Privacy Policy

1. Controller

2. Hosting and IONOS WebAnalytics

This website is hosted by IONOS SE. When the website is accessed, IONOS processes technically necessary connection and server log data. This may include the IP address of the device, date and time of access, the requested page or file, amount of data transferred, referrer URL, browser type and version, operating system and device type, access status and technical error messages.

This processing is necessary to deliver the website, ensure its technical functionality and security, and detect and defend against attacks and misuse. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the secure, stable and uninterrupted operation of the website. IONOS acts as a technical service provider or processor.

IONOS WebAnalytics is used as part of the hosting plan. According to IONOS, data is collected through server log files or a tracking pixel. WebAnalytics does not use cookies. The IP address transmitted when a page is requested is anonymised immediately after transmission and is then processed without reference to an individual.

Collected data may include the previously visited website, requested page or file, browser type and version, operating system, device type, time of access and the IP address in anonymised form. The data is used exclusively for statistical analysis and technical optimisation of the website. According to IONOS, no personal visitor profiles are stored and no data is disclosed to third parties.

To the extent that personal data is processed before anonymisation, the legal basis is Article 6(1)(f) GDPR. Identifiable log data is processed only for as long as necessary for security and technical operation or as required by law. This policy therefore does not promise a single fixed retention period for every IONOS product.

IONOS information about WebAnalytics
IONOS Privacy Policy

3. Language and appearance

When the English home page is opened, the browser's preferred language is read locally only so that an available language version can be suggested. The detected browser language is not stored.

Only when users actively select a language is that choice stored in the browser's local storage so it can be taken into account on later visits. The selected light or dark appearance is stored there as well. These settings are not used for advertising, evaluated to create user profiles, or automatically transmitted to the operator or third parties.

Local storage is used under section 25(2)(2) of the German TDDDG to the extent necessary to provide the language or appearance expressly selected by the user. Settings remain on the device until they are changed or deleted through the browser or website data controls.

4. Cookies and external content

This website currently uses no advertising, marketing or profiling cookies. It loads no external fonts, social-media plugins, embedded videos or other third-party content that would transmit data to additional providers merely by opening the website. Statistical analysis by IONOS WebAnalytics is described in section 2.

5. Contact by email

When users contact us by email, the data they provide is processed. This may include their email address, name, message content and any other information they submit voluntarily. Processing is carried out to handle and answer the request.

If the request concerns a contract or pre-contractual steps, the legal basis is Article 6(1)(b) GDPR. General enquiries are processed under Article 6(1)(f) GDPR; the legitimate interest is handling and answering incoming enquiries.

The provider of the email service may act as a technical recipient. Data is deleted once the request has been conclusively handled unless statutory retention duties or legitimate grounds require longer storage.

Support data is separate from smoking and usage data stored locally in SmokeGoal. SmokeGoal does not automatically attach local app data to a support request. Because ordinary email may not always be fully protected against access by third parties, users should avoid sending particularly sensitive health or other confidential information by email.

Providing personal data when contacting us is voluntary. However, without the information required to process the request, it may not be possible to respond.

Voluntary technical diagnostic report: The app can store up to 30 sanitised technical error events locally. A report is created only when the user explicitly requests it, is shown in full for review and is never sent automatically. The user decides whether to copy it or send it to info@smokegoal.com using their email app.

The report may contain the SmokeGoal version and build number, Android and SDK version, device manufacturer and model, app language and theme, timestamps, affected technical function, sanitised error text and the randomly generated pseudonymous support ID (RevenueCat App User ID). It does not contain smoking, savings, goals, challenges, checkpoints or backup content, Google Play order numbers or purchase tokens. The selected email provider processes the message when it is sent.

6. Purpose of SmokeGoal

SmokeGoal is an application for documenting and personally reducing cigarette consumption. Users can record and evaluate cigarette consumption, personal goals, check-in times, consumption values, costs, time information and challenges.

Important notice: SmokeGoal is intended for personal documentation, motivation and self-observation. The app does not provide medical advice, diagnosis or treatment and is not a substitute for professional medical support.

7. Data stored in the app

Depending on how the app is used, the following information may be stored on the device:

• cigarette entries and timestamps,
• previous and current cigarette consumption,
• personal daily and intermediate goals,
• check-in times, reminders and daily routines,
• cigarette and pack prices,
• challenges and calculated statistics such as savings, costs and time,
• app settings such as language, currency and display options.

In this Privacy Policy, the information listed above is collectively referred to as “personal entries”. Statistics, charts, goals, progress values, costs, savings, time values and other results calculated from them are referred to as “resulting analyses”.

Personal entries and resulting analyses may reveal aspects of a person’s smoking and health behaviour. SmokeGoal therefore treats them as particularly sensitive information requiring special protection.

8. Local processing and protection of sensitive information

For its core functions, SmokeGoal generally processes personal entries and resulting analyses locally on the device. No SmokeGoal account is required for the core functions. The operator cannot access this locally stored information and does not automatically transmit it to its own servers, advertising partners or ad networks.

If a future feature transmits information about smoking or health behaviour to the operator or another service, this policy will be updated before that feature is activated and, where required, explicit consent or another appropriate basis under Article 9(2) GDPR will be provided.

9. Device backup and device changes

SmokeGoal has technically disabled automatic Android cloud backups and the regular Android device-to-device transfer of internal app data. SmokeGoal does not operate its own cloud synchronisation.

Users can deliberately create a manual SmokeGoal backup as a JSON file. The file is stored only after an explicit action at the location shown in the app or selected by the user. If it is saved, transferred or shared through another service, further processing is governed by that service. Diagnostic events, the pseudonymous support ID, acknowledgement of the privacy notice, backup-reminder status and local trial or paid status are not included in the manual backup. Restoring a valid backup consumes the local trial.

10. Exporting and sharing content

SmokeGoal can create charts or files from locally stored app data on the device. If users save, export or share a file through the operating system's share function, they choose the recipient and app themselves. SmokeGoal does not send content automatically.

After content is deliberately transferred to an external service such as a messenger, email service or cloud storage provider, further processing is governed by that provider's privacy terms.

11. Notifications and reminders

If users enable reminders, SmokeGoal can schedule local notifications on the device. Notification permission may be required depending on the operating system. Smoking and time data used for local reminders is not transmitted to the operator for this purpose.

12. Advertising, tracking and sale of data

SmokeGoal does not use advertising networks or tracking or profiling services to market personal entries or resulting analyses as part of its core functions. This information is not disclosed to advertising partners or other third parties for advertising purposes and is not sold.

SmokeGoal does not use its own analytics, telemetry or crash-reporting SDK. Depending on device settings, Apple or Google may process crash and diagnostic data as part of their operating-system and store services and may make aggregated or technically necessary information available to the developer. This processing is governed by the privacy notice of the relevant platform provider.

Technical events recorded locally for the voluntary diagnostic report are not automatic telemetry and are never transmitted automatically. Optional RevenueCat SDK diagnostics and automatic collection of device identifiers for attribution are disabled. No advertising or analytics integrations and no contact details are configured as RevenueCat customer attributes. RevenueCat nevertheless processes the technical and transaction data required for purchase management as described in the following section.

13. Purchases, subscriptions and RevenueCat

Paid subscriptions are currently offered in the Android app through Google Play. SmokeGoal may also offer a one-time purchase for permanent premium access (“Lifetime”) in the future. If an iOS version is offered later, paid offers will be processed through the Apple App Store. SmokeGoal uses RevenueCat, Inc., United States, to manage offers, purchase entitlements, subscription status, permanent premium unlocks and receipt validation.

RevenueCat may process the randomly generated pseudonymous support ID (RevenueCat App User ID), store and platform, product identifier, purchase and subscription status, transaction, receipt and purchase-history information, purchase time and term, device and operating-system information, app version, language, country or region, currency, last activity and technical connection data such as the IP address. For Google Play purchases, the Google purchase token may also be processed.

SmokeGoal does not send RevenueCat smoking entries, savings, goals, challenges, checkpoints, prices, time values, backups or personal statistics. Names, email addresses and telephone numbers are not stored as customer attributes, and advertising identifiers are not collected automatically for attribution. Optional RevenueCat SDK diagnostics are disabled. The pseudonymous support ID is used for purchase management and support, not for advertising or cross-provider tracking.

Processing required to provide and manage a purchase is based on Article 6(1)(b) GDPR. Processing for secure receipt validation, prevention of misuse and technical error analysis is based on Article 6(1)(f) GDPR. The legitimate interest is secure and reliable purchase management. Where legally applicable, RevenueCat is engaged under a data processing agreement.

RevenueCat Privacy Policy
RevenueCat Data Processing Addendum

Apple or Google process account, payment, transaction and billing data under their store services on their own responsibility to the extent that they determine the purposes and means of that processing. The privacy notices of Apple or Google also apply. Complete payment details, in particular credit card or bank account information, are not provided to SmokeGoal or RevenueCat.

Data required for purchase and subscription management must be provided for technical or contractual reasons. Without this processing, paid offerings cannot be purchased, activated or restored. Local basic functions remain unaffected where they do not require a paid entitlement.

RevenueCat also provides us with analyses of purchases, subscriptions, renewals, cancellations and revenue. Purchase and subscription information is processed for this purpose; smoking entries and personal progress data are not used for these analyses.

Request data deletion

14. Retention and deletion

Locally stored app data remains on the device until the user deletes it in the app or through device functions. Automatic Android cloud backup and regular device transfer are disabled. Manually created JSON backup files remain under the user’s control at the selected storage location until the user deletes them.

Purchase data, support requests or other information actually accessible to the operator is stored only for as long as necessary for the relevant purpose or as required by statutory retention duties or the establishment, exercise or defence of legal claims.

Deletion of purchase and subscription data held by RevenueCat may be requested via info@smokegoal.com. The pseudonymous support ID (RevenueCat App User ID) displayed in the app may be required to identify the record. Data that Apple, Google or the controller must retain due to statutory record-keeping obligations remains unaffected.

How to request deletion of RevenueCat purchase and subscription data

In SmokeGoal, open Settings → Premium status and copy your pseudonymous support ID (RevenueCat App User ID). Email info@smokegoal.com with the subject “SmokeGoal data deletion” and include the ID if available. You may still contact us if you no longer have the app or cannot find the ID; we will clarify how to identify the relevant record. We will review your request and delete the associated RevenueCat customer record where applicable. Resetting or uninstalling the app removes local app data, but does not by itself delete data held by RevenueCat or Google Play. Delete any manually created JSON backups yourself at the location you chose. Deleting RevenueCat data does not cancel an active Google Play subscription; manage or cancel it separately in Google Play. Continued use or restoring a purchase may cause purchase and subscription information to be processed again. Information that must be retained for legal reasons may remain with the relevant controller.

15. Data security and minimisation

SmokeGoal is developed in accordance with the principle of data minimisation and with the aim of processing personal entries and resulting analyses locally wherever possible. Information is processed or transmitted only to the extent necessary for a function used by the user.

16. Recipients of personal data

Depending on the function used, personal data may be received by IONOS for website hosting and technical logs, the email service provider for support requests, Apple or Google for store, purchase and payment services, and RevenueCat for the technical management of purchases and subscriptions.

SmokeGoal does not transmit personal entries or resulting analyses to any of these recipients. This information is not disclosed to advertising partners or other third parties for advertising purposes and is not sold.

17. International data transfers

RevenueCat, Apple and Google may process data in the United States or other countries outside the European Economic Area. Transfers take place only subject to Articles 44 et seq. GDPR, in particular on the basis of an adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses. Further details are provided in the privacy and contractual documents of the respective providers.

Locally stored smoking and progress data is not transferred to a third country for these purposes.

For transfers not covered by an adequacy decision, RevenueCat’s Data Processing Addendum provides in particular for the European Commission’s Standard Contractual Clauses.

18. Regional information and additional rights

Users in the United States can find detailed information in the U.S. Consumer Health Data Privacy Notice. SmokeGoal does not sell personal entries or resulting analyses, use them for advertising, or disclose them to third parties. The controller cannot access information stored only locally.

For users in Japan, the purposes, categories, recipients, transfers, retention and contact details required by the APPI are described in this policy and in the Japanese privacy notice. Requests concerning personal data actually held by the controller may be submitted by email.

Depending on the place of residence, additional rights may arise under the laws of the United Kingdom, Switzerland, Canada, Australia, New Zealand, Brazil, Mexico, Türkiye or the United Arab Emirates. These may include information, access, correction, deletion, portability, objection, withdrawal of consent and complaint rights. SmokeGoal will apply the locally mandatory right and response period. Local-only data must be managed on the device because the controller cannot access it.

19. Legal bases

The specific legal bases are identified with each processing activity. Depending on the activity, these may include Article 6(1)(b) GDPR for contractual or pre-contractual matters, Article 6(1)(c) GDPR for legal duties, Article 6(1)(f) GDPR for secure website operation and general enquiries, and—where required—Article 6(1)(a) GDPR for consent. If health data were made accessible to the operator in the future, an additional exception under Article 9(2) GDPR would be required.

Personal entries and resulting analyses processed exclusively on the device are currently not accessible to the operator.

20. Data subject rights

Where the operator processes personal data, data subjects have, subject to the statutory conditions, rights of access under Article 15 GDPR, rectification under Article 16, erasure under Article 17, restriction under Article 18, data portability under Article 20 and objection under Article 21. Consent may be withdrawn at any time with effect for the future.

To exercise these rights, email info@smokegoal.com.

The operator cannot access or centrally delete app data stored exclusively on the device. Users can delete this data directly in the app or through device functions.

21. Right to object

Where personal data is processed under Article 6(1)(f) GDPR, data subjects may object at any time on grounds relating to their particular situation. The operator will then cease processing unless compelling legitimate grounds override the interests, rights and freedoms of the data subject or processing is necessary for the establishment, exercise or defence of legal claims.

22. Right to lodge a complaint

Under Article 77 GDPR, data subjects may lodge a complaint with a data protection supervisory authority. The authority generally responsible for the operator is:

www.lda.bayern.de

A complaint may also be submitted to another supervisory authority competent under the GDPR.

23. Automated decision-making and profiling

No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place in connection with this website or the described core functions of the SmokeGoal app.

24. Changes to this Privacy Policy

This Privacy Policy will be updated when the website, app, services used or legal requirements change. The current version will be published on this website and made available in the app or through the privacy link provided there.