Privacy Policy
DRAFT: dashed boxes are placeholders to fill (legal entity, AI provider, server region, mailbox). Remove before publishing.
Summary
- Q-Smoke stores your smoking log, settings, photos and AI chat history — health-related data processed on your consent.
- AI chat sends messages + a data summary to a third-party AI provider; photos and email are not sent.
- No sale of data, no ads, no location. Delete your account in the app. For ages 18+.
1. Who is responsible for your data
Q-Smoke is a personal quit-smoking app (logging each cigarette/session, weekly/monthly reports, an AI assistant) operated by DBR Group ([full legal name, registration no., address — fill in before publishing]) ("DBR", "we"). DBR is the controller and processor of your personal data in the app.
This policy is prepared under: Law on Personal Data Protection No. 91/2025/QH15 (effective 1 January 2026) and Decree 356/2025/ND-CP implementing it (which replaced Decree 13/2023/ND-CP), and Law on Cybersecurity No. 116/2025/QH15 (effective 1 July 2026), and the rules of the Apple App Store and Google Play.
2. Data we collect
We do not collect location, contacts or advertising identifiers; we use no behavioural analytics or advertising.
| Category | Details | Purpose |
|---|---|---|
| Account | Email, password (stored as a hash by the authentication provider), join date; OTP codes sent by email to verify/reset. | Sign-in, account security. |
| Smoking log | Each cigarette: time, reason (text you write), photo (if you attach one); session name you set; days you log as smoke-free. | Journal, reports, trend feedback. |
| Quit settings | Daily goal, pack price, cigarettes per pack, cigarettes per day before quitting. | Compute progress and savings. |
| Photos | Photos you take with the camera or pick from your library to attach to a cigarette (compressed before upload). | Shown back to you. Library photos may carry metadata (e.g. where taken) in the original file. |
| AI assistant chat | Messages you send, chat history, and a summary of your smoking data used as context (see §5). | Encouragement, quit-smoking suggestions. |
A cache and your AI-consent flag are stored on your device.
3. Sensitive data and consent
Smoking habits, reasons for smoking (which may relate to stress or emotions) and quit-smoking conversations are health-related data — sensitive personal data under Vietnamese law. We process it only with your consent (when you create an account and, for the AI assistant, on the consent screen before your first chat), only to provide the features you use, and for no other purpose. You may withdraw consent by no longer using the AI feature or by deleting your account.
4. Purposes
- Provide your journal, reports and quit progress to you alone.
- Sync across devices.
- Send verification/reset emails.
- Operate the AI assistant when you use it.
- Security, abuse prevention and legal compliance.
- We do not sell data and do not use it for advertising.
5. AI assistant and third parties
When you message the AI assistant, the app sends, through our server, to a third-party AI model provider ([AI model provider name — confirm from the chat Edge Function]): up to your 30 most recent messages and a summary of your smoking data (weekly/monthly totals, time-of-day pattern, the reasons you logged, 14-day detail including session names and each cigarette's time, your goal). Your photos and email are not sent. The assistant is a computer program, not a doctor; replies are for encouragement and reference only and may be wrong.
| Party | Role | Data |
|---|---|---|
| Supabase Inc. | Cloud infrastructure: authentication, database, photo storage, server functions; sends OTP emails. | All data in §2. |
| AI model provider ([AI model provider name — confirm from the chat Edge Function]) | Generates the assistant's replies. | Messages + smoking-data summary (no photos, no email). |
| Expo / EAS | App build and distribution tooling. | Does not receive journal content. |
| Apple / Google | App stores, operating system. | Per their policies. |
6. Storage and transfer outside Vietnam
Supabase and the AI provider operate servers outside Vietnam (Supabase: [exact server region — confirm in Supabase dashboard]). Transfers abroad to provide the service are based on your consent and follow the rules on cross-border transfer of personal data (including a transfer impact assessment dossier where required). We require recipients to apply appropriate security under a data-processing agreement.
7. Retention
We keep data until you delete it or delete your account. Deleting a cigarette, a session or the chat removes that record from the database; a photo attached to a deleted cigarette may remain in storage until you delete your account — email us if you want it removed sooner. Infrastructure backups (if any) are overwritten on the provider's cycle [backup cycle — confirm].
8. Your rights, deleting your account and export
Under the Law on Personal Data Protection you have the right to: be informed; consent or refuse (and withdraw consent); access, view and correct your data; obtain a copy; request deletion; request restriction of processing; object to processing; and complain, report, bring a claim and seek compensation as provided by law.
To exercise these rights, write to contact@dbr.business [xác nhận hộp thư]. We acknowledge your request and handle it within the statutory time limits; we may ask you to verify your identity to prevent impersonation. Withdrawing consent does not affect processing already carried out, but some features may stop working.
- Delete account: Account tab (person icon) → "Delete account" at the bottom of the screen (two-step confirmation). We delete all your photos, log, settings, chat history and sign-in account from our systems. The cache on your device is also cleared.
- Copy of your data: there is no export button yet; email contact@dbr.business [xác nhận hộp thư] to receive a copy.
9. Security and breach notification
We use encrypted connections, per-account access control [verify RLS on 3 tables + private bucket, then remove this box], store your session in the device's secure storage, keep photos in a private bucket and serve them via time-limited links. No system is perfectly secure.
If a personal-data breach occurs that may harm your lawful rights and interests, we will notify the competent data protection authority within 72 hours of discovery, take remedial measures, and notify you where the law requires.
10. Age
Q-Smoke is not intended for people under 18. Under Vietnamese law a child is a person under 16 and processing a child's personal data requires the consent of a parent or guardian. If you are a parent/guardian and believe your child has given us data, contact us and we will delete it.
11. EU/EEA/UK users
If you use Q-Smoke from the European Economic Area (EEA) or the United Kingdom, the GDPR / UK GDPR may apply alongside Vietnamese law. Our legal bases are then consent (Art. 6(1)(a)) and performance of a contract (Art. 6(1)(b)); for special-category data (e.g. health) it is explicit consent (Art. 9(2)(a)). You additionally have the right to data portability and to lodge a complaint with your local supervisory authority. For transfers outside the EEA we rely on Standard Contractual Clauses (SCCs) or another valid mechanism offered by the recipient.
12. Changes to this policy
We may update this document when the product or the law changes. Material changes will be announced in the app or by email before they apply; the update date is shown at the top. Continuing to use the service after the effective date means you accept the new version, unless the law requires us to obtain your consent again.
13. Contact
DBR Group ([full legal name, registration no., address — fill in before publishing]) · Email: contact@dbr.business [xác nhận hộp thư]. You may also complain to Vietnam's competent personal data protection authority (under the Ministry of Public Security).