Tapr

Smoke less, your way

Privacy Policy

Last updated: April 30, 2026

This Privacy Policy describes how the Tapr mobile application ("Tapr", "the app", "we") handles information when you use it. Tapr is published by Zoran Gojković, an independent developer based in Lazarevac, Serbia, operating under the Fenix label.

1. Who is the data controller

The data controller for the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR is Zoran Gojković, Lazarevac, Serbia. For any privacy matter, contact us at fenixjzdev@gmail.com.

2. Legal basis and special-category note

Tapr handles smoking-related habit data. Under GDPR Article 9, behavioural-health information can be considered a special category of personal data. We address this by:

• Keeping all individual log entries on your device only — they never leave your phone in readable form;
• Encrypting Cloud Sync payloads end-to-end with a key derived from your purchase token, so the server stores ciphertext that we cannot decrypt;
• Stripping any individual data points from AI Insights requests before sending them off-device — only anonymous histograms (counts per hour-of-day, counts per weekday, total cigarettes, etc.) are transmitted, with no timestamps, no GPS coordinates, and no identifiers in the payload;
• Relying on your explicit consent (Article 6(1)(a) and Article 9(2)(a)) — given when you accept the onboarding terms and again when you enable each individual Pro feature — as the legal basis for any data processing that does take place.

3. What information Tapr handles

Tapr divides information into five categories.

3.1. Local-only data (free and Pro)

The following stays on your device and is never transmitted to us:

• Your cigarette log entries (timestamp, optional location coordinates, automatic local tag — see §3.2)
• Your craving sessions (start time, outcome — held out / gave in)
• Your taper plan (start date, daily allowance per week, target end date)
• Your money goal (cigarettes-per-pack, price-per-pack, savings target, currency)
• App preferences (language, daily-reminder time, notification choices, notification permission state)
• Onboarding-completion flag

This data is stored in the app's private SQLite database and SharedPreferences, which other apps on your device cannot access.

3.2. On-device automatic tagging

For the Stats screen pie chart and the auto-classification feature, Tapr applies a small local heuristic that classifies each cigarette into one of seven categories — morning, coffee, post-meal, work break, evening / social, stress, or other — based purely on the time-of-day and day-of-week of the log entry, plus whether you logged a "gave in" craving session in the same minute. This runs entirely on your device. No data leaves your phone for this feature.

3.3. Location data (optional, on-device)

If you grant the location permission, Tapr tags each cigarette log with the GPS coordinates of where you smoked. This is used to spot patterns ("you smoke most often near your office at 17:00") and to power the Pro Risk Zones feature. Coordinates are stored only in the local cigarette log table.

You can revoke the location permission at any time in your phone's system Settings, and Tapr will continue to work with location-tagging disabled. We never receive raw coordinates of individual log entries.

3.4. Pro Cloud Sync data (Pro users only)

If you enable Cloud Sync, your cigarette log entries, craving sessions and Risk Zone definitions are encrypted on your device using AES-256-GCM with a key derived from your Google Play purchase token. The encrypted blobs are then transmitted to our server, which stores the ciphertext but cannot read its contents. The encrypted blobs are kept so that:

• You can sign in on a second device with the same Google account and restore your history;
• You can recover your data after reinstalling the app.

Your purchase token is the only identifier we use to address your encrypted data on the server — there is no email address, no Tapr account, no password. You can disable Cloud Sync at any time from More → Cloud Sync. To request deletion of all server-side encrypted blobs, email us; we will erase them within 30 days.

3.5. Pro Risk Zones (Pro users only)

Risk Zones are circular geofences (50–1000 metre radius) that you create around places where you typically smoke. The geofence centre coordinates and your zone names ("Office", "Coffee shop") are stored on your device, and — if Cloud Sync is enabled — also as encrypted blobs on our server. The server cannot read the zone name or the coordinates. The geofence detection itself runs on your device through Google Play Services Location.

3.6. Pro AI Insights (Pro users only)

If you use the AI Insights feature, the app builds an anonymous summary of the past 30 days of your activity and uploads it to our server, which then forwards it to OpenAI for analysis. The summary contains only:

• Total cigarettes logged across the period;
• A 24-bucket histogram of cigarettes by hour-of-day;
• A 7-bucket histogram of cigarettes by day-of-week;
• Counts of cigarettes per local trigger category (the seven buckets from §3.2);
• Daily totals for the past 30 days as a numeric series;
• Total craving sessions and how many you held out of;
• Your current taper-plan week index and that week's daily limit;
• The two-letter language code in which you want the insight written.

The summary contains no timestamps, no GPS coordinates, no zone names, no purchase token, no device identifiers, and no other personal data. It cannot be tied back to you on the OpenAI side.

OpenAI processes the request under its standard API terms, including a 30-day retention window for abuse-monitoring after which they delete the request. We do not train any model on your data and we do not authorise OpenAI to do so.

Generation runs as a once-daily server-side job. The resulting insight text — a short paragraph in your language — is then stored on our server (associated with your purchase token only) and delivered to your app the next time it polls. You can stop using AI Insights at any time and request deletion of all your stored insights and aggregate uploads by emailing us.

3.7. PDF export (Pro users only, on-device)

The "Export for doctor" feature generates a PDF report on your device summarising your last 30 / 60 / 90 days. The PDF is written to your phone's cache directory and shared via the Android system share sheet at your initiative. The file is not uploaded to our server. Where you choose to send it (email, drive, messaging app) is your decision and outside our control.

4. In-app purchases and Pro entitlement

Pro is a one-time €19.99 lifetime in-app purchase processed by Google Play Billing. We never see your card details. Google Play sends our server a purchase token that we use to verify the entitlement is still valid and to address your encrypted Cloud Sync blobs. If you request a refund through Google Play and it is granted, the entitlement is automatically downgraded back to free on the next billing-state check (typically within minutes — Google notifies us via Real-Time Developer Notifications).

5. Permissions

• Notifications (POST_NOTIFICATIONS) — to deliver your daily reminder, weekly summary, Risk Zone alerts and (Pro) AI insight when ready. Required on Android 13 and newer; you can revoke it at any time in system Settings.
• Location (ACCESS_FINE_LOCATION) — to tag cigarette logs and (Pro) detect Risk Zone arrivals.
• Background location (ACCESS_BACKGROUND_LOCATION) — Pro only, requested separately when you open Risk Zones, so geofences work when Tapr is not in the foreground.
• Vibration — for haptic feedback on the log button and at the end of the craving timer.
• Internet — only for Pro Cloud Sync, AI Insights and Google Play Billing entitlement check. The free app makes no network calls.
• Foreground service (FOREGROUND_SERVICE_LOCATION) — Pro only, used by the geofence engine when Risk Zones are active.
• Exact alarms (SCHEDULE_EXACT_ALARM, USE_EXACT_ALARM) — to fire your daily reminder at the chosen minute even when the device is in Doze.
• Boot completed (RECEIVE_BOOT_COMPLETED) — to re-arm Risk Zone geofences and the daily reminder after you restart the phone.
• Billing (com.android.vending.BILLING) — to process the Pro lifetime purchase via Google Play.

You can deny any of these and the relevant feature will degrade gracefully. The free app's core (logging, taper plan, stats, craving timer) does not require any of the optional permissions.

6. Third parties

Tapr connects to the following third parties:

• Google Play Billing — to process the Pro lifetime purchase. Subject to Google's privacy policy.
• Google Play Services Location — to determine the device's location and run geofence detection on-device. We do not transmit your raw coordinates.
• OpenAI — to generate Pro AI Insights from the anonymous weekly summary described in §3.6. Subject to OpenAI's API terms; the request never carries identifiers that can be tied back to you.

Tapr does not include any analytics SDK, advertising SDK, crash reporter, or any other third-party tracker. There is no Firebase, no Google Analytics, no Sentry, no Adjust, no Branch.

7. Data retention

• Local data — kept on your device until you uninstall the app or use Settings → Reset.
• Cloud Sync encrypted blobs — kept until you disable Cloud Sync or request deletion. We retain blobs of refunded Pro purchases for up to 30 days to allow restore in case of a billing error, then delete.
• AI Insights aggregate uploads and generated insight texts — the most recent aggregate per user is kept for cron processing; generated insights are kept for 12 weeks of personal history. Both are deleted on request.
• Pro entitlement record (purchase token, is_pro flag, refund timestamps) — kept for as long as you have a valid Google Play purchase token, for as long as required to honour billing-state changes.
• OpenAI request logs — controlled by OpenAI; their standard policy is up to 30 days for abuse monitoring.

8. Your rights under GDPR

If you are in the EU, EEA, UK or Switzerland, you have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate data;
• Request deletion of your data ("right to be forgotten");
• Request a copy of your data in a portable format;
• Object to or restrict our processing;
• Withdraw your consent at any time (note: most local data is processed locally and not under our control);
• Lodge a complaint with your national supervisory authority.

To exercise any of these, email fenixjzdev@gmail.com. We respond within 30 days. Because Cloud Sync stores only ciphertext addressed by a purchase token, we may need you to confirm ownership of the token (for example, by sharing the Google Play order ID) before we can act on a deletion or access request.

9. Children

Tapr is not intended for, and is not directed at, persons under 18 years of age. We do not knowingly process data of minors. The app's onboarding requires you to confirm you are 18 or older, and Pro purchase ratings on Google Play reflect this. If you believe a minor has installed the app and provided data, contact us and we will delete it.

10. Security

All network traffic uses HTTPS (TLS 1.2+). Cloud Sync payloads, Risk Zone definitions, and craving sessions are encrypted on-device with AES-256-GCM before transit. The encryption key is derived from your Google Play purchase token using HKDF-SHA-256 — neither the key nor the token is stored on our server in clear form.

Server-side, encrypted blobs and Pro entitlement records are stored in a MySQL database on a managed shared-hosting account, accessible only via SSH key authentication and a single per-database account. The app's API key for OpenAI is stored only in our server's PHP configuration file outside the public document root, and is never sent to your device.

We do not store any plaintext cigarette logs, craving sessions, or zone coordinates on the server, ever.

11. International transfers

Our hosting provider's servers are located in the United States, and OpenAI's API endpoint is also operated from the United States. By using Pro Cloud Sync or AI Insights you consent to the transfer of encrypted blobs (Cloud Sync) or anonymous aggregates (AI Insights) to those servers. We rely on Standard Contractual Clauses where required.

12. Changes to this policy

If we change this policy materially, we will update the "Last updated" date at the top and (for material changes) show an in-app notice the next time you open the app. Continued use after the change means you accept the updated terms.

13. Contact

Questions, requests or complaints — fenixjzdev@gmail.com.