Privacy Policy

Version 2 · Effective 9 October 2026

1. Controller

The controller under the EU General Data Protection Regulation ("GDPR") and Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") is:

Kariha Web Agency (sole proprietorship)
Tax office and number: Fethiye, 71851050704
Address: Taşyaka Mah. 218/21 Sk. No:40, 48303 Fethiye / Muğla, Türkiye
Email: privacy@kariha.net

This policy covers the Quitmo Android app (the "App") and the pages at quitmo.kariha.net.

2. What we process, why, and on what legal basis

2.1 Data that stays on your phone

What you enter in the App is stored on your phone: your name or nickname, gender, fears and motivations, quit date, cigarettes per day, pack size and price, currency, years smoked; slip and craving entries (intensity, feelings, triggers, place and your own notes), mood entries, crisis sessions, affirmations, personal goals, past attempts, rewards earned and settings.

Unless you turn on the cloud backup, this data never reaches us and we cannot see it. Counters, rewards, notifications and statistics are calculated on your phone. If your phone's own backup (Android device backup to your Google account) is on, this data may be included in that device backup, which you manage in your phone's settings.

2.2 Cloud backup (optional, explicit consent)

If you sign in with Google and give explicit consent, the journey data above is backed up so it can be restored on a new phone. We also process your Google account's email address, name and Firebase user ID, and a record of the consents you gave (version and date).

• Purpose: backing up your data and restoring it on a new phone.
• Legal basis: smoking, slips and mood may be health-related, special category data, so we rely on your explicit consent (GDPR Art. 9(2)(a), KVKK Art. 6(2)). For your account details, performance of the service (GDPR Art. 6(1)(b), KVKK Art. 5(2)(c)).
• Where: Google Firebase Authentication and Cloud Firestore. The backup database is in Frankfurt (EU, europe-west3).
• Withdrawal: withdraw at any time via Settings → Privacy and data → Delete my account, which deletes your cloud data and account. Withdrawal does not affect the lawfulness of earlier processing.

2.3 Purchases

Premium is sold through Google Play. Google processes your payment details; we never receive card data. The app asks Google Play directly whether your Google Play account owns Premium; no other payment service is involved.

• Purpose: completing purchases, unlocking Premium, restoring purchases, accounting obligations.
• Legal basis: performance of a contract (GDPR Art. 6(1)(b), KVKK Art. 5(2)(c)) and legal obligation (GDPR Art. 6(1)(c), KVKK Art. 5(2)(ç)).

2.4 Crash reports

When the App crashes, Firebase Crashlytics sends a technical report: device model, Android version, app version, the stack trace and a random installation ID. Reports contain no journey data.

• Purpose: finding and fixing bugs, keeping the App secure and working.
• Legal basis: legitimate interest (GDPR Art. 6(1)(f), KVKK Art. 5(2)(f)). Turn it off in Settings → Privacy and data → Crash reports.

2.5 Usage analytics (optional, consent)

If you allow it, Firebase (Google Analytics) collects usage statistics such as screens used, session length, app version, device type and approximate country. Your smoking, mood and diary data are never sent to analytics. The advertising ID is not collected and there is no ad personalisation.

• Legal basis: your consent (GDPR Art. 6(1)(a), KVKK Art. 5(1)). Off by default; turn it on or off in the App's privacy step or in Settings. Turning it off also deletes analytics data on your phone not yet sent.

2.6 News and offers (optional, consent)

If you allow it, we may send app notifications and, if you signed in with Google, emails about new features, campaigns and discounts, based on your consent. Withdraw it any time in Settings or via the link in the message. Reward and health notifications are not marketing; manage them in Settings → Notifications.

2.7 Forum (optional)

To enter the forum you confirm that you are over 18 and accept the forum rules, and you pick a nick. The forum runs on our own hosting server (quitmo.kariha.net). Your Google account's email address and name are not sent to the forum server; only your Firebase ID is used to verify you.

• Visible to everyone: your nick, your profile picture if you set one, your "about me" text, the rewards you pick for your showcase, the counter and statistics you share (smoke-free time, cigarettes not smoked, money saved; you can hide these on your profile), your Premium badge, your messages, reactions and whether you are online. What you write is open to every member of the same language room; we advise against sharing personal or health details.
• Other data kept on the server: the date of your 18+ and rules confirmation, ban, block and report records, your message counts, and (for Premium) the subscription end date returned by Google Play. For this, your purchase token is checked with Google Play.
• Notifications (optional): if you turn on the switch in the forum rules, you are notified when someone replies to you or @mentions you. For this your phone's Firebase Cloud Messaging token is kept on the forum server; it is removed when you switch it off or delete your account.
• Moderation: messages pass an automatic filter; reported content is reviewed by the forum moderator. Messages that break the rules are hidden, and repeated breaks lead to a temporary or permanent ban. The member who reported is not named to the reported member.
• Legal basis: providing the forum (GDPR Art. 6(1)(b), KVKK Art. 5(2)(c)); legitimate interest in moderation and safety (GDPR Art. 6(1)(f), KVKK Art. 5(2)(f)); your explicit consent for notifications and the profile picture.
• Deletion: Settings → Privacy and data → Delete my account also deletes your forum account: your nick, profile picture, "about me", showcase, numbers, reactions, blocks and notification token are removed. Your messages stay as context for the room and for other members' replies, under the name "Deleted member", with no link to you. If you want a message removed completely, write to privacy@kariha.net. Moderation records (ban and report history) are kept without identity to prevent abuse.

2.8 Contacting us

If you email us, we process your name, email address and message to answer you (GDPR Art. 6(1)(b) and (f), KVKK Art. 5(2)(c) and (f)).

3. Who receives your data

We do not sell your data or share it for advertising. We only use these service providers (processors) to run the service:

We may disclose information to competent authorities where we are legally required to.

International transfers

Some providers process data outside Türkiye and outside the EU. Transfers from the EU rely on the European Commission's Standard Contractual Clauses or adequacy decisions (EU-US Data Privacy Framework); transfers from Türkiye rely on standard contracts and appropriate safeguards under KVKK Art. 9.

4. How long we keep data

• Data on your phone: until you delete it (Settings → Delete data on this phone, or uninstalling).
• Cloud backup and account: until you delete your account. Deleted immediately from the live database; removed from the provider's technical backups within 30 days.
• Forum: until you delete your account; after deletion your messages remain without identity (see 2.7). Moderation records are kept without identity to prevent abuse.
• Crash reports: 90 days.
• Usage analytics: up to 2 months (event-level data).
• Purchase records: as long as tax and commercial law require (up to 10 years).
• Correspondence: 2 years after your request is closed.

5. Security

All traffic between the App and servers is encrypted (TLS). In the cloud, each user can read and write only their own data, enforced by server-side access rules. Data is accessed only as far as needed to provide the service.

6. Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability, to object, and to withdraw consent at any time. Under KVKK Art. 11 you also have the right to learn whether and how your data is processed and to whom it is transferred, and to claim compensation for unlawful processing.

How: the App's deletion and consent settings handle most requests at once. For anything else, email privacy@kariha.net from the address you signed in with, or write to the address above. We answer within 30 days, free of charge.

You can complain to your local data protection authority in the EU, or to the Turkish Personal Data Protection Authority (kvkk.gov.tr).

7. Automated decisions

We make no automated decisions with legal or similarly significant effects. Rewards, levels, notification times and insights are calculated on your phone, only to show them to you.

8. Children

Quitmo is for people aged 18 and over. If we learn a user is under 18, we delete their cloud data.

9. Changes

We may update this policy. For significant changes, especially to processing based on consent, we will tell you in the App and ask for consent again where needed. The version and effective date are shown at the top.

10. Cloud backup consent text