1. Who We Are
Breathe Free with Me is a personal project operated by an individual based in England. For the purposes of UK and EU GDPR, the operator is the data controller for personal data collected through the Breathe Free with Me app and website.
Data Protection contact: privacy@breathefreewithme.com
2. What Data We Collect
We collect the minimum data necessary to provide the app. Here is what we collect and why:
| Category | Data Types | Purpose |
|---|---|---|
| Account information | Name, email address | To create and manage your account |
| Profile & demographics | Age range, gender, country, occupation (all optional) | Personalisation and aggregated product insights |
| Environmental data | Nicotine product type, weekly consumption, years of use, weekly spend | Core app functionality: lifestyle tracking, environmental footprint calculation |
| Daily check-in data | Daily Focus, daily practices and affirmations | Progress tracking and motivation support |
| Awareness items | Moments, people, and places you choose to record; optional GPS co-ordinates for location awareness items | Self-awareness building. We do NOT track your location continuously. |
| Community data | Support requests (username or anonymous), responses to others' requests | Peer support features |
| Preferences & consents | Notification preferences, marketing consent, policy acceptance timestamps | Delivering notifications you want; demonstrating lawful processing |
| Technical data | Device type, OS version, app version, crash logs, usage analytics | App stability and performance improvements |
3. Legal Basis for Processing
UK and EU GDPR requires us to have a lawful basis for each category of personal data we process. Our legal bases are:
| Data Category | Legal Basis | Details |
|---|---|---|
| Account and service data | Contract performance (Art 6(1)(b)) | Processing is necessary to provide the service you signed up for |
| App functionality data | Contract performance (Art 6(1)(b)) | Core feature delivery |
| Service improvement | Legitimate interests (Art 6(1)(f)) | Improving the app for all users; does not override your rights |
| Marketing communications | Consent (Art 6(1)(a)) | Only if you opt in; you can withdraw at any time |
| Legal compliance | Legal obligation (Art 6(1)(c)) | Required by law |
4. How We Use Your Data
We use your data only for the following specific purposes:
- Providing and improving the Breathe Free with Me app
- Supporting community features (anonymised where possible)
- Sending you service notifications (e.g. check-in reminders, if opted in)
- Complying with legal obligations
- Responding to your support enquiries
We do not use your data for advertising. We do not profile you for commercial purposes. We do not use your data for automated decision-making with legal or similarly significant effects.
5. Data Sharing and Third Parties
We share your data only with the following categories of third-party service providers, all of whom are bound by appropriate data processing agreements:
- Microsoft Azure (UK region): cloud infrastructure and database storage
- Google Firebase (mobile only): authentication, crash reporting, analytics, and push notifications
- AI service providers are used sparingly for community support. Data is minimised and not retained for training without explicit consent
5a. International Data Transfers
Your data is primarily stored in the UK or European Economic Area (EEA) on Microsoft Azure servers located in the UK.
Some data may be processed by Google (Firebase services) in the United States. Where data is transferred outside the UK/EEA, we ensure adequate safeguards are in place, including:
- The UK/EU-US Data Privacy Framework
- Standard Contractual Clauses (SCCs)
- Adequacy decisions by the UK Secretary of State / European Commission
6. Data Retention
We retain personal data only for as long as necessary:
- Active account data: held for the life of your account
- Daily check-in and reflection data: held for the life of your account
- Account deletion: all personal data is permanently deleted within 30 days of your deletion request
- Support communications: retained for up to 2 years
- Anonymised aggregated data: may be retained indefinitely (this cannot be re-linked to you)
7. Your Rights Under UK & EU GDPR
You have the following rights regarding your personal data. You can exercise any of these rights by contacting us at privacy@breathefreewithme.com:
| Right | What it means |
|---|---|
| Right of access | Request a copy of all personal data we hold about you |
| Right to rectification | Correct inaccurate or incomplete data |
| Right to erasure | Request deletion of all your data ("right to be forgotten") |
| Right to data portability | Receive your data in a machine-readable format |
| Right to restrict processing | Ask us to pause processing of your data in certain circumstances |
| Right to object | Object to processing based on legitimate interests |
| Right to withdraw consent | Withdraw any consent you have given at any time |
We will respond to all valid requests within one calendar month. In complex cases, we may extend this by a further two months but will notify you promptly.
8. Cookies and Tracking
Our website does not use tracking cookies. It uses browser-standard local storage (localStorage/IndexedDB) solely to maintain app state and functionality. No advertising cookies, tracking pixels, or third-party analytics that identify you are used.
The app does not use cookies. App-side tracking is limited to session management and performance monitoring (via Firebase, mobile only) necessary for the service to function.
9. Children and Young People
Breathe Free with Me is intended for users aged 16 and over. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has provided us with personal data without appropriate consent, please contact us immediately at privacy@breathefreewithme.com and we will delete it promptly.
10. Data Security
We implement appropriate technical and organisational security measures to protect your data, including:
- Encryption in transit (TLS 1.2+) and at rest
- Access controls limiting who can access personal data
- Regular security reviews
- Incident response procedures to notify you and the ICO in the event of a breach
11. Changes to This Policy
We will notify you of any material changes to this Privacy Policy via the app or by email (if provided) before those changes take effect. The "Last updated" date at the top of this policy reflects the most recent revision.
Where changes require your consent (for example, a new purpose for processing your data), we will ask for it explicitly. You are free to delete your account if you do not wish to continue under a revised policy.
12. How to Contact Us or Complain
For all privacy queries, data requests, or complaints:
Email: privacy@breathefreewithme.com
If you are not satisfied with our response, you have the right to lodge a complaint with your relevant supervisory authority:
- UK residents: Information Commissioner's Office (ICO), ico.org.uk · 0303 123 1113
- EU residents may contact their local national data protection authority. A full list is available at: edpb.europa.eu/about-edpb/about-edpb/members_en