Privacy Policy

This is the permanent copy of version 2026-10-28-2 (October 28, 2026). Read the current version · all legal documents.

Effective October 28, 2026 · Version 2026-10-28-2 · Earlier versions

1. Who we are

NOPE is run by Bit Microsystems LLC, 3640 Myrtle Avenue, Long Beach, CA 90807, USA. We are responsible for (the "controller" of) the personal data described here. Questions or requests: hello@quitwithnope.com.

This policy covers the NOPE app, quitwithnope.com and the emails we send. For team plans, the organisation that pays decides who to invite. We still decide how members' NOPE data is used, and this policy applies to it.

2. What we collect

We don't collect your location, contacts, photos, health-app records or advertising identifiers. The app contains no advertising SDK and no third-party analytics SDK.

3. How we use it, and our legal bases

Where the GDPR or UK GDPR applies, we rely on these legal bases:

Our staff can access account data only when it's needed for support, billing or security. Admin access is limited to a small number of people and every admin action is logged.

4. AI-written messages

Your daily affirmations, and some personal notes in emails if you've allowed it, are written by an open-source language model that runs on Cloudflare Workers AI. Cloudflare acts as our processor. To write a message we send the model the context it needs: your first name or nickname, what you're quitting, your plan stage and days to your quit date, how long you've used it, what you said holds you back, recent progress (cravings beaten, recent slips, money kept), your toughest trigger times, and short excerpts of your most recent journal notes so the message can echo your own words. The model keeps nothing after it answers. Neither we nor Cloudflare use your data to train AI models. We filter what the model writes and block medical claims.

5. Emails and notifications

• Service emails, which we send whenever they're needed: sign-in codes; purchase confirmations and receipts; trial, renewal and price-change notices; payment problems; pause and cancellation confirmations; gift and team invitations and updates.
• Marketing emails: offers (including after a plan ends), and about every 10 days a story, tip or quote for people who aren't subscribed. Unsubscribe with the link in any of these emails or by emailing us. Unsubscribing doesn't stop service emails.
• Push notifications: affirmations and reminders, only if you allow them. Turn them off in the app or your phone's settings.

6. Gift and team plans: what payers see

Joining a team is always your choice. When a team invites you, NOPE asks you to confirm before you join and tells you exactly what the team will see. Until you tap Join, the team only sees that you've been invited. A gift starts when you sign in with the invited address, and you can decline or leave it.

You can leave in the app or at quitwithnope.com/account. We only tell the payer that a seat became free, not who left. If they invited people by email, though, they may be able to tell from their list that you're no longer on it.

Unused domain and join-link seats. If you joined through your organisation's email domain or a join link and haven't signed in or opened NOPE for 120 days, we email you, and release the seat 14 days later if you still haven't. We use only that last-open date, and the payer isn't told who was released.

If you buy a gift or team plan, recipients see your name (as you entered it), your message and, for teams, the team name.

7. If someone gave us your email address

If a friend bought you a gift or your organisation invited you, they gave us your email address, and maybe your name and a message. We use it only to deliver the invitation and a small number of reminders, to show the buyer whether you accepted, and to recognise you if you sign in with that address. Every invitation has a link to decline and stop further emails. If you decline, we remove your seat, tell the buyer the invitation was declined, and keep a scrambled (hashed) copy of your address so that sender can't invite you again for 12 months. On the same page you can also choose never to receive NOPE invitations from anyone. We then keep a hashed copy of your address for as long as that choice stands, and you can ask us to lift it at any time. We also keep a hashed log of the invitations we send for 35 days, so we can limit how many invitations anyone receives. If you never sign in, we delete the invitation within 90 days after the plan it belongs to ends.

8. Who processes your data

We use these service providers. Each acts on our instructions, gets only what it needs, and is bound by a data-processing agreement:

Payment disputes. If a card payment is disputed, we may give Stripe and the card network the records of that purchase: what was bought and when, the terms accepted at checkout and when, the country and IP address it was bought from, our receipts and emails, and account dates such as sign-ins. We never give them your quit data.

We may also disclose data if the law requires it, to protect people's safety or our rights, or to a buyer of our business, which would have to keep honouring this policy. If that ever happens, we'll tell you first.

9. What we never do

• We never sell your personal data, and we never "share" it for cross-context behavioural advertising, as California law defines these terms.
• We never show ads in the app, and we never give your data to advertisers or data brokers.
• We never use your data to train AI models, and we never let our providers do so.
• We never tell an employer or gift-giver anything about how your quit is going.

10. This website

quitwithnope.com uses Google Analytics 4 to count visits and see which pages and links people use. Google Analytics sets cookies and receives your IP address, approximate location, device and browser type, and the pages you view. We use it only in aggregate to understand which marketing works. It is never joined to your NOPE account, and we don't use it for advertising or remarketing. The site also loads fonts from Google Fonts, so Google receives your IP address when a page loads.

Your choice. If you visit from Europe (including the EU, EEA, UK and Switzerland), we ask first, and Google Analytics doesn't load at all unless you choose Allow. Elsewhere it's on by default and you can switch it off. You can change your choice at any time with cookie settings; we remember it in your browser's local storage. You can also use Google's browser add-on, block cookies, or use your browser's tracking protection. Advertising signals are always off. Pages where you sign in, manage your account or pay on our website don't load Google Analytics.

11. International transfers

We're based in the United States, and most of our providers process data there. When we transfer personal data from the EU, EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum), or on the provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, plus additional safeguards where needed. Ask us for a copy of the relevant safeguards.

12. How long we keep data

When you delete your account, we also delete your contact from our email provider and your diagnostic logs. Apple, Google and Stripe keep their own records of your purchases under their own policies.

13. Security

Data is encrypted in transit (TLS). Payment secrets are encrypted at rest. Access is limited to people who need it, and we log admin actions. Sign-in uses one-time codes, so there's no password to steal. No system is perfectly secure. If a breach affects you, we'll tell you and the relevant authorities as the law requires.

14. Your rights

Wherever you live, you can ask us to:

• access your data or get a copy of it in a portable format;
• correct it (you can edit most of it yourself in the app);
• delete it: in the app (More → Danger zone → Delete account), at quitwithnope.com/account, or by email;
• stop marketing: use the unsubscribe link, or email us;
• withdraw consent you gave us, at any time. This doesn't affect anything we did before.

In the EU, EEA and UK you can also object to processing based on legitimate interests, ask us to restrict processing, and complain to your data protection authority (in the UK, the ICO). We'd appreciate the chance to fix things first.

To make a request, email hello@quitwithnope.com from your account email. If you write from another address, we may ask you to confirm your identity with a sign-in code. We reply within 30 days (45 days where US state law allows) and don't charge for requests.

15. US state privacy rights

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with privacy laws have the rights in section 14, and also:

• Right to know the categories of personal information we collect (section 2), where it comes from, why we use it (section 3), and the categories of providers we disclose it to (section 8). In the past 12 months we have disclosed identifiers, commercial information, internet activity, and sensitive information (health-related quit data) to service providers, for the purposes above. We have not sold or shared any of it.
• Sensitive personal information. We use health-related quit data only to provide the Service and as otherwise permitted by law, so there's nothing for you to limit. We never use it to infer things about you beyond your quit.
• Opt-out signals. We don't sell or share personal data. We still treat a Global Privacy Control signal as a request to opt out.
• No discrimination for using your rights.
• Authorised agents may make requests for you with your signed permission. We'll verify your identity with you directly.
• Appeals. If we decline your request, reply to our answer to appeal. We'll respond within the time the law sets. If you're still unhappy, you can contact your state attorney general.

Washington, Nevada and Connecticut residents: see our Consumer Health Data Privacy Policy.

16. Children

NOPE is for adults and isn't directed at anyone under 18. We don't knowingly collect data from children. If you think a child has given us their data, tell us and we'll delete it.

17. Changes and contact

If we change this policy materially, we'll tell you by email or in the app before the change applies, and ask for your consent where the law requires it. Earlier versions are kept at quitwithnope.com/legal.

Bit Microsystems LLC · 3640 Myrtle Avenue, Long Beach, CA 90807, USA · hello@quitwithnope.com