The short version (plain language)
QuitBets exists to help you stop sports betting. To do that, you tell us sensitive things. Here is our deal with you, in one paragraph: we collect the minimum we need, we never sell your data, we never share your health-related information with advertisers or ad platforms, you can use the core app without telling us your name or email, and you can see or delete everything we hold about you with one tap in Settings. The rest of this document is the legally complete version of that paragraph.
1. Who we are
QuitBets is published by S12 Studio, a French société par actions simplifiée unipersonnelle (SASU), registered under SIREN 107 211 898 (RCS Paris), with its registered office at 47 rue Vivienne, 75002 Paris, France (“we”, “us”). We are the data controller for the processing described in this policy.
Contact for all privacy matters: support@quitbets.app
Our supervisory authority is the Commission Nationale de l’Informatique et des Libertés (CNIL), France. You may lodge a complaint with the CNIL (www.cnil.fr) or with your local data protection authority.
2. Scope: this app handles sensitive data, and we treat it that way
QuitBets is a wellness app for people who want to stop sports betting. Information about your relationship with gambling is, in most legal systems, health-related or “special category” data, the most protected category that exists. We do not argue with that classification. We built the app around it. Concretely, this means we ask for your explicit consent before collecting it, we apply elevated security to it, and we never use it for advertising.
3. What we collect (and what we deliberately do not)
3.1 Data we collect
| Data | What it is | When | Where it lives |
|---|---|---|---|
| Onboarding answers | Your responses to the quiz (betting habits, losses, triggers, history). This is sensitive data. | At onboarding, with your explicit consent | On your device |
| Recovery data | Quit date, daily check-ins, streak, your “reasons to quit” text | As you use the app | Same as above |
| Subscription status | Whether you have an active subscription, tier, receipts | On purchase | RevenueCat and Apple/Google. We never see or store your card number. |
3.2 Data we deliberately do not collect
No real name. No precise location (and we never use geofencing). No contacts. No photos. No microphone. No biometrics. No payment card numbers. No advertising identifiers. The app contains no advertising SDKs and no social media tracking pixels (no Meta pixel, no TikTok SDK, no ad networks). This is a design decision, not an accident: data we never collect cannot leak, be subpoenaed, or be misused.
4. Why we process your data (legal bases)
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the core service (plan, streak, money-saved) using your sensitive onboarding data | Your explicit consent (Art. 9(2)(a) GDPR). You can withdraw it at any time in Settings; withdrawal deletes the associated data. |
| Operating your subscription | Performance of a contract (Art. 6(1)(b)) |
| Legal compliance (tax records on subscriptions, responding to lawful requests) | Legal obligation (Art. 6(1)(c)) |
We do not use your data for automated decisions producing legal or similarly significant effects.
5. Who receives your data (sub-processors)
We share data only with the service providers below, only to operate the app, under data processing agreements:
| Provider | Role | Location | Safeguard |
|---|---|---|---|
| Apple / Google Play | App distribution, payments | Global | Their developer terms / DPF |
| RevenueCat | Subscription receipt management | US | DPA + DPF |
| Cloudflare, Inc. (public DNS resolver 1.1.1.1) | Android blocker only: answers your phone’s lookups for websites that are not betting sites, so ordinary pages keep loading. Lookups for blocked betting sites are stopped on your phone and go nowhere. We never receive any of these lookups. | Global | Cloudflare resolver privacy commitments + DPF |
| jsDelivr (content delivery network) | Downloading updates to the public list of betting sites the blocker covers. Like any download, it sees your IP address; no personal data is sent. | Global | Provider’s privacy terms |
We never sell your personal data. We never share your health-related data with advertisers, ad networks, data brokers, or social media platforms. Not for money, not for “analytics,” not at all.
6. International transfers
We are a French company; some providers above process data in the United States. Where data leaves the EU/EEA, we rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses, plus the technical measures described in section 9.
7. Your choices and rights
Available to everyone, regardless of where you live:
- Access / export:Settings → “Export my data” produces a machine-readable file of everything we hold.
- Deletion:Settings → “Delete all my data” erases your data from your device.
- Withdraw consent: deleting your data withdraws consent for sensitive-data processing.
- Notifications: controlled in Settings and at the OS level.
Additional rights under GDPR (EU/UK), including rectification, restriction, objection, and portability: exercise via support@quitbets.app; we respond within one month. Additional rights under US state laws (e.g., California): we honor access/deletion/correction requests and the Global Privacy Control signal; we do not sell or share personal information as defined by the CCPA/CPRA.
8. Consumer Health Data, notice for Washington, Nevada, and Connecticut residents
Your onboarding answers and recovery data are “consumer health data” under the Washington My Health My Data Act and similar laws.
- Collection: we collect the categories listed in section 3.1, for the purposes in section 4, with your consent obtained before collection.
- Sharing: we do not share consumer health data with third parties except the processors in section 5 acting on our instructions. We will never share consumer health data for marketing, and we will never share it with any other category of recipient without first obtaining your separate, specific consent for that sharing.
- Sale: we do not and will not sell consumer health data. (A sale would require your written authorization under Washington law; we will never ask for one.)
- Geofencing: we do not use geofencing of any kind.
- Your rights: you may access, withdraw consent, and delete your consumer health data (Settings, or support@quitbets.app). We will respond within the timelines required by your state’s law. You may appeal a refusal by replying to our decision; appeals are reviewed by the company’s privacy lead.
The standalone version of this notice required by Washington law is published at quitbets.app/legal/consumer-health-privacy.
9. Security
Measures include: encryption in transit (TLS); dependency monitoring. No system is perfectly secure; section 10 is our commitment for the residual case.
10. If something goes wrong (breach notification)
If a breach creates risk to you, we will notify our supervisory authority within the legally required deadlines (72 hours under GDPR) and notify affected users directly and promptly, in plain language, with what happened, what data was involved, and what we are doing about it. We comply with the US FTC Health Breach Notification Rule and applicable state notification laws.
11. Retention
| Data | Kept until |
|---|---|
| Onboarding + recovery data | Until you delete it in Settings or uninstall the app |
| Subscription/tax records | As required by law (up to 10 years, accounting records, held by processors) |
12. Age
QuitBets is for adults. You must be 18 or older. We do not knowingly collect data from anyone under 18; if we learn we have, we delete it and close the account (and refund any subscription).
13. Changes
We will notify you in the app of material changes before they take effect, and the version history is available on request. Continued use after notice means acceptance; for changes affecting sensitive-data processing, we will ask for fresh consent.
14. Contact
S12 Studio, 47 rue Vivienne, 75002 Paris, France, support@quitbets.app
Website notice: quitbets.app and the waitlist
This section covers the website you are reading, which is operated by the same controller (S12 Studio, section 1).
- No cookies. This website sets no cookies and uses no tracking or advertising technologies.
- Waitlist. If you join the waitlist, we store the email address you submit, solely to send you the launch announcement. It is stored on our hosting provider’s infrastructure (Cloudflare), is never shared with marketing platforms, and is deleted after the launch announcement or on request at support@quitbets.app.
- Hosting logs. Our host (Cloudflare, Inc.) processes technical data such as IP addresses to serve the site securely, with short retention.
- Your rights for this processing are the same as in section 7.