Privacy Policy
Data controller / Data Fiduciary: Aiovent Solutions UG (haftungsbeschränkt), Scholppenäcker 4/1, 71642 Ludwigsburg, Germany. Managing Director: Himanshu Kalubhai Kevadiya. Amtsgericht Stuttgart, HRB 800332. Full provider details: Impressum.
Contact for privacy questions and data-subject requests: hello@aiovent.com
1. Who we are and what this covers
MavaFree ("the app", "we", "us") is an app that supports people who want to stop using mava and other smokeless tobacco. It is operated by Aiovent Solutions UG (haftungsbeschränkt). This policy explains what personal data we process when you use the app, why, on what legal basis, how long we keep it, and the rights you have. It applies to both user roles: the Quitter ("I'm quitting") and the Supporter ("I'm supporting someone") — the one person a Quitter invites to support them (see §4). Some screens call the Supporter an Observer.
Some features described here — signing in with Google or Apple (§2), personal AI messages (§5) and the paid 90-day program (§10) — are not offered in every version of the app. Where a version does not offer a feature, none of the processing described for it takes place.
2. Data we process
| Category | Examples | Role |
|---|---|---|
| Account data | Email address; display name (the name you choose yourself and can change in Settings — the only name the person you link with sees); chosen role; sign-up date; authentication identifiers; the settings you choose, such as notification preferences | Both |
| Consent records | Timestamps and version of the terms, privacy and health-data consent you gave, your age confirmation, and the language the consent screen was shown in; whether you agreed to AI-written messages (§5) and to usage statistics; if you invite a Supporter, when you agreed to share with them (the time your invite code was created) | Both |
| Health-behavior data (special category) | Mava use you log (what you chewed and when), craving levels (1–10), mood, requests for support, notes you attach to a craving, journal entries, daily check-ins, streaks, relapse events | Quitter |
| Plan & progress data | Your 90-day plan and daily schedule, how closely you followed it, reward-meter score, badges | Quitter |
| Ready check | The date and time you signed your promise at the end of the Ready check, kept in your profile and in a separate record your Supporter can read (§4). Your answers stay on your phone (see below) | Quitter |
| Purchase data (only where the app sells a 90-day program) | The store's transaction ID, the product, which of your programs it is (first, second or third), the platform (App Store or Google Play) and the purchase date, each confirmed with Apple or Google (§10). Never your card or other payment details | Quitter |
| Messages | Motivational messages shown to you — from the app's built-in library or, only if you agreed, written by AI (§5); the pre-written messages you and your Supporter send each other, stored as a reference to the chosen message, never as typed text | Both |
| Link data | Your Quitter ↔ Supporter link: invite code, status, when it was created and claimed, both account IDs and — while the link is active — both display names, when the Supporter last looked at your progress, and when they last got a reminder to get in touch | Both |
| Alert data | Craving alerts raised for your linked Supporter: the craving level that triggered each one, whether it was urgent or a request for support, when it was raised, and when your Supporter acknowledged it | Both |
| Safety data | Reports you send us (the reason you chose and what you reported), reports of AI-written messages, and the people you have blocked | Both |
| Device / technical data | Time zone, app version, the IP address your phone connects from (which our servers and providers receive with each request), crash diagnostics (§5), and — only if you are a Supporter and allow notifications — a push notification token | Both |
| Product-usage events (only if you opt in) | Which screens are opened and which features are used, with coarse bands instead of exact values (§5) | Both |
We do not process payment card data, we do not use advertising identifiers, and we do not serve ads. We do not ask for your phone number. Your health-behavior data is never used for advertising, and we never sell your personal data.
Special-category (health) data
Craving, mood, mava-use and relapse data reveal information about your health. We treat it as special-category data under GDPR Article 9 and as personal data requiring your consent under India's Digital Personal Data Protection Act, 2023 (DPDP). We process it only with your explicit consent, given on the consent screen at registration. Showing it to a Supporter needs a second, separate consent, given on the invite screen (§4). Sending some of it to Anthropic for AI-written messages needs a third, optional consent (§5).
Signing in with Google or Apple
Instead of an email address and a password, you can sign in with Google or Apple. Google or Apple confirms who you are and gives the app a sign-in token, from which Firebase Authentication (§5) creates your account. From Google or Apple we receive your email address (with Apple's Hide My Email, only a private relay address), your name if your account shares it, an identifier for your Google or Apple account so that your next sign-in opens the same account, and — from Google — a link to your profile picture. Firebase Authentication may keep the name and picture link with your sign-in details, but the app never shows them to anyone and never uses them as your display name. We never see your Google or Apple password, and signing in shares nothing with Google or Apple beyond what the sign-in requires. The legal basis is the same as for any account: contract (Art. 6(1)(b)). To delete an account that has no password, you confirm by signing in with Google or Apple once more; your Google or Apple account itself is not affected.
The Ready check
If you are a Quitter, the app asks you a few short questions before your plan starts and you then sign a short promise to yourself. Your answers stay on your phone: the reasons you choose, anything you write in your own words, your money goal, the first name you give for the person who has your back and the name you type to sign are kept only in the app's storage on your phone and are used only to show them back to you. They are never sent to our database, our backend server, Anthropic or your Supporter, so we cannot show them to anyone or restore them. Deleting your account in the app or uninstalling it erases them from that phone; your phone's own backup (such as an iCloud or Google backup) may include them, and we have no access to it.
On our server we store only when you signed: the date and time, once in your profile and once in a separate record that holds nothing else and that your Supporter can read while your link is active. If you tap "Remind me in 2 weeks", the reminder is scheduled on your phone itself and does not pass through any server.
3. Why we process it, and our legal basis
| Purpose | Legal basis (GDPR / DPDP) |
|---|---|
| Provide core features (the Ready check, logging, plan, rewards, messages, CBT tools, the Supporter link) | Contract (Art. 6(1)(b)) |
| Process health-behavior data to build and adapt your plan and the messages you see | Explicit consent (Art. 9(2)(a)) · DPDP consent |
| Send the data described in §5 to Anthropic so that it writes personal AI messages | Separate explicit consent, optional and unticked by default (Art. 6(1)(a), 9(2)(a)) · DPDP consent. You can withdraw it at any time in Settings |
| Share your display name, logs, progress, rewards, messages and the date of your promise with the Supporter you invite, and send them craving alerts (§4) | Your explicit consent, given on the invite screen when you tap "Agree & create my code" (Art. 6(1)(a), 9(2)(a)). You withdraw it by ending the link |
| Sell a 90-day program where the app offers one: confirm each purchase with Apple or Google, record it with your account, and apply the limit of three programs per account (§10) | Contract (Art. 6(1)(b)) |
| Send the push notifications you enabled | Consent (Art. 6(1)(a)) |
| Product analytics, only if you opt in | Consent (Art. 6(1)(a)) — separate, optional, and refusing it changes nothing about the app |
| Review reports and enforce blocks | Legitimate interests (Art. 6(1)(f)) in keeping the app safe for the people who use it |
| Security, abuse prevention, crash diagnostics, including the IP address your phone connects from and our server logs | Legitimate interests (Art. 6(1)(f)) |
| Keep a used-marker of each store transaction after your account is deleted, so the same purchase cannot start a program again (§8) | Legitimate interests (Art. 6(1)(f)) in preventing fraud |
| Comply with legal obligations, such as keeping accounting records | Legal obligation (Art. 6(1)(c)) |
We do not train models on your data. Your logs, journal entries and notes are not used to train or improve any machine-learning model, ours or anyone else's, and Anthropic does not use the requests described in §5 to train its models. If we ever want to use your data for this, we will ask you first, separately, and you will be able to say no and keep using the app.
You can withdraw consent at any time (see §7); withdrawal does not affect processing already carried out before you withdrew.
4. The Supporter — data sharing you control
A Quitter can link one Supporter at a time — a partner, friend or family member they trust. Nothing is shared without your consent. Before your invite code is created, the app lists what your Supporter will and will never see, and you agree by tapping "Agree & create my code". The time your code is created is our record of that consent. Sharing begins only when your Supporter enters the code, and you can withdraw your consent at any time by ending the link.
What your Supporter can see while the link is active:
- Your display name.
- Your logs — cravings with their level, what you chewed and your check-ins, including the optional mood — with the date and time of each. Their app shows only the entries from after they joined you, but the access you grant covers your earlier entries as well. Each entry also carries technical details the app stores with it, such as its time zone and that day's plan limit and schedule; your Supporter's app does not display these, but they are part of the entries it can read.
- Your progress, streaks, reward meter and badges.
- The date you signed your promise in the Ready check — never your reasons, your money goal, the names you typed or your other answers.
- The pre-written messages you send each other.
- An alert when a craving runs high or when you ask for support (see below).
What your Supporter never sees: your email address; your real name, unless you use it as your display name; any note you attach to a craving (stored separately, where no other user can read it); your journal; your plan itself and the settings in your profile; your consent record; your push token.
What a Supporter cannot do: change or delete your data, or stop you from ending the link.
If you are a Supporter, the person you support sees your display name, the messages you send each other, whether an alert was sent to you and, when you tap "Let … know I saw it", the time you tapped it. While the link is active it also records when you last looked at their progress; they see that time, but not what you looked at. Your email address, push token and settings stay in your own profile, which no other user can read. You only see data for a Quitter who has linked you, and only while that link lasts.
Messages
Neither of you can type a message to the other. Your Supporter taps one of a set of pre-written encouragements, and you can tap one of a set of pre-written updates back. Only a reference to the chosen message is stored, and each phone shows it in its own language. A new Supporter never sees the messages you exchanged with an earlier one.
Craving alerts
Your Supporter is alerted about a craving in these situations, and no others:
- Automatically, when your craving is 7 or higher — at 9 or 10 the alert is marked urgent.
- When your craving is 5 or 6 and you explicitly agree when the app asks whether your Supporter should know. If you do not answer, nothing is sent.
- When you tap "Tell my supporter" on the emergency screen.
Cravings of 1 to 4 never generate an alert, although they still appear in the logs your Supporter can see. Non-urgent alerts are limited to one every two hours; urgent alerts are never held back. Alerts reach your Supporter as push notifications (§5). A notification names you only by your display name and never contains your craving level. A Supporter can turn these notifications off in Settings; the alert is then still recorded and shown in their app.
Ending, blocking and reporting
Either of you can end the link at any time from Settings. As soon as a link ends, our server cuts off the other person's access, removes both display names from the link and deletes that link's alerts. Either of you can also block the other: this ends the link and stops that person joining you again with a new invite code, and neither of you is told when the other blocks. If a message or a person is abusive, you can report it from inside the app; a report tells us the reason you chose and what it concerns, nothing else from your account. You can also report an AI-written message you think is wrong or harmful. Questions about a report or a block can go to hello@aiovent.com at any time.
5. Who else processes your data (sub-processors)
The providers below process data on our instructions so the service can run, each under its own data-processing terms, which we have accepted as their customer. Anthropic and PostHog receive data only if you agree.
- Google Firebase / Google Cloud — authentication, the Firestore database, our
server functions, and Firebase Hosting, which serves this website and the small file the app reads
to check whether a newer version exists (that request carries no account information).
Everything in our database — your profile, logs, notes, plans, journal, messages,
links, alerts, reports and blocks — is stored in India (Firestore region
asia-south1, Mumbai), and our server functions run there too. Your sign-in record — email address, name or display name, account ID, and either a hashed password or the Google or Apple details listed in §2 — is handled by Firebase Authentication, which Google runs in the United States. - Our backend server — run for us on Google Cloud Run in India
(region
asia-south1, Mumbai), with Google as our processor. Where your version of the app uses it, it checks the cravings you log for an alert to your Supporter, adapts your plan and, only if you agreed, requests the AI-written messages described below. For each craving, the app sends it the entry you logged — never the note you attached to it — together with your account ID, time zone, link ID and the language you use the app in. It reads from our database what these tasks need and writes alerts and messages back to it. Where your version does not use it, the app and our server functions do the same work without it. - Expo (push delivery) → Apple APNs / Google FCM — delivers push notifications to Supporters who allow notifications: craving alerts, the Quitter's pre-written updates, milestone notes and an occasional reminder to get in touch. Expo receives the Supporter's push token and the notification's title and text — which name the Quitter only by display name and never contain a craving level — and passes it to Apple's or Google's push service. A Quitter's own reminders are scheduled on the phone and do not pass through Expo or any other server.
- Anthropic (Claude API), USA — writes personal AI messages, only if you agree: an optional checkbox on the consent screen, unticked by default, that names Anthropic, which you can switch on or off at any time in Settings → Privacy & data. If you do not agree, or switch it off, nothing about you is sent to Anthropic and your messages come from the app's built-in library. With your consent, after you log a craving our server asks Anthropic for a short encouragement, at most five times a day; beyond that, or when our server or Anthropic cannot be reached, your message comes from the library. Each request contains only your craving level, mood, a coarse time of day, today's plan target, the type, craving level and mood of up to five recent entries, and your app language — no name, no email, no account identifier, and none of your craving notes or journal entries. During a 90-day program (§10), the weekly progress message and similar program messages send Anthropic only a few numbers, such as the day of your plan and the cravings you rode out, and the language to write in. Every AI-written message is marked in the app as written by AI; it is encouragement, not medical advice. Anthropic processes these requests under its Commercial Terms of Service and data processing addendum and does not use them to train its models.
- PostHog (EU) — optional product analytics, off unless you opt in on the consent screen or in Settings. It uses a random identifier stored on your phone that is not linked to your account, your name or your email — so the statistics are pseudonymous, not anonymous. Geolocation lookup is disabled. Health-related information is included only as coarse bands and yes/no values, such as your usual daily amount (in three bands), whether a day was under, on or over its target, how far into your plan you are, and whether you were mava-free at a milestone. It never receives notes, messages, journal entries, your Ready-check answers, your email or your account ID.
- Sentry (only where the build ships with crash reporting enabled) — crash and diagnostic data, to help us fix faults, with no account identity attached.
Alerts are never sent by WhatsApp, SMS or email: we do not use Twilio or any other messaging service. We do not sell your personal data, and we share it with no one other than the person you link with (§4), the providers listed above, and — only as far as needed — Google or Apple when you sign in with them (§2) or buy a program (§10).
6. International transfers
We are established in Germany; everything in our database is stored in India, and our server functions and backend server run there too. Your sign-in record is processed by Google in the United States. Expo, Anthropic and Sentry are based in the United States (Anthropic receives data only if you agreed to AI messages), PostHog stores statistics in its EU cloud, and push notifications are delivered through Apple's and Google's push services. Where personal data moves between the EU/EEA and a country without an EU adequacy decision — including India and the United States — the transfer is covered by the EU Standard Contractual Clauses in the relevant provider's data processing terms and, where a provider is certified, the EU–U.S. Data Privacy Framework, together with additional measures — most importantly the minimization and pseudonymization described in §5. You can ask us for details of the safeguard applying to a specific provider at hello@aiovent.com.
7. Your rights
You have the right to access, rectification, erasure, restriction, portability, to object, and to withdraw consent. Under the DPDP Act you may also nominate another person to exercise your rights in the event of your death or incapacity — write to us and we will record it. Most rights are self-service in the app:
- Export your data: Settings → Privacy & data → Export my data, as a single JSON file.
- Delete your account and all associated data: Settings → Privacy & data → Delete my account, confirmed by typing DELETE and re-entering your password — or, for an account that signs in with Google or Apple, by signing in with it once more. What is erased is listed in §8.
- End sharing with your Supporter: end the link in Settings. This withdraws your consent to share (§4).
- Withdraw your consent to AI messages: switch AI messages off in Settings → Privacy & data. From then on nothing about you is sent to Anthropic, and everything else keeps working.
- Turn off analytics: the "Share usage statistics" switch in Settings → Privacy & data.
- Withdraw your health-data consent: the app cannot work without it, so you withdraw it by deleting your account, or by writing to us and we delete your account and data.
You can also exercise any of these rights by writing to hello@aiovent.com, even if you have uninstalled the app; we respond within one month. If you think we have got something wrong, you can complain to a supervisory authority — for us that is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, or the authority where you live. If you are in India, you may raise a grievance with our grievance officer (§14) and, if unsatisfied, with the Data Protection Board of India.
8. Retention
- Your logs, craving notes, plan, journal, messages and rewards are kept for as long as your account exists, so that your history, streak and progress remain yours. They are deleted when you delete your account.
- Archive: the app's backend is able to move logs older than 90 days out of the live database into a separate archive. We do not operate that archive today. If we ever turn it on, we will update this policy and tell you in the app before it starts; craving notes would never be archived, and deleting your account would erase archived data too.
- Ready check: the date and time you signed your promise are kept while your account exists; your Supporter loses access to it as soon as your link ends. Your answers stay on your phone (§2).
- AI usage counter: when you use AI messages, our server keeps a small record that no app can read: the times of your recent AI messages (the last 24 hours, or 7 days for weekly messages) and the program dates it needs to enforce the limits. It holds no message text, no craving levels and no notes, and it is deleted with your account.
- Purchase records: kept while your account exists. When you delete your account we keep only a marker that the store transaction was used, with no account ID and nothing else about you, so the same purchase cannot start a program on another account. Apple and Google keep their own records under their terms.
- Links: the record of a link is kept until either of you deletes your account; display names are removed from it as soon as the link ends. Alerts are deleted as soon as the link ends or either of you deletes your account.
- Reports of a person or a message are kept as a record of the complaint, even if the account that sent it is later deleted. Reports of AI-written messages are deleted with the account that filed them. Blocks are kept until the person who blocked deletes their account; a block that names you is also removed when you delete yours.
- Push token: kept on a Supporter's profile until a new token replaces it or the account is deleted.
- Account and consent records are kept while your account exists, and afterwards only as long as needed to evidence that consent was given.
- Usage statistics and crash reports (only where switched on) are not linked to your account, so deleting your account does not delete them; they are kept by PostHog and Sentry under the retention settings of our account there.
- Server logs (which can contain your IP address and account ID) are deleted after 30 days.
- On account deletion we erase your profile, logs, craving notes, plans, messages, rewards, journal and promise date, your links and every alert that concerns you, the blocks naming you, your reports of AI-written messages, your AI usage counter, the link between you and your purchase records, and finally your sign-in account — subject only to the items above, to copies in Google's own disaster-recovery systems until they expire, and to records we are legally required to keep.
9. Security
Data is encrypted in transit (HTTPS/TLS) and at rest. Access to the database is controlled by deny-by-default security rules: a Supporter can read a Quitter's logs, progress, alerts, the date of their promise and the messages of their own link only while that link is active. No other user can ever read your profile, plan, journal or craving notes. Server endpoints require a verified authentication token. You can add a device lock (PIN or biometric) in Settings so that someone holding your unlocked phone still cannot open the app.
10. Payments
Where the app offers it, a 90-day program is a one-time in-app purchase in the App Store or Google Play. It is not a subscription and never renews, and you can buy at most three programs per account. Supporters never pay. Prices are shown in the store before you buy.
Apple or Google processes your payment, refunds and receipts as an independent controller under its own terms and privacy policy. We never receive or process your card or payment details. From the store we receive only the purchase data listed in §2. Our server functions check each purchase with Apple or Google before your program starts, record it with your account, and refuse a purchase that is not confirmed, has been refunded or is already recorded for another account. The legal basis is our contract with you (Art. 6(1)(b)); the used-marker kept after you delete your account rests on our legitimate interest in preventing fraud (Art. 6(1)(f), §8).
11. Children
MavaFree is not intended for children. The service supports quitting a tobacco product and is for adults aged 18 or over only. You confirm your age on the consent screen, and we store only that confirmation and its date — never a date of birth. We do not knowingly collect data from children, and if we learn that we have, we delete it.
12. Not medical advice
MavaFree provides motivational and behavioral support. It does not provide medical advice, is not a medical device, and does not diagnose, treat, cure or prevent any condition. AI-written messages are encouragement, not advice. We do not routinely read what you write in the app — we review only what a user reports to us — so nobody is watching for a crisis on your behalf, and the app is not a crisis service. In an emergency in India, call 112, or Tele-MANAS on 14416 / 1-800-891-4416. See the in-app medical disclaimer and the Terms of Service.
13. Changes to this policy
We may update this policy. Material changes will be notified in the app, and where a change affects processing that rests on your consent, we will ask for your consent again. The "Last updated" date at the top reflects the current version.
14. Contact and grievance officer
Aiovent Solutions UG (haftungsbeschränkt), Scholppenäcker 4/1, 71642 Ludwigsburg, Germany · hello@aiovent.com · Impressum
Grievance officer under the DPDP Act, 2023: Himanshu Kalubhai Kevadiya, reachable at hello@aiovent.com. We aim to acknowledge a grievance within 72 hours and to resolve it within 7 days. We have not appointed a Data Protection Officer; privacy requests go to the same address.