Consumer Health Data Privacy Policy
Effective October 27, 2026 · Version 2026-10-27 · All legal documents
NOPE helps people quit smoking and other nicotine use. Information about your smoking and quitting can be consumer health data under Washington's My Health My Data Act, Nevada's consumer health data law (SB 370) and Connecticut's Data Privacy Act. This policy explains how Bit Microsystems LLC ("we") collects, uses, shares and protects it. It applies to everyone, wherever you live, and adds to our main Privacy Policy.
In short
- We collect your quit data only to give you the NOPE features you ask for.
- We use it for anything else, like personalising marketing emails, only with your consent, and you can withdraw consent any time.
- We never sell it, never share it with advertisers, and never share it with an employer or gift-giver.
- You can see it, get a copy and delete it whenever you like.
1. The consumer health data we collect
- Your habit: what you use (for example cigarettes or vapes), how much and how often, how long you've used it, and what it costs you.
- Your quit plan: quit date, daily allowance and taper progress.
- Your behaviour and feelings around quitting: cigarettes you log, cravings and what triggered them, slips, breathing sessions, "what's holding you back", and journal notes you write.
- Things we work out from that data: stats like days smoke-free, money saved, recovery-timeline estimates, milestones and awards, and the affirmations written for you.
- The fact that you use a quit app. Your email address and push token, combined with the above, may also count as consumer health data.
We don't collect precise location, biometric or genetic data, or data from health apps or wearables.
2. Where it comes from
Directly from you, when you set up your profile and use the app. We don't buy health data or get it from data brokers, and we don't infer health conditions from other sources.
3. Why we collect and use it
With your consent, to provide the NOPE Service you ask for:
- to build and adjust your taper plan, and show your stats, savings and recovery timeline;
- to run the craving tools and journal;
- to write your daily affirmations and send them at the times you chose. An AI model running on Cloudflare Workers AI writes them from your first name, what you use, your plan stage, recent progress, your toughest triggers and short excerpts of your recent journal notes. The model keeps nothing after it answers, and nobody uses your data to train AI models;
- to sync and back up your progress so it survives a new phone;
- to keep the Service secure, fix problems and comply with the law.
You give this consent in the app before we ask for any quit details, and we keep a record of when you gave it and which version of this policy you saw. It covers the AI-written affirmations described above. Without it we can't provide the quit features, and you can delete your account at any time.
Only with your separate, optional consent: to personalise marketing emails with your own numbers (such as what smoking costs you) or an AI-written note based on your profile. You can turn this off at any time in the app, by using the link in any of those emails, or by emailing us. Saying no doesn't affect the app.
We never use consumer health data for advertising, and we never use it to make decisions about you that have legal or similarly significant effects.
4. Who we share it with
We don't sell consumer health data, and we don't share it with third parties or affiliates for their own purposes. We have no affiliates that receive it. We disclose it only to processors that handle it for us under contract, solely to provide NOPE:
| Processor | Why |
|---|---|
| Cloudflare (including Workers AI) | Hosting our API, and running the AI model that writes affirmations |
| DigitalOcean (Amsterdam, the Netherlands) | Hosting the database that stores your profile and progress |
| Expo, Apple and Google push services | Delivering notifications that contain your affirmations, if you allow them |
| Brevo | Delivering emails, including personalised ones only if you consented |
If the law requires us to disclose data (for example a valid court order), we'll do so only as required and, where allowed, tell you first.
Gift-givers and employers never receive your consumer health data. If someone else pays for your plan, they can see at most your name and email address and whether you joined, and a team only sees that you joined after you confirm in the app. If you joined through your organisation's domain, they only see totals (see our Privacy Policy).
5. Your rights
You have the right to:
- confirm whether we collect, share or sell your consumer health data, and access it, including a list of the processors we've shared it with (section 4);
- delete it. In the app go to More → Danger zone → Delete account, or sign in at quitwithnope.com/account, or email us. We delete it from our systems and tell our processors to delete it too. Backups are overwritten on their normal rotation;
- withdraw consent at any time. Withdrawing consent to collection means we can no longer provide the quit features, so we'll help you delete your account;
- appeal if we refuse a request (section 6).
We won't discriminate against you for using these rights.
6. How to make a request or appeal
Email hello@quitwithnope.com with the subject "Health data request" from the email on your account. If you write from another address, we'll confirm it's you with a one-time code. We'll respond within 45 days. If we need more time, we'll tell you why, and we may take up to 45 more days where the law allows.
If we decline your request, you can appeal by replying with the subject "Appeal". We'll answer in writing within 45 days and explain our reasons. Washington residents who are unhappy with the result can complain to the Washington State Attorney General at atg.wa.gov/file-complaint. Residents of other states can contact their own attorney general.
7. Security and retention
Only staff who need it can access consumer health data, for support or security. That access is logged. Data is encrypted in transit, and we keep it only while your account exists. See the retention table and security section of our Privacy Policy.
8. Geofencing
We don't use geofences around health care facilities, and we don't collect precise location at all.
9. Changes and contact
If we want to use consumer health data in a new way, we'll ask for your consent first. Earlier versions of this policy are kept at quitwithnope.com/legal.
Bit Microsystems LLC · 3640 Myrtle Avenue, Long Beach, CA 90807, USA · hello@quitwithnope.com