Privacy Policy

1. Overview

FreeAir Coach LLC ("FreeAir Coach," "we," "us," or "our") provides an AI-powered smoking cessation wellness application available through web browsers, the Apple App Store, and Google Play. This Privacy Policy describes how we collect, use, share, and protect your information when you use our app, our website at freeaircoach.com, or our subscription services (collectively, the "Service").

By using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Email address, password (stored as a one-way hash), and optional profile information you provide during onboarding.
• Quit Profile: Your quit date, daily cigarette count, primary triggers, and other smoking history information you choose to share.
• Craving Logs: Trigger type, craving intensity, emotional state, location/situation context, outcome (smoked or didn't), and any notes you record.
• AI Coach Conversations: Messages you send to and receive from the FreeAir Coach AI Coach.
• Health and Wellness Information: Smoking history, medications (e.g., nicotine replacement therapy), withdrawal symptoms, and quit goals you choose to share with the AI Coach or enter in your profile.
• Communications: Emails, support requests, and feedback you send to us.

2.2 Information Collected Automatically

• Device Information: Device type, operating system, browser type, screen size, and unique device identifiers.
• Usage Data: Pages viewed, features used, time spent in the app, lessons completed, and engagement patterns.
• Log Data: IP address, access times, and error reports.
• Local Storage: We use browser localStorage and device storage to retain your craving logs, profile, trial progress, preferences, and AI Coach conversation history (cached locally for up to 7 days). See Data Storage for details.

2.3 Information from Third Parties

• Subscription and Purchase Data: Information from Apple, Google, or Stripe confirming a subscription purchase, payment status, renewal, or cancellation.
• Authentication Data: If you sign in via Apple ID, Google, or another identity provider, we receive your email address and a unique identifier from that provider.

3. How We Use Your Information

We use your information to:

• Provide the Service: Deliver smoking cessation coaching, craving tracking, AI conversations, lung recovery timeline calculations, CBT lessons, and progress tracking.
• Personalize Your Experience: Generate personalized AI Coach responses, identify your top craving triggers, recommend coping strategies based on your patterns, and adjust coaching to your readiness stage.
• Process Subscriptions: Manage your subscription status, billing, renewals, cancellations, and (for web subscribers) lifetime access purchases through Apple, Google, or Stripe.
• Communicate with You: Send transactional emails (receipts, password resets, subscription updates), respond to support requests, and — only with your consent — send product updates or educational content.
• Improve the Service: Analyze usage patterns to improve features, fix bugs, and develop new functionality. This analysis is conducted on aggregated, de-identified data wherever possible.
• Ensure Safety and Security: Detect and prevent fraud, abuse, security incidents, and violations of our Terms of Service.
• Comply with Legal Obligations: Respond to lawful requests from public authorities, comply with applicable laws, and enforce our agreements.

We do not use your craving logs, smoking history, AI Coach conversations, or other personal information for advertising, marketing to third parties, or any purpose other than providing and improving the Service.

4. Third-Party AI Processing (Anthropic Claude)

4.1 What Data Is Sent to Anthropic

• Messages you send to the AI Coach (including any health, lifestyle, or smoking-related content you choose to share)
• Anonymized behavioral context (days smoke-free, craving frequency, readiness stage)
• Relevant portions of your craving log entries, when needed to answer your question
• System prompts and grounding documents (CBT, ACT, and Motivational Interviewing reference materials) we send alongside your request

4.2 What Data Is NOT Sent

• Your name, email address, or contact information
• Your password or any authentication credentials
• Your payment information
• Your IP address (Anthropic may receive it as part of standard internet protocol, but we do not transmit it as part of the request payload)
• Craving log entries unrelated to your current question

4.3 How Anthropic Uses This Data

According to Anthropic's published policies for the Claude API:

• Data submitted to the Claude API is not used to train Anthropic's AI models by default for commercial API customers.
• Data is processed solely to generate the response you requested.
• Anthropic retains API request data for a limited period (typically up to 30 days) for abuse monitoring and operational purposes.
• Anthropic's data handling is governed by the Anthropic Privacy Policy and the Anthropic Commercial Terms of Service.

4.4 Your Consent and Control

The first time you use the AI Coach or any AI-powered feature, you will see a consent dialog explaining what data is sent and to whom. You may decline. If you decline:

• The AI Coach will be disabled for your account.
• The rest of FreeAir Coach (craving logging, lung recovery timeline, CBT lessons, relaxation sessions, achievements) will continue to function normally.
• You can change this preference at any time in Settings.

5. Third-Party Services and Data Sharing

We share data with the following service providers, only as needed to operate the Service. We do not sell your data to anyone.

Each of these providers is contractually obligated to handle your data in accordance with applicable privacy laws and to use it only for the purposes described above. We do not authorize any of these providers to sell, rent, or use your data for their own marketing purposes.

5.1 No Advertising or Tracking SDKs

FreeAir Coach does not include any third-party advertising SDKs, analytics tracking pixels, location-tracking services, or behavioral targeting tools. We do not share data with advertisers, data brokers, or marketing platforms.

5.2 Other Disclosures

We may also disclose your information:

• Legal Compliance: If required by law, subpoena, court order, or other legal process.
• Safety: If we believe disclosure is necessary to protect the rights, property, or safety of FreeAir Coach, our users, or the public.
• Business Transfers: In connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case the acquiring entity will be bound by this Privacy Policy or a substantially similar one.
• With Your Consent: Any other disclosure for which you provide explicit consent.

6. Payment Processing

FreeAir Coach does not directly handle or store your full payment card details. Payment processing is handled by:

• Apple App Store for iOS subscriptions (Apple is the merchant of record)
• Google Play for Android subscriptions (Google is the merchant of record)
• Stripe for direct web subscriptions and lifetime purchases (FreeAir Coach LLC is the merchant of record; Stripe processes payments on our behalf)

Each of these processors has its own privacy policy governing how they handle your payment data:

• Apple Privacy Policy
• Google Privacy Policy
• Stripe Privacy Policy

6.1 FSA/HSA Eligibility

Smoking cessation programs are eligible for FSA/HSA reimbursement under IRS Code 213(d). When you submit your FreeAir Coach purchase to your FSA/HSA administrator, we may provide you with a receipt or itemized statement to support reimbursement. We do not directly transmit your FSA/HSA information to your administrator — you handle that submission yourself.

7. Data Storage and Retention

7.1 Where Data Is Stored

• On Your Device (Primary Storage): The vast majority of your personal data — including craving logs, quit profile, trigger patterns, achievements, AI Coach conversation history (cached for 7 days), and feature preferences — is stored locally on your device using browser localStorage or equivalent device storage. We do not operate health data servers that hold this information.
• On Our Servers and Service Providers' Servers: Account credentials, subscription status, support communications, and operational logs are stored on servers operated by Netlify (United States) and Stripe (United States).
• Transient Processing: AI Coach messages are sent to Anthropic's Claude API for processing. We do not retain a server-side copy of these messages beyond the time needed to deliver the response to your device. Anthropic may retain API request data for up to 30 days for abuse monitoring per their terms.

7.2 How Long We Retain Data

• Active Account Data: Retained for as long as your account is active.
• After Account Cancellation: Personal data is retained for 90 days after cancellation to handle billing disputes, support requests, and legal obligations, then deleted unless a longer retention period is required by law.
• Lifetime Subscribers: Account data is retained for the life of the product, with the same deletion-on-request rights as subscription customers.
• Aggregate Analytics: De-identified aggregate data may be retained indefinitely for product improvement.
• Legal Holds: If we are required by law to retain certain information longer (e.g., for tax or regulatory reasons), we will do so only for the period required.

7.3 Local Data on Your Device

Data stored locally on your device persists until you clear your browser storage, uninstall the app, or use the Service's "Delete My Data" option in Settings.

7.4 FTC Health Breach Notification Rule

FreeAir Coach is subject to the FTC Health Breach Notification Rule (16 CFR Part 318). Because most of your health data is stored on your device rather than on our servers, the scope of information that could be breached on our end is significantly limited. In the event of a security incident affecting health information we hold, we will notify affected users and the FTC as required by law.

8. Data Security

We implement reasonable technical and organizational measures designed to protect your information, including:

• HTTPS/TLS encryption for all data transmitted between your device and our servers
• Encryption at rest for data stored in our service providers' databases
• Hashed (one-way encrypted) password storage
• API key restrictions limiting access to authorized FreeAir Coach services only
• Local-first architecture that minimizes the volume of personal data on our servers
• Regular security reviews and dependency updates
• Access controls limiting employee and contractor access to personal data on a need-to-know basis

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security. If you suspect your account has been compromised, please contact us immediately at admin@freeaircoach.com.

9. Your Privacy Rights

Regardless of where you live, you have the following rights with respect to your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate or incomplete information.
• Deletion: Request that we delete your personal information, subject to certain exceptions (e.g., legal retention requirements).
• Portability: Request a machine-readable copy of your data.
• Withdraw Consent: Where we rely on your consent, withdraw it at any time.
• Object to Processing: Object to our processing of your data for specific purposes.

To exercise any of these rights, email us at admin@freeaircoach.com with the subject line "Privacy Request." We will respond within 30 days. We may need to verify your identity before fulfilling certain requests.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: What categories of personal information we collect, the sources, the purposes, and the third parties with whom we share it.
• Right to Delete: Request deletion of your personal information.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Limit Use of Sensitive Personal Information: Limit our use of certain categories of sensitive personal information.
• Right to Opt-Out of Sale or Sharing: FreeAir Coach does not sell your personal information and does not share it for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To exercise these rights, contact us at admin@freeaircoach.com.

11. Washington Health Data Rights (MHMDA)

If you are a Washington State resident, you have additional rights under the Washington My Health My Data Act (MHMDA):

• Right to Confirm: Confirm whether we are collecting, sharing, or selling your consumer health data.
• Right to Access: Access a list of all third parties with whom we have shared or sold your consumer health data.
• Right to Withdraw Consent: Withdraw consent for the collection and sharing of your consumer health data.
• Right to Delete: Request deletion of your consumer health data.
• Right to Withdraw Consent: Withdraw consent for the collection and sharing of your consumer health data.
• Right to Delete: Request deletion of your consumer health data.

FreeAir Coach does not sell consumer health data. To exercise MHMDA rights, contact us at admin@freeaircoach.com. Similar protections apply to Maryland residents under the Maryland Online Data Privacy Act (MODPA), Connecticut residents, and residents of other U.S. states with comprehensive privacy laws.

12. European Privacy Rights (GDPR/UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR) or UK GDPR:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure / "right to be forgotten" (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)
• Right to lodge a complaint with a supervisory authority

12.1 Legal Bases for Processing

We process your personal data on the following legal bases:

• Performance of a Contract (Article 6(1)(b)): To deliver the subscription Service you requested.
• Consent (Article 6(1)(a)): For optional features (e.g., AI Coach with Claude processing) and marketing communications.
• Legitimate Interests (Article 6(1)(f)): For security, fraud prevention, and product improvement, balanced against your rights.
• Legal Obligation (Article 6(1)(c)): For tax, accounting, and regulatory compliance.

For data concerning health (smoking cessation, craving patterns), we rely on your explicit consent under Article 9(2)(a) GDPR.

12.2 Data Controller

FreeAir Coach LLC is the Data Controller of your personal information. Contact: admin@freeaircoach.com.

13. Children's Privacy

FreeAir Coach is intended for adults age 18 and older. We do not knowingly collect personal information from individuals under 18. If you are under 18, please do not use the Service or provide any information to us.

If we become aware that we have collected personal information from a person under 18 without verified parental consent, we will delete that information promptly. If you are a parent or guardian and believe your child has provided us with information, contact us at admin@freeaircoach.com.

14. International Data Transfers

FreeAir Coach is based in the United States, and our service providers (Apple, Google, Stripe, Anthropic, Netlify) primarily operate from the United States. If you are located outside the United States, your personal information will be transferred to and processed in the United States, where data protection laws may differ from those of your country.

For transfers from the European Economic Area, United Kingdom, or Switzerland, we rely on Standard Contractual Clauses approved by the European Commission, supplementary safeguards where required, and the recipient's compliance with applicable data protection frameworks.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will:

• Update the "Last Updated" date at the top of this page
• For material changes, notify you by email or through a prominent notice in the Service before the changes take effect
• For changes that expand our use of your personal information beyond what was previously disclosed, obtain your consent where required by law

Your continued use of the Service after the updated Privacy Policy takes effect constitutes your acceptance of the changes.

16. Contact Us

For privacy questions, requests, or to exercise your rights under this Privacy Policy:

FreeAir Coach™ is a trademark of FreeAir Coach LLC, a Virginia limited liability company. FreeAir Coach provides educational smoking cessation content and is not a substitute for professional medical advice, diagnosis, or treatment.