Privacy Policy

PuffPause is operated by Lucalvry LLC, a limited liability company organized under the laws of Wyoming, USA, with its registered office at 30 N Gould St, STE R, Sheridan, WY 82801. Lucalvry LLC is the data controller for personal information processed through the Services, unless a specific feature identifies another controller.

We collect the following categories of personal information:

• Account information, name or display name, email address, password (hashed), and authentication identifiers.
• Quit-progress data, cravings you log, breathing sessions completed, streaks, goals, and other content you create in the app.
• Device and usage data, device model, operating system, app version, language, time zone, IP address, crash reports, and interactions with in-app features.
• Subscription and purchase metadata, subscription status and transaction identifiers received from Apple App Store, Google Play, RevenueCat, or Stripe. We do not receive or store your full payment card details.
• Communications, messages you send us (support requests, contact form submissions, survey responses).
• Push and notification tokens, where you opt in to notifications.

We do not knowingly collect precise geolocation, biometric identifiers, or information about your health from wearables unless you explicitly connect such a source.

• To provide, personalize, and improve the Services and your quit plan.
• To authenticate you and secure your account.
• To operate subscriptions, trials, and billing through our app-store partners.
• To send transactional messages (receipts, security notices) and, where permitted, product updates.
• To analyze usage, diagnose crashes, and prevent fraud or abuse.
• To comply with law and enforce our Terms of Service.

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under Article 6 GDPR:

• Contract, to deliver the Services you signed up for.
• Legitimate interests, to secure the Services, improve them, and communicate with users, balanced against your rights.
• Consent, for optional analytics, marketing, or push notifications; you may withdraw consent at any time.
• Legal obligation, to comply with tax, accounting, and other laws.

We do not sell your personal information. We share it only with service providers acting as our processors, and only to the extent needed for the Services:

• Supabase, database, authentication, and storage.
• Apple, Google, RevenueCat, Stripe, subscription and payment processing.
• Push and email providers, to deliver notifications you have opted into.
• Analytics and crash reporting providers, to keep the app stable and improve it.
• Professional advisors and authorities, when legally required, or to protect rights, safety, or property.

We are based in the United States and our processors may be located in other countries. When we transfer personal information from the EEA, UK, or Switzerland to a country without an adequacy decision, we rely on Standard Contractual Clauses and additional safeguards where required.

We keep personal information for as long as your account is active and for a limited period afterwards to comply with legal obligations, resolve disputes, and enforce our agreements. Backups are rotated on a rolling schedule. You may request deletion at any time (see Your Rights).

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Request correction or deletion.
• Object to or restrict certain processing.
• Request portability of your data.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data protection authority.

To exercise any right, email privacy@puffpause.xyz. We will respond within the timeframes required by applicable law and may need to verify your identity.

In the past 12 months we have collected the categories of personal information described in Section 2 for the purposes described in Section 3. We have not sold or shared personal information for cross-context behavioral advertising, and we do not knowingly do so for anyone under 16. California residents may request access, deletion, correction, and portability, and may designate an authorized agent to submit requests. You will not be discriminated against for exercising these rights.

To exercise these rights, email privacy@puffpause.xyz with the subject line "California privacy request".

The Services are not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and least-privilege service accounts. No method of transmission or storage is perfectly secure; we cannot guarantee absolute security.

PuffPause is a wellness product, not a medical device. It is not intended to diagnose, treat, cure, or prevent any disease. Always consult a qualified healthcare provider about nicotine dependence and cessation.

We may update this Privacy Policy from time to time. When we make material changes we will notify you through the Services or by email and update the effective date above.

For privacy questions or to exercise your rights, contact: