PRIVACY POLICY

1. WHO WE ARE

HitList ("we," "us," or "our") is a nicotine tracking application operated as a personal data tracking tool for adults 18 and older. HitList is accessible at app.hitlistnicotine.com and hitlistnicotine.com.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application and website. Please read this policy carefully. If you disagree with its terms, please discontinue use of the application.

For questions about this policy, contact us at: privacy@hitlistnicotine.com

2. NOT A MEDICAL DEVICE

HitList is a personal data tracking tool. It is not a medical device, does not provide medical advice, and is not a substitute for professional medical care, addiction treatment, or healthcare of any kind. Nothing in this application or on this website constitutes medical advice.

If you have concerns about nicotine dependence or your health, please consult a qualified healthcare professional. By using HitList, you acknowledge that you are using it as a personal tracking tool only and that all decisions regarding your nicotine use are your own.

3. INFORMATION WE COLLECT

Information you provide directly:

• Email address (used for account creation and authentication)
• Username (chosen by you, displayed within the app)
• Nicotine usage logs (time, product type, brand name, MG strength — entered by you)
• App settings and preferences (daily goals, timer settings, bedtime)
• Ghost Mode plan data (baseline usage, taper plan selections)
• Operator Mode settings (protocol preference, bedtime)
• Post-use survey responses (optional, Operator Mode only)
• Group and event memberships and participation data

Information collected automatically:

• IP address (collected by our infrastructure provider, Supabase)
• Device type and browser information
• Timestamps of account activity
• Authentication tokens and session data

Information from third parties:

• If you sign in with Google, we receive your email address and Google account identifier from Google. We do not receive your Google password or any other Google account data.

Information we do NOT collect:

• Your real name (unless you choose to use it as your username)
• Your physical location or GPS data
• Your payment information (handled entirely by Stripe — we never see your card details)
• Health records or medical information
• Contacts or address book data
• Photos or camera data

4. HOW WE USE YOUR INFORMATION

We use the information we collect to:

• Create and manage your account
• Provide the core tracking functionality of the application
• Calculate and display your personal usage statistics and trends
• Generate your Ghost Mode taper plan based on your baseline data
• Power Groups and Events features, including leaderboards visible to other group/event members
• Send transactional emails (account confirmation, password reset)
• Send push notifications if you have enabled them
• Process subscription payments via Stripe
• Improve the application through analysis of aggregated, anonymized usage patterns
• Generate anonymized aggregate insights for potential business partnerships (see Section 7)

5. HOW WE SHARE YOUR INFORMATION

We do not sell your personal data. We do not share your individual usage data, email address, or any personally identifiable information with third parties for marketing purposes.

We share data in the following limited circumstances:

• Within the app: Your username and usage statistics are visible to other members of Groups and Events you join. You control which groups and events you join.
• Service providers: We use Supabase (database and authentication), Stripe (payment processing), and Vercel (hosting). These providers process data on our behalf under their own privacy policies and data processing agreements.
• Legal requirements: We may disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of HitList, our users, or the public.
• Business transfer: If HitList is acquired or merges with another company, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

6. DATA VISIBLE TO OTHER USERS

When you join a Group or Event, the following information becomes visible to other members of that Group or Event:

• Your username
• Your usage count and MG totals for the period since you joined that group or event
• Your ranking on the leaderboard

Your email address, individual log timestamps, survey responses, Ghost Mode plan details, and Operator Mode settings are never visible to other users.

You can leave any Group or Event at any time, which removes your data from that group's or event's leaderboard going forward.

7. ANONYMIZED AND AGGREGATE DATA

We may use anonymized, aggregated data — data that cannot be traced back to any individual user — for business purposes including:

• Understanding general usage patterns to improve the application
• Sharing category-level insights with nicotine brand partners (for example: "X% of users in this dataset use 6mg pouches" — with no individual identifiers)
• Publishing general statistics about nicotine usage patterns

This aggregate data contains no usernames, email addresses, individual log entries, or any other information that could identify you personally. Our Terms of Service and this Privacy Policy disclose this use. By using HitList, you consent to the use of your anonymized data in this way.

8. DATA RETENTION

We retain your data for as long as your account is active. If you delete your account, we will delete all personally identifiable data associated with your account within 30 days, except where we are required to retain it for legal purposes.

Anonymized aggregate data derived from your usage may be retained indefinitely as it cannot be used to identify you.

9. YOUR RIGHTS AND CHOICES

You have the following rights regarding your data:

• Access: You can view all your usage data within the app at any time.
• Correction: You can update your username and settings within the app at any time.
• Deletion: You can delete your account and all associated data from within the app settings. All personal data will be deleted within 30 days.
• Export: You can request a copy of your personal data by contacting us at privacy@hitlistnicotine.com. We will provide it in a machine-readable format within 30 days.
• Opt-out of notifications: You can disable push notifications at any time within the app settings or your device settings.

If you are a resident of the European Union, you may have additional rights under the General Data Protection Regulation (GDPR), including the right to data portability and the right to lodge a complaint with your local supervisory authority. Contact us at privacy@hitlistnicotine.com to exercise these rights.

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA). We do not sell personal information as defined under CCPA. Contact us at privacy@hitlistnicotine.com for more information.

10. DATA SECURITY

We use industry-standard security measures to protect your data, including:

• Encrypted data transmission (HTTPS/TLS) for all data in transit
• Row-level security in our database, ensuring users can only access their own data
• Authentication tokens with automatic expiry and refresh
• Third-party infrastructure providers (Supabase, Vercel) with their own security certifications

No method of transmission over the internet or method of electronic storage is 100% secure. While we use commercially reasonable security measures, we cannot guarantee absolute security. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

11. CHILDREN'S PRIVACY

HitList is intended for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@hitlistnicotine.com. If we discover that we have collected personal information from a minor, we will delete it immediately.

12. THIRD-PARTY SERVICES

HitList uses the following third-party services that have access to certain user data:

• Supabase — database, authentication, and storage. Supabase Privacy Policy
• Stripe — payment processing. Stripe handles all payment data and we never have access to your full card details. Stripe Privacy Policy
• Vercel — hosting and content delivery. Vercel Privacy Policy
• Google — optional sign-in via Google OAuth. Google Privacy Policy
• OneSignal — push notifications (if enabled). OneSignal Privacy Policy

13. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the "Last updated" date at the top of this page and, for significant changes, by sending a notification through the app or via email. Your continued use of HitList after any changes constitutes your acceptance of the updated policy.

14. CONTACT US

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

privacy@hitlistnicotine.com

We will respond to all requests within 30 days.