Privacy policy

1. Who is responsible

QuitPact, based in Canada, is responsible for your data under this policy. Your data is processed in the United States by the service providers described in section 4. Contact: hello@quitpact.com.

2. What we collect and why

When you start a pact: the choices you make (program, commitment amount, quit date, email), later your name, your reasons for quitting in your own words, what and how much you vape, past quit attempts, weekly spend and, if you choose, an accountability partner's first name and email. We use these to set up the program, to write your pact summary, to show progress on your dashboard and in milestone messages, and to email your partner if you asked us to.

At checkout: your payment is handled by Stripe. We never see your full card number. We receive a payment reference, the card's type (credit, debit or prepaid), its last four digits and its expiry, so we can run the program and charge the commitment amount only when a failure is confirmed. We record the exact wording you agreed to, when, and the internet address it came from.

After payment: your US mobile number, your express consent to receive texts (with the time and wording), and your time zone, so checks arrive at reasonable hours.

During the program: each check's photo of your test result (and once, if you use another brand, the box), with the check number, date and time burned into the image; when you opened and submitted each check; every message we sent you and whether it was delivered; and every review decision, notice, appeal and charge, in a log that cannot be edited.

On the website: standard technical data (browser, device type, rough location by country from your internet address, pages visited) and, in the start flow and dashboard, recordings of how the pages are used, so we can fix confusing steps. See section 4.

3. Your check photos

Check photos are reviewed by a member of the QuitPact team. They are stored in a private storage bucket, never public, never shared with your partner or anyone else, and never used for marketing or training without your separate written permission.

Photos of checks that did not lead to a charge are deleted 30 days after review. Photos tied to a charge (the check that led to it and any retest) are kept for 180 days after the charge, because card disputes can arrive months later, and are then deleted. Deletions are logged.

4. Who else handles your data

A small number of service providers process data on our behalf, each only for its job: payments and the saved card (Stripe; its own privacy policy applies to the card details you enter on its pages), text messaging, email delivery, website hosting and our database and photo storage (in the United States), website analytics, and an AI writing service that receives a few of your quiz answers, never your name or contact details, to write the personal sentences in your pact summary. Each receives only what its task needs, and none may use your data for its own purposes.

We do not sell your data. We do not share it with advertisers or data brokers. Your mobile number and your text-message consent are never shared with third parties or affiliates for their marketing. We disclose data only if the law requires it or to defend a legal claim (for example, a card dispute).

Analytics: we count how people move through the website and the start flow and record how the pages are used (taps, scrolling, which option was chosen) to find and fix confusing steps. Recordings mask your email, phone number, name and signature, and are never active on the check page (your camera) or on the checkout page. The site sets a small number of cookies and local-storage entries for this, for keeping your answers if you come back, and for signing you in.

5. How long we keep things

Account, program, message and log records are kept for as long as your program runs and for as long as we need them to handle refunds, disputes and the law (generally up to seven years for payment records). Photos follow the schedule in section 3. Waitlist and lead emails are deleted when you unsubscribe, or after one year if you never join. If you ask us to delete your account, we delete what we are allowed to delete and tell you what we must keep and for how long.

6. Your choices and rights

You can ask us at any time to see, correct or delete your personal data, or to send you a copy, by emailing hello@quitpact.com. You can stop texts by replying STOP (your checks then continue by email), remove a partner from your dashboard, and unsubscribe from any promotional email with its link. Residents of some states (for example California) have specific rights under state privacy laws; we honour requests from anyone, wherever they live, within 30 days.

QuitPact is for adults 18 and over. We do not knowingly collect data from anyone younger. If you believe a minor has given us data, email us and we will delete it.

7. Security

Data travels over encrypted connections. Check links are single-use and expire at the deadline. Photos are in private storage with short-lived access links. Admin access is limited to the QuitPact team, behind a sign-in restricted to one email address. Secrets are kept out of the code. No system is perfectly secure; if we ever discover a breach that affects you, we will tell you promptly.

8. Changes

We may update this policy; the version date is at the top. Material changes to how we use data you already gave us will be emailed to you before they take effect.