Privacy Policy

Last updated: 10 July 2026

This Privacy Policy explains how CutPuff ("CutPuff", "we", "us", or "our") collects, uses, shares, and protects your information when you use the CutPuff: Quit Vaping mobile application (the "App") and the website at cutpuff.com (the "Site"). The App and the Site together are the "Service".

CutPuff is operated by Ethan Khoce, an independent developer based in Singapore, who acts as the data controller for the personal data described in this policy. If you have any questions about this policy or how your data is handled, you can reach us through the contact form at https://cutpuff.com/contact.

By using the Service, you confirm that you have read and understood this policy. If you do not agree with it, please do not use the Service.

1. Who can use the Service

CutPuff is intended for adults aged 18 and over. The Service is not directed to children, and we do not knowingly collect personal data from anyone under 18. See Section 12 for more detail.

2. Information we collect

We collect the following categories of information.

Information you give us

• Account details: your email address, which you use to sign in through a passwordless one-time code. If you sign in with Apple, we receive the name and email (or an Apple private relay email) that you choose to share.
• Quit-journey information: details you enter about your vaping, such as your baseline puff count, nicotine strength, device or product type, cost per pod or device, your reduction goals and taper targets, and logs you create such as puffs, cravings, mood, triggers, and notes.
• Support information: anything you send us when you contact us through the form at cutpuff.com/contact or otherwise communicate with us.

Information we collect automatically

• Device and technical data: device model, operating system version, language, time zone, approximate region, and app version.
• Usage data: how you interact with the App, including screens viewed, features used, and session activity, collected through analytics.
• Diagnostic data: crash reports, error logs, and performance data that help us fix problems.
• Identifiers: IP address, mobile and app-instance identifiers, and similar identifiers assigned by our service providers.

Information we receive from third parties

• Subscription data: your subscription and trial status, plan, renewal or expiry dates, and entitlement information, provided by our subscription manager. We read your current subscription status live and do not store your payment card details.
• Purchase data: transaction confirmations and identifiers from the Apple App Store. We never receive your full payment card number.

A note on minimisation: several values you see in the App, such as your streak, money saved, and progress, are calculated on your device when needed and are not stored by us as separate records.

3. How we use your information

We use your information to:

• create and manage your account and authenticate you
• provide the core features of the App, including tracking, taper plans, and progress
• process and manage your subscription, free trial, and access to paid features
• provide customer support and respond to your requests
• understand how the Service is used so we can maintain, improve, and develop features
• detect, prevent, and address fraud, abuse, security issues, and technical problems
• comply with legal, tax, and accounting obligations.

4. Legal bases for processing (EU, EEA, and UK users)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR and UK GDPR:

• Performance of a contract: to create your account, provide the App, and manage your subscription.
• Consent: for optional analytics where required, for recording quit-journey information that may relate to your health, and for any marketing communications. You can withdraw consent at any time.
• Legitimate interests: to keep the Service secure, prevent fraud, and improve our features, balanced against your rights.
• Legal obligation: to meet tax, accounting, and other legal requirements.

Where we rely on consent, you can withdraw it at any time without affecting processing carried out before withdrawal.

5. How we share your information

We do not sell your personal data. We share information only as described below.

Service providers (sub-processors). We use trusted providers that process data on our behalf so we can run the Service:

• Google (Firebase): authentication, database (Firestore), analytics, crash reporting (Crashlytics), and cloud hosting. Provided by Google LLC and its affiliates.
• RevenueCat, Inc.: management of subscriptions, trials, and entitlements.
• Apple Inc.: App Store payment processing and Sign in with Apple.

Each provider is permitted to use your data only to deliver services to us under their own data protection terms.

Legal and safety. We may disclose information if required by law, regulation, legal process, or an enforceable governmental request, or where necessary to protect the rights, safety, or property of our users, the public, or us.

Business transfers. If the Service or its assets are transferred to another party (for example, in a sale), your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.

6. International data transfers

We are based in Singapore, and our service providers may store and process your data in the United States and other countries. These countries may have data protection laws that differ from those where you live. Where required, we rely on appropriate safeguards for international transfers, such as the European Commission's Standard Contractual Clauses and, where applicable, our providers' certifications under recognised transfer frameworks. You can contact us for more information about these safeguards.

7. How long we keep your information

We keep your personal data for as long as your account is active or as needed to provide the Service. When you delete your account or ask us to delete your data, we remove or anonymise your personal data within a reasonable period, unless we are required to keep it to meet legal, tax, or accounting obligations, or to resolve disputes and enforce our agreements. Analytics and diagnostic data are retained for limited periods in line with our providers' standard settings, for example up to 14 months for certain analytics data.

8. How we protect your information

We use technical and organisational measures to protect your data, including encryption in transit, database access rules, and restricted access to accounts and systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to address any incident appropriately.

9. Your privacy rights

Depending on where you live, you may have some or all of the following rights:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to correct inaccurate or incomplete data.
• Deletion: ask us to delete your personal data.
• Restriction and objection: ask us to limit or stop certain processing.
• Portability: receive your data in a portable format.
• Withdraw consent: withdraw any consent you have given.

To exercise any of these rights, contact us through https://cutpuff.com/contact. We may need to verify your identity before responding, and we will reply within the timeframes required by applicable law. You can also delete your account and associated data from within the App. If you are in the EEA or UK and believe we have not handled your data properly, you have the right to lodge a complaint with your local data protection authority.

10. United States state privacy rights

If you are a resident of California or another US state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut, or Utah), you have specific rights regarding your personal information.

Categories collected. In the past 12 months we have collected the categories described in Section 2, including identifiers, account information, commercial information (subscription and purchase records), internet and app activity, and information you choose to provide about your vaping and cravings.

Sensitive information. Information you log about your vaping and cravings may be treated as sensitive personal information. We use it only to provide the Service to you and do not use it to infer characteristics or for advertising.

No sale or sharing. We do not sell your personal information and do not share it for cross-context behavioural advertising, as those terms are defined under California law.

Your rights. Subject to applicable law, you may request to know, access, correct, or delete your personal information, and you have the right not to receive discriminatory treatment for exercising these rights. To make a request, use https://cutpuff.com/contact.

11. Health-related information

Some information you enter, such as your vaping habits and cravings, may reveal information related to your health. We process this information to provide the tracking and taper features you ask for. Where the law requires it, we rely on your consent, and you can delete this information or withdraw your consent at any time from within the App or by contacting us. CutPuff is a self-tracking and wellness tool and is not a medical device. See our Terms of Use for the full health disclaimer.

12. Children's privacy

The Service is intended for adults aged 18 and over and is not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided us with personal data, please contact us and we will take steps to delete it.

13. Cookies and similar technologies

The App relies on mobile software development kits and limited on-device storage rather than browser cookies. The Site at cutpuff.com may use essential cookies to function and, where you allow it, analytics cookies to understand traffic. You can control cookies through your browser settings. Where required, we ask for your consent before setting non-essential cookies.

14. Third-party links and services

The Service may link to third-party websites or services that we do not control, including the Apple App Store. This policy does not apply to those third parties, and we encourage you to review their privacy policies before providing them with your information.

15. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date above, and for significant changes we will provide a more prominent notice within the App or on the Site. Your continued use of the Service after an update means you accept the revised policy.

16. Contact us

If you have questions, requests, or complaints about this policy or your personal data, contact us through the form at https://cutpuff.com/contact.

CutPuff is operated by Ethan Khoce, based in Singapore.