Privacy Policy
Last updated: 27 February 2026
Introduction
Cirrus (“we”, “our”, “us”) is operated by Mark Chapman, based in the United Kingdom. We are committed to protecting your privacy and handling your personal data responsibly.
This Privacy Policy explains how we collect, use, store, and protect your information when you use the Cirrus mobile application and website (together, the “Service”).
Information We Collect
Account Information
When you create an account, we collect your email address and a display name of your choosing. You may optionally provide additional profile information.
Usage Data
We collect data about how you use the Service, including:
- Quit timer start dates and progress
- Craving logs (time, intensity, and optional notes)
- Breathing exercise completions
- Journal entries and mood data
- Community posts and interactions
- Badge and milestone achievements
Location Data (Optional)
If you choose to enable location features, we collect approximate location data when you log a craving. This is used solely to help you identify craving patterns by place. Location data is never shared with third parties and you can disable this at any time.
Device Information
We collect basic device information including device type, operating system version, and a unique device identifier for analytics and crash reporting purposes.
AI Coach Conversations
Conversations with the Puff AI coach are processed to provide personalised support. These conversations are stored securely and are not shared with third parties.
How We Use Your Information
We use your information to:
- Provide, maintain, and improve the Service
- Personalise your quit journey, including AI coaching and craving insights
- Send relevant notifications (craving warnings, milestone celebrations)
- Analyse usage patterns to improve the app experience
- Respond to support requests
- Process subscription payments through Apple's in-app purchase system
Data Sharing
We do not sell your personal data. We share data only in the following limited circumstances:
- Service providers: We use third-party services for hosting (Supabase), analytics (Vercel Analytics), and crash reporting. These providers process data on our behalf under strict contractual obligations.
- Community features: Posts and comments you make in the Cirrus community are visible to other users. Your display name and badge level are shown alongside your posts.
- Legal requirements: We may disclose data if required by law or to protect the safety of our users.
Data Security
We take reasonable technical and organisational measures to protect your personal data, including encryption in transit (TLS) and at rest. However, no method of transmission over the internet is 100% secure.
Data Retention
We retain your data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law.
Your Rights
Under UK data protection law (UK GDPR), you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Object to processing of your data
- Request data portability
- Withdraw consent at any time
To exercise any of these rights, contact us at cirrusapp@mail.com.
Children's Privacy
Cirrus is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it promptly.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or by email. Continued use of the Service after changes constitutes acceptance of the updated policy.
Contact Us
If you have questions about this Privacy Policy or your personal data, contact us at cirrusapp@mail.com.