ClariLung Privacy Policy

Effective date: 2026-10-10

ClariLung (“we”, “our”, “the app”) helps you quit vaping, smoking, weed, or cigars. It is made by Duskfield Studios LLC. This policy explains what we collect, why, who else receives it, how long we keep it, and your rights. It covers the iPhone, iPad, Android and Wear OS apps and clarilung.com.

1. Information we collect

Account: your email address, your name (optional), a password hash (bcrypt — we never store your password itself), and, if you sign in with Google or Apple, the account identifier that provider gives us.

Age check: at sign-up we ask for the month and year you were born, only to confirm you are at least 13. We check it and discard it — it is not stored.

Quit profile: what you are quitting (vape, cigarettes, weed or cigars), device type, nicotine strength, how much you used per day, what it cost you, your quit method (cold turkey or taper) and taper length, your quit date, your craving triggers, the money / days / craving goals you set, and your time zone.

What you log: streaks and slips, daily taper logs, craving check-ins (intensity, trigger, the tool you used, whether you resisted, and any context you type in), journal entries (mood and text), nicotine-replacement logs (product, strength, quantity, notes), lesson progress, milestones and achievements.

Health data you connect: on iPhone (Apple Health) or Android (Health Connect), if you allow it, a summary of your heart rate, heart-rate variability, VO₂ max, blood oxygen, breathing rate and sleep — see section 4.

AI Coach conversations: the messages you send the Coach and its replies, stored so you can come back to a conversation.

Community and buddies: forum posts and replies you write, upvotes, reports you file, and people you block (section 5); quit-buddy connections, encouragement messages, and the email addresses you send buddy invitations to.

Subscription: which store handled your payment (Stripe, Apple or Google), your plan, status, billing period, and the store’s customer, transaction or purchase identifiers. We never see card numbers or store passwords.

Device and technical data:

A device identifier, hashed. On Android we read the device’s ANDROID_ID; on iPhone we create an install ID; on the web we create a random ID kept in your browser. We store only a salted one-way hash of it, used for one thing: making sure each person gets one free trial.
A push-notification token, if you turn notifications on.
In-app usage events (for example, which onboarding step you reached) so we can see where people get stuck. These are never sold or used for advertising.
IP addresses, which our servers use for rate limiting and which appear in server logs, and crash / error reports (section 3, Sentry).

We do not collect your precise location, contacts, photos, or browsing history, and we use no advertising identifiers.

2. How we use your data

To run your quit plan, taper schedule, health timeline, stats and goals
To personalise the AI Coach with your triggers, craving patterns and progress
To sync your streak to home-screen widgets, Apple Watch and Wear OS
To run the community forum and quit-buddy features
To send push notifications you allow (milestones, check-ins, buddy encouragement)
To send email — see “Email we send” below
To take payments through Stripe, Apple and Google and keep your access in sync across devices
To give each person one free trial, and to protect the service from abuse
To find and fix errors

We do not use your data for advertising, and we do not sell it.

Email we send

Account email you need: sign-up verification, password reset, and a welcome email.
Product tips and updates during and after your trial. Every one has a one-click unsubscribe link, and you can turn them off any time in Settings → “Product tips and updates by email”.
Buddy invitations you ask us to send to a friend. The friend can unsubscribe from the email, and we then send that address no further invitations.
Replies to messages you send through our contact or bug-report forms.

3. Who else receives your data

These companies process data for us, each only for the purpose shown.

Groq (GroqCloud) — runs the AI Coach. Receives the messages you send the Coach, plus your quit profile (substance, device type, nicotine strength, quit method, days free, triggers and craving patterns). Your name and email address are not sent. Under our agreement Groq may not use inputs or outputs to train or fine-tune any model, and we have enabled Zero Data Retention on our Groq account, so your messages are processed to generate a reply and not stored by Groq. Processing takes place in the United States. Groq’s privacy policy · Groq’s data-retention documentation.
DeepInfra — runs the AI Coach only when Groq is busy or unavailable, using the same model. It receives the same message and quit profile Groq would, and never your name or email address. DeepInfra holds the request in memory only while it answers, then deletes it; it does not write it to disk or use it to train any model. DeepInfra’s data-privacy documentation.
Stripe (web payments), Apple (App Store) and Google (Google Play) — handle subscriptions and send us the identifiers above. Stripe’s privacy policy.
Sign in with Google / Sign in with Apple — if you use them, they confirm your identity and email to us. On the web their sign-in scripts load only on the pages where you sign in or connect an account.
Apple Health and Google Health Connect — on your device, if you connect them (section 4).
Expo (650 Industries) — delivers push notifications through Apple Push Notification service (APNs) and Google Firebase Cloud Messaging (FCM), and delivers app updates (EAS Update). Push messages contain the notification text, such as a milestone or a buddy’s encouragement.
Resend — sends our emails (section 2). It receives the recipient address and the message. Resend’s privacy policy.
Railway — hosts our servers, our PostgreSQL database and cache, and our server logs. Your account data is stored there.
Cloudflare — serves our website, and may count page views on it with Cloudflare Web Analytics, which uses no cookies and does not track you across sites.
Sentry — receives crash and error reports from the apps, website and server so we can fix bugs. We configure it not to receive request contents (so no Coach messages, journal entries or craving notes), page query strings, or your IP address, and we do not record your screen. Sentry’s privacy policy.

Our website loads no advertising or social-media trackers, and our fonts are served from our own domain.

4. Health data, and the consent we ask for

Data about quitting a substance is health data, and we treat it that way. What you use and how often, your cravings and slips, your nicotine-replacement logs, and the vitals you connect from Apple Health or Health Connect are special-category data under Article 9 of the UK/EU GDPR and consumer health data under Washington’s My Health My Data Act and Nevada SB 370. Some of it is sent to Groq — or, when Groq is busy, DeepInfra — to personalise the Coach (section 3).

We ask for your explicit consent to process it — a separate, unticked checkbox, not bundled into our Terms. That consent is our lawful basis under GDPR Art. 9(2)(a). We record when you gave it and which version of the notice you saw, and if we change the notice materially we ask again.

You can withdraw it at any time in Settings → Data & privacy → Withdraw consent. ClariLung cannot run a quit plan without this data, so withdrawing pauses the app until you agree again or delete your account. Withdrawal does not undo processing that already lawfully happened.

Apple Health and Health Connect are optional and connect only after you allow them in the system prompt. Only a summary (current value, baseline and trend per vital) reaches our servers. You can disconnect in your device’s Health settings. We never use health data for advertising and never sell it.

HIPAA does not apply to ClariLung — that law covers health-care providers, health plans and their contractors, and we are none of those: ClariLung is sold directly to you, we do not diagnose or treat, and we do not bill insurance. What does apply, and what we hold ourselves to, is the FTC’s Health Breach Notification Rule, the FTC Act’s ban on deceptive statements, and the state consumer-health-data laws above.

5. The community forum is public to other members

Posts and replies in the community forum are visible to other signed-in ClariLung members. Posting is anonymous by default — you appear under a random name. If you turn anonymous off, your account name is shown with the post. Don’t include anything you would not want other members to read.

You can edit your own post or reply for 24 hours and delete it at any time. You can report a post or reply (we review reports, and content reported by several people is hidden automatically until we do), and block its author so you no longer see their posts.

Quit buddies you connect with see your streak length, your name, and the encouragement messages you send them.

6. Security

All traffic between the apps, the website and our servers uses HTTPS (TLS)
Your data is stored in a managed PostgreSQL database at our host, Railway, with access restricted to the ClariLung service and its operators
Passwords are hashed with bcrypt
Sign-in tokens are kept in the iOS Keychain / Android Keystore on mobile, and in your browser’s local storage on the web
Rate limiting and account lockout against password guessing
Security headers on the website and API
Daily database backups by our host

Your journal, Coach conversations and other content are not end-to-end encrypted: our service reads them to show them to you and to run the Coach.

If there is a breach. If your health-related data is ever acquired by someone without your authorisation, we will notify you by email without unreasonable delay and no later than 60 days after we discover it, describing what happened, what data was involved, and what we are doing about it. Where the law requires it we will also notify the U.S. Federal Trade Commission and, for larger incidents, the media.

7. Data sharing

We do not sell or rent your data and do not share it for advertising. We share it only with the processors in section 3, with other members as described in section 5, and with authorities when valid legal process requires it.

8. How long we keep data

Your account data: while your account is open.
When you delete your account, you are signed out at once and your data is deleted immediately, in the same operation — your profile, logs, journal, Coach conversations, health vitals, community posts and replies, buddies, and subscription records. A web (Stripe) subscription is cancelled at the same time. See Account Deletion.
What remains after deletion:
- the free-trial ledger — your normalised email address and the salted hash of your device identifier, no longer linked to any account, so a deleted account can’t restart a free trial;
- reports other people filed about posts you have deleted — the reason and outcome only, without the post;
- our email suppression list, if you unsubscribed from invitation emails, so we keep honouring it;
- server logs at Railway (account ID, IP address, API path and user agent — no content), kept under Railway’s log retention. Security-relevant events (sign-ins, password changes, deletions) are recorded only in these logs;
- database backups, until they rotate out.
Payment records: we keep none in our database after deletion. Stripe, Apple and Google keep their own records under their own policies.

9. Your rights

Wherever you live, you can:

Access / export your data — Settings → Data & privacy → Export my data downloads a file with everything in your account: profile, quit plan, logs, cravings, journal, Coach conversations, health vitals, nicotine-replacement logs, community posts, replies and reports you filed, blocks, buddies, subscriptions, your consent record, notifications and usage events
Correct it — edit it in the app, or ask us
Delete it — Settings → Danger zone → Delete account, or email us
Withdraw consent for health data — Settings → Data & privacy
Unsubscribe from product emails — the link in any of them, or the Settings toggle
Not be treated differently for using these rights

California, Washington, Nevada, EU and UK residents have these rights under their laws; Washington residents may also ask which third parties received their consumer health data (section 3 lists them), and EU/UK residents can complain to their data protection authority. We do not sell consumer health data and never have. Email support@duskfieldstudios.com; we respond within 30 days (45 where the law allows).

10. Children

ClariLung is not for children under 13, and sign-up checks this: someone under 13 cannot create an account. (We check the birth month and year and do not store them.) We do not knowingly collect data from children under 13. If you are a parent or guardian and believe your child under 13 has an account, email support@duskfieldstudios.com with the account’s email address; we will delete the account and its data, including its free-trial record. Users aged 13 to 17 must have a parent’s or guardian’s agreement to our Terms.

11. Wellness disclaimer

ClariLung is a wellness app and does not provide medical advice, diagnosis or treatment. The AI Coach is an AI, not a person or a medical professional. If you have severe withdrawal symptoms or mental-health concerns, talk to a healthcare provider. In a crisis, call or text 988 (Suicide & Crisis Lifeline, US) or call 911.

12. Changes

We will tell you about material changes in the app or by email at least 14 days before they take effect, and update the effective date above.

13. Contact

Duskfield Studios LLC, 2108 N St Ste N, Sacramento, CA 95816 · support@duskfieldstudios.com