method and account state;
• information required for account reconciliation, migrations, security, or account binding.

BreakLoop currently supports authentication methods such as Sign in with Apple, Google sign-in, and email-based authentication through Clerk.

Smoking, wellness, and health-related information

This may include information such as:

• smoking history and typical cigarette consumption;
• quit or reduction goals;
• planned and actual cigarette limits;
• smoking events and progress;
• cravings, triggers, emotions, and reflections;
• pledges and delay activity;
• exercise usage and completion;
• reduction-plan information;
• milestones and achievements; and
• other information you choose to provide through smoking-cessation or wellness features.

Because this information may reveal information about your health, habits, dependence, or wellbeing, we treat it conservatively as health-related data and, where the GDPR applies, as potentially falling within the special categories of personal data that receive additional protection.

Billing and entitlement information

We may process or receive limited records needed to provide paid access, such as:

• a RevenueCat or BreakLoop billing identifier;
• product and entitlement identifiers;
• subscription or Lifetime Access status;
• purchase source;
• transaction or purchase identifiers;
• purchase, renewal, expiration, cancellation, refund, or revocation status;
• price, currency, or country information where made available by the billing provider; and
• technical records used to validate or restore access.

For direct web purchases using RevenueCat Billing, Stripe processes payment-card information. BreakLoop does not receive or store your complete payment-card number.

For App Store purchases, Apple processes the payment transaction under Apple's own terms and privacy practices.

Beta and Early Access information

If you claim beta access or purchase Early Access, we may process information needed to determine eligibility and capacity and to grant, maintain, reconcile, or revoke access, such as your account identifier, entitlement state, beta-claim status, grant timestamps, and related technical records.

Website and analytics information

Our website and app may process limited technical and usage information such as:

• app version and operating-system information;
• device or browser type;
• general usage events and feature interactions;
• error, crash, and diagnostic information;
• page views, referrers, and approximate geographic information supplied by analytics or hosting providers;
• IP address where necessarily present in network, hosting, security, or provider logs; and
• other technical information needed to secure and operate the Service.

We do not intentionally send the contents of smoking logs, cravings, reflections, pledges, or other health-related free-form entries to analytics or advertising systems.

Support and communications

If you contact us, we may process your email address, message, attachments, diagnostic information you provide, and our correspondence with you.

Public feedback

BreakLoop may contain a feedback area for bug reports, feature requests, comments, or product feedback. Information you intentionally submit to a public or shared feedback area is an exception to the private-by-default treatment of your app data: that feedback may be visible to other BreakLoop users and may later be displayed on the BreakLoop website.

Do not include private medical, smoking, or other sensitive personal information in public feedback.

4. How we use information

We use personal data only for purposes connected to operating and improving BreakLoop, including to:

• provide the app and website;
• create and authenticate accounts;
• generate, store, synchronize, and restore your BreakLoop data;
• provide personalized smoking-reduction and wellness functionality based on information you choose to enter;
• verify Premium, subscription, beta, and Lifetime Access entitlements;
• issue and validate offline premium leases;
• process and reconcile web purchases and App Store entitlements;
• provide customer support;
• secure the Service and prevent fraud, abuse, unauthorized access, and attacks;
• diagnose errors and improve reliability and product usability;
• measure aggregated website or product usage;
• manage the beta program and capacity;
• comply with legal, tax, accounting, and regulatory obligations; and
• establish, exercise, or defend legal claims.

We may also send service-related emails, such as authentication, security, billing, purchase, beta, account, or important product notices.

Where you have opted in, or where applicable law otherwise permits it, we may send product education, feature reminders, or similar emails. We may use general account or feature-usage signals to make those messages relevant. We do not use detailed smoking, craving, reflection, or other health-related content for advertising or targeted marketing.

You can unsubscribe from optional marketing or product-reminder emails using the unsubscribe mechanism provided in the message or by contacting us. Necessary service and security communications may still be sent while your account remains active.

5. Legal bases under the GDPR

Where the GDPR applies, our legal bases depend on the purpose and type of information.

Contract and steps requested by you

We process information where necessary to provide the Service you request, administer your account, provide Premium access, process entitlements, support you, and perform our contractual obligations. This processing is generally based on Article 6(1)(b) GDPR.

Explicit consent for health-related data

Because smoking and cessation information may constitute health data, we rely on your explicit consent under Article 9(2)(a) GDPR where that provision applies, together with an applicable Article 6 basis.

Your consent must be obtained through a clear affirmative action. This Privacy Policy alone is not the consent mechanism.

If you use BreakLoop anonymously, you can withdraw that consent by deleting the relevant local BreakLoop data or ceasing use of the affected functionality. If you use a signed-in account, you can withdraw consent by deleting your BreakLoop data/account through the available account controls or by contacting us.

Withdrawal does not make earlier lawful processing unlawful. Because processing smoking and wellness information is central to BreakLoop's personalized functionality, withdrawing consent or deleting the relevant data may make some or all personalized features impossible to continue providing.

Consent for optional communications or analytics

Where consent is legally required for optional analytics, device access, or promotional email communications, we rely on your consent under Article 6(1)(a) GDPR and applicable communications/privacy law.

Legitimate interests

Where appropriate and permitted by law, we may rely on legitimate interests under Article 6(1)(f) GDPR for limited purposes such as service security, fraud prevention, abuse detection, reliability, protecting legal rights, and privacy-preserving measurement, provided those interests are not overridden by your rights and interests.

We do not rely on ordinary legitimate interests as a substitute for an Article 9 condition where processing involves special-category health data.

Legal obligations and legal claims

We may process limited information where necessary to comply with legal obligations under Article 6(1)(c) GDPR or to establish, exercise, or defend legal claims as permitted by applicable law.

6. Account deletion and consent withdrawal

You may delete signed-in BreakLoop data through the Account controls accessible from the app's welcome screen after authentication, where available.

Account deletion is designed to remove attributable health and wellness data as soon as reasonably possible, usually within seconds once the deletion request is successfully processed.

We may retain a narrow tombstone or deletion marker where needed to prevent deleted data from being recreated or to maintain system integrity. Such a record is not intended to contain your smoking or health information and, where technically implemented as intended, cannot be used by us to reconstruct the deleted wellness data.

Certain transaction, billing, fraud-prevention, security, tax, accounting, or legal records may need to be retained separately for longer periods.

Deleting a BreakLoop account does not cancel an App Store subscription. It may also permanently sever account-bound entitlements, including Lifetime Access, as explained in the Terms of Use. You should review the deletion warning carefully before proceeding.

7. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, subject to legal obligations and the nature of the data.

In general:

• Signed-in BreakLoop app data: retained while needed to provide cloud backup and Premium functionality and may be automatically deleted after approximately 12 months without Premium access, unless you delete it earlier or law requires a different period.
• Deleted account health/wellness data: removed as soon as reasonably possible after a valid deletion request, usually within seconds in normal operation.
• Lifetime Access and entitlement records: retained for as long as necessary to provide and prove the entitlement, unless the entitlement is refunded, lawfully terminated, or permanently severed by account deletion; limited transaction records may remain where legally required.
• Purchase, tax, and accounting records: retained for the statutory retention period or as otherwise necessary to establish or defend legal claims.
• Early Access purchase records: retained while needed to deliver and prove the purchased entitlement and thereafter only as required for legal, accounting, fraud-prevention, or claims purposes.
• Support emails: retained for as long as reasonably necessary to resolve the request, maintain support history where useful, or protect legal rights, then deleted or anonymized according to operational retention practices.
• Optional email-delivery records: retained according to our configured retention and the operational requirements of our email provider.
• Analytics and diagnostic information: retained according to our configured product settings and provider retention cycles and deleted or aggregated when no longer needed.
• Public feedback: may remain visible until deleted, moderated, or no longer needed for the feedback service, subject to legal and product requirements.

If backup systems are introduced in the future, deleted information may remain in secured disaster-recovery backups for a limited period before rotation, but would not be restored for ordinary use except where necessary for disaster recovery and consistent with applicable law.

8. Service providers and other recipients

We use carefully selected third-party providers to operate BreakLoop. Depending on how you use the Service, these may include:

• Clerk — authentication, account management, and identity services;
• Convex — backend infrastructure and cloud storage for signed-in BreakLoop data;
• RevenueCat — subscription, purchase, entitlement, beta-grant, and billing-state management;
• Stripe — payment processing for eligible direct web purchases made through RevenueCat Billing;
• Apple — App Store distribution and purchases, Sign in with Apple, TestFlight, and related Apple platform services;
• Google — Google sign-in where you choose that authentication method;
• Vercel — website hosting and privacy-focused web analytics;
• PostHog — product analytics, diagnostics, and error/crash analysis as configured; and
• Resend — delivery of account, service, support, and permitted product emails.

These providers may process personal data on our behalf as processors/service providers, or in some circumstances for their own purposes as independent controllers, depending on the service and transaction.

We do not authorize service providers to use your BreakLoop health or wellness data for their own advertising purposes.

We may also disclose information where required by law, valid legal process, or a binding request from a competent authority, or where reasonably necessary to protect the rights, safety, security, or integrity of BreakLoop, users, or others, subject to applicable law.

We do not sell personal data to data brokers or advertisers.

9. Payment information

BreakLoop does not intentionally store complete payment-card details.

Direct website purchases using RevenueCat Billing are processed using Stripe as the payment processor. RevenueCat manages the billing flow and entitlement lifecycle while Stripe processes payment information.

App Store purchases are processed by Apple.

Payment providers may collect billing, fraud-prevention, tax, location, device, and payment information under their own terms and privacy policies. BreakLoop generally receives only the transaction and entitlement information needed to provide and support the purchase.

10. Analytics and cookies

BreakLoop website

We do not use advertising cookies.

Vercel Web Analytics is designed to provide aggregated website analytics without third-party cookies and without persistent cross-site visitor identifiers.

If PostHog or another analytics system is used on the website in a configuration that stores or accesses non-essential information on your device or otherwise requires consent under applicable law, we will obtain the required consent before enabling that processing for you.

BreakLoop app

Product analytics and diagnostics may be used to understand feature usage, detect errors, and improve reliability. These systems must not be intentionally populated with the contents of smoking logs, cravings, reflections, pledges, or similar sensitive health-related entries.

BreakLoop does not include advertising SDKs for targeted advertising.

11. Local notifications

BreakLoop notifications are scheduled and handled locally on your device. BreakLoop does not require a remote push-notification service to deliver those locally scheduled reminders.

Your device operating system controls notification permissions and display behavior.

12. International data transfers

Some of our service providers operate internationally or may process information outside Germany, the European Economic Area, the United Kingdom, or your country of residence.

Where applicable data-protection law restricts international transfers, we use or rely on an appropriate transfer mechanism made available for the relevant processing, such as an adequacy decision, approved standard contractual clauses, or another legally recognized safeguard.

You may contact us at support@getbreakloop.app for more information about safeguards relevant to your data.

13. Data security

We use technical and organizational measures intended to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction. These measures may include access controls, authentication, encryption in transit, provider security controls, restricted backend access, and minimization of stored data.

No system is completely secure, and we cannot guarantee absolute security.

14. Your privacy rights

Depending on where you live, you may have rights regarding your personal data, including rights to:

• obtain information about processing;
• access your personal data;
• correct inaccurate data;
• delete data;
• restrict certain processing;
• receive portable data in an applicable format;
• object to certain processing based on legitimate interests;
• withdraw consent at any time for future processing based on consent; and
• lodge a complaint with a competent data-protection authority.

Where GDPR rights apply, we will respond within the legally required period and may need to verify your identity before acting on a request.

BreakLoop is intended to support user-accessible data export. Where export functionality is available in the app, you may use it directly; otherwise, you may contact us.

15. Anonymous users

If you use BreakLoop without an account, we generally cannot identify locally stored smoking or wellness information on your device or retrieve it for you. You control that local information through the app and your device, including by deleting or resetting local app data.

However, technical and billing records associated with an anonymous billing identity may still exist separately where necessary to maintain or restore eligible purchases.

16. Public sharing by you

If you use BreakLoop's sharing functionality to share an achievement, badge, milestone, or other information outside the app, you choose what information leaves BreakLoop and which external app or recipient receives it.

Once shared, the recipient or third-party platform controls what happens to that copy under its own privacy practices. BreakLoop is not responsible for further use of information you intentionally share outside the Service.

17. Children

BreakLoop is not intended for anyone under 18 years old, or under a higher minimum age where required by applicable law.

If we learn that we have collected account data from a person who is not eligible to use the Service, we may delete or restrict the account as required by law.

18. No sale, advertising use, or AI training of health data

For clarity:

• we do not sell your personal data;
• we do not rent your personal data;
• we do not provide your smoking or wellness data to advertisers;
• we do not use your smoking or wellness data for targeted advertising;
• we do not use your smoking or wellness data to build advertising profiles; and
• we do not use your personal BreakLoop data to train artificial-intelligence or machine-learning models.

Service providers may process data only as necessary to provide their services to BreakLoop or for other purposes independently disclosed by them where they act as their own controller.

19. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in BreakLoop, our providers, legal requirements, or our data practices.

If a change materially affects how we use sensitive or health-related information, we will provide additional notice or obtain new consent where required by law.

The “Last updated” date identifies the current version.

20. Contact and complaints

For privacy questions, rights requests, or concerns, contact:

Email: support@getbreakloop.app

The Publisher's legally required identity and address information is available in the Legal Notice (Impressum) on the BreakLoop website.

If the GDPR applies to you, you also have the right to lodge a complaint with the competent German data-protection supervisory authority or, where applicable, the supervisory authority in the EU/EEA country of your habitual residence, place of work, or alleged infringement.