Privacy policy

Last updated 26 October 2026

1. Who we are

MindVape is an iPhone app that helps adults who vape notice how they vape. In this policy, "we" and "us" means The Crafted Code Ltd, a company registered in England and Wales (company number 14639993), with its registered office address on Companies House. MindVape is a product of The Crafted Code Ltd. We're responsible for the personal data described here (the "controller", in GDPR terms). For anything about privacy, email hello@thecraftedcode.com with "Privacy" in the subject. Because we're based in the UK, our lead regulator is the Information Commissioner's Office (ICO).

This policy covers the MindVape app, its widgets, Live Activity and shortcuts, and the mindvape.app website. US residents can also read our consumer health data notice.

2. What stays on your iPhone

MindVape is built to work without us. Everything you put into it is stored on your iPhone and is never sent to us:

• puffs, sessions, day answers ("Didn't vape", "Don't remember") and rough logs;
• your Lineup: vape names, types, colours, pod moods, liquids, strengths and any photos you add;
• vibe checks, moments and notes;
• nicotine-in-the-liquid figures, trends, patterns and Heads-ups;
• your settings, reminders and the result of the age check;
• anything the app reads from Apple Health.

We have no server that stores this, no account it could be tied to, and no way to look at it.

How it's protected

Your history is protected by iOS data protection, so it's encrypted while your iPhone is locked. It's also left out of iCloud and iPhone backups on purpose, which follows Apple's rule that health data doesn't go into iCloud. You can add a Face ID lock in Settings › Privacy lock.

When it leaves your phone because you asked

Some features create a copy of your data, and only when you tap something. You choose where the copy goes, and we never receive it:

• Backup file. Settings › Backup and transfer › Save a backup file makes a file locked with a password you choose (AES-256 encryption). You decide where to save it, for example in Files, iCloud Drive or AirDrop. We can't open it, and if you forget the password, nobody can, us included. Photos aren't included.
• Move to a new iPhone. Your old iPhone shows a code. Your new iPhone scans it with the camera and receives your history directly over your local Wi-Fi network, encrypted with a one-time key. It never passes through the internet or through us.
• Export. Settings › Privacy and data › Export everything makes a JSON file of your history, without photos, for you to keep or share.
• Summary for a GP (Plus). A PDF for a doctor, nurse or stop-smoking service. You choose what goes in it. Vape names and photos are never included.
• Share cards. An image you can save or share. Cards never show your vapes, flavours or nicotine.

Once you send one of these somewhere, the app or service you send it to handles it under its own terms.

Deleting it

Settings › Privacy and data › Delete history removes everything from your iPhone for good. Deleting the app does the same. Backup files you saved yourself stay where you put them until you delete them.

3. What leaves your iPhone

A few things do leave your phone. This is the full list:

Usage events (Google Firebase Analytics)

The app can only send events from a short, fixed list that's built into the code: steps of onboarding, which screen you opened, that a session started or was saved, that something was logged and by which method (for example a tile or the Lock Screen), that you added a vape or liquid, that you viewed or used the Plus offer, that you exported or deleted your history, and similar. Each event can carry a label from a fixed set, such as the screen's name or "yearly". Firebase also records some events by itself: the first time the app opens, app sessions, app updates, and in-app purchases (with the product, price and currency).

With each event, Firebase receives a random ID for this installation of the app (the "app instance ID"), your iPhone model, iOS version, app version, language, and an approximate location (country, region or city), which Google works out from a shortened version of your IP address. Google doesn't keep the IP address itself.

Usage events never include puff counts, sessions' lengths, nicotine, liquid strengths, vibe answers, moods, moments, vape or flavour names, photos, notes or any other text you type, Apple Health data, or whether you vaped on a given day.

We don't use Apple's advertising identifier (IDFA) or vendor identifier (IDFV), we never ask to track you, and we don't set a user ID. Google's advertising features, Google signals and ad personalisation are switched off, and the app tells Firebase that ad storage and ad use are denied, whatever you choose.

Crash reports (Google Firebase Crashlytics)

If the app crashes, it sends a crash report: the technical trace, the time, your iPhone model, iOS version, free disk space and memory, app version, a random installation ID, and the list of usage events from just before the crash (the same fixed list as above). Crash reports never contain anything you logged. They follow the same switch as usage events.

Purchases (Apple and RevenueCat)

Apple processes every payment. We never see your name, email address, Apple Account or card. RevenueCat runs the subscription system for us. When the app opens, it fetches the current Plus prices and checks whether Plus is active. To do that, RevenueCat receives a random ID it creates for this installation, your purchase receipts from Apple (product, price, currency, purchase, renewal and expiry dates, trial status and the App Store country), the app version, your iPhone model and iOS version, and your IP address, which it uses to send the response. RevenueCat never receives anything you log.

Age check (Apple)

On first launch, the app asks Apple's Declared Age Range whether you're over the age limit. Apple answers on your iPhone with a range, not your birthday, and you can choose not to share it. The app keeps only the result ("passed", "under age" or "not shared") on your iPhone. We don't receive it, except that a usage event can say "passed" or "not shared" if usage events are on.

Emails to us

If you email support or privacy, we receive your email address, what you write and anything you attach. Please don't send your logs or screenshots of them unless you want to.

What we never do

• Sell personal data, or share it for advertising.
• Show ads, or let ad networks into the app.
• Track you across other companies' apps or websites.
• Use anything from MindVape, including Apple Health data, for advertising, marketing or data mining.
• Use precise location, contacts, your microphone or your photo library. The camera is only used to scan the transfer code.

4. Apple Health

If you turn on Sleep and steps (part of Plus), MindVape asks to read your sleep and step count from Apple Health. It uses them only on your iPhone, to show whether they line up with your vaping. It never writes anything to Health. Health data is never sent to us or anyone else, never stored in iCloud by MindVape, and never used for advertising, marketing or data mining. You can stop it at any time in the Health app › Sharing › Apps › MindVape.

5. What other people could see on your phone

Your logs are private from us, but someone holding your phone could see some things. You control all of these:

• Notifications never show puffs, nicotine or mood. You choose which ones you get in Settings › Notifications.
• The Live Activity on the Lock Screen is Quiet by default: it shows the timer, not your vape or puff count.
• Widgets can hide their numbers until your iPhone is unlocked (Settings › Privacy lock › Private widgets).
• Privacy lock asks for Face ID or your passcode whenever MindVape opens, and can hide it in the app switcher. It's free.
• Siri and Shortcuts. If you log by voice, Apple processes the request under Apple's privacy policy. MindVape only receives the action, such as "add a puff".

6. Why we use data, and our legal bases

If you're in the UK, the EEA or Switzerland, data protection law asks us to say which legal basis we rely on for each use.

Your logs, vibe checks and Apple Health data could be health data, which GDPR treats as special category data (Art. 9). We've designed MindVape so that we never receive them or have access to them. The data we do receive is limited to app usage and purchases, and we don't use it to work out anything about your health.

We don't make decisions about you based solely on automated processing, and we don't build profiles of you.

7. Who we share it with

These companies process data for us under contracts that limit them to providing their service to us:

• Google (Google Ireland Ltd in the EEA and UK, Google LLC elsewhere): Firebase Analytics, Crashlytics and Firebase Hosting for the website. We've turned off Google's optional data sharing settings, so Google uses this data only to provide these services to us.
• RevenueCat, Inc. (USA): the subscription system.
• Google (Google Workspace): our email.

Apple processes payments, Siri, Apple Health, the age range and App Store analytics as an independent company, under Apple's privacy policy. Apple shares only aggregated, anonymous sales and App Store analytics reports with us.

We'll disclose data if the law requires it, for example a valid court order, and we'll push back on requests that are too broad. Because your logs aren't on our systems, we couldn't hand them over even if asked. If MindVape is ever sold or merged, the small amount of data we hold would pass to the new owner, who would have to keep the promises in this policy or ask you first.

8. Data outside your country

Google and RevenueCat may process data in the United States and other countries. When data leaves the UK, the EEA or Switzerland, we rely on the EU–US Data Privacy Framework, its UK extension and the Swiss–US framework where the provider is certified, and on standard contractual clauses (with the UK addendum) otherwise.

9. How long we keep it

Apple keeps its own records of your purchases under Apple's policies.

10. Security

The best protection is not having your data, so we've kept almost everything on your phone. What we do receive travels over encrypted connections, is tied to random IDs rather than names, and sits with providers who hold recognised security certifications. Only the people who build MindVape can access our Firebase and RevenueCat dashboards, and those accounts use two-factor sign-in. If a security incident affected your personal data, we'd tell you and the regulator where the law requires it.

11. Your choices and rights

Choices in the app

• Turn usage and crash reports off any time in Settings › Privacy and data › Usage and crash reports.
• Export your history, or delete it, in Settings › Privacy and data.
• Stop Apple Health access in the Health app › Sharing › Apps.
• Turn off notifications in Settings › Notifications, or in iOS Settings.

Your rights

Depending on where you live, you can ask us to tell you what personal data we hold about you and give you a copy, correct it, delete it, limit how we use it, send it to you or someone else in a portable format, or stop using it. You can also object to uses based on our legitimate interests, and withdraw consent at any time without affecting anything we did before. To ask, email hello@thecraftedcode.com. We'll reply within one month (45 days in the US), and we won't charge you or treat you differently.

There's no account, so we can only find your data if you help us link it to you:

• Purchases: send the order ID from your Apple receipt (in the email Apple sent, or at reportaproblem.apple.com). We'll find the RevenueCat record and delete it or send you a copy.
• Usage events and crash reports are tied only to a random ID that we can't link to you, so we usually can't single them out. You can turn them off, and they're deleted after 2 months and 90 days.
• Your history is on your iPhone, and only you can export or delete it.

If you're not happy with our answer, you can appeal by replying to it, and we'll review the decision within the time the law sets. You can also complain to your data protection authority. In the UK, that's the Information Commissioner's Office (ico.org.uk). In the EU, it's the authority in your country. In the US, you can contact your state attorney general.

12. Age

MindVape is for adults who already vape: 18 or over (21 or over in the US), and over the legal age for vaping where they live. It's rated 18+ on the App Store. If Apple tells the app you're under the age limit, the app stops before anything is saved or sent. If we learn that we've received data from someone under the age limit, we'll delete it.

13. US state privacy notice

This section is for residents of California and other US states with consumer privacy laws, including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and Washington. Health-data laws in Washington, Nevada and Connecticut are covered in our consumer health data notice.

What we collect (last 12 months)

We get this information from you and your device, for the purposes in section 6, and keep it for the periods in section 9. We use service providers only.

We don't sell personal information, and we don't share it for cross-context behavioural advertising, as California law defines those terms. We don't process it for targeted advertising or profiling, and we don't sell or share data from anyone under 16. Because we don't sell or share, there's nothing to opt out of, and the app and site honour Global Privacy Control signals by default because there's no tracking to turn off.

You have the rights described in section 11: to know, access, correct, delete and port your data, and not to be discriminated against for using them. You can also have an authorised agent ask for you; we may ask them for proof that you gave them permission. We'll verify requests using the details described in section 11, such as an Apple order ID, because we don't hold names or accounts.

14. This website

mindvape.app has no cookies, no analytics, no ads and no third-party scripts, and the fonts are hosted on our own site. Like any web host, Firebase Hosting (Google) processes your IP address and browser details to deliver the pages and keep them secure, and may keep short-lived server logs. If you arrive from a link with a campaign tag, the site adds that tag to the App Store link, so Apple's App Store analytics can count downloads per campaign. The site stores nothing about you.

15. Changes and contact

If we change this policy, we'll update the date at the top and keep earlier versions available on request. If a change matters, for example if we started collecting something new, we'll tell you in the app before it applies and, where the law requires it, ask for your consent again.

Questions or requests: hello@thecraftedcode.com · The Crafted Code Ltd, company number 14639993, registered in England and Wales.