Privacy Policy
Last updated: 3 August 2026
What we collect
Nasma collects no personal information. There is no account, and the app does not obtain your name, email address, phone number, location or device identifiers.
Where data is stored
All records (smoking, cravings, goals, settings) are stored only on your device. Neither the developer nor any third party can read them.
Network access
Apart from App Store purchase handling, which Apple provides, the app makes no network requests. No advertising, analytics or crash-reporting SDK is included.
Health (HealthKit)
Only after you explicitly grant permission, Nasma reads three types — resting heart rate, steps and sleep — on a read-only basis. The data is processed on your device and never sent anywhere. Nasma never writes to Health, does not use Clinical Health Records, and never uses health data for advertising. You can revoke permission at any time in the Health app.
Face ID / Touch ID
Used only to unlock the app. Authentication stays on the device and no biometric data reaches the app.
Notifications
Local notifications are scheduled on the device only if you enable them. Their contents are never sent anywhere.
Backups
You choose where an exported file is stored. The developer never sees the destination or its contents.
Children
Nasma is not designed for children. Please use it in line with its age rating.
Deleting your data
“Delete all data” in Settings removes every record and setting. Deleting the app also removes the data on your device.
Changes
If this policy changes, this page will be updated.
How the Android version handles your data
The following describes the Android version (Android 9.0 and later). Everything above applies to iOS; only the points below differ on Android.
Your records are stored in a local database (Room) on your device. They are never sent to the developer's servers.
Both cloud backup and device-to-device transfer are disabled (allowBackup="false" plus data_extraction_rules.xml). To move to a new device, export a backup yourself from inside the app.
With your permission, Nasma uses Health Connect on your device. It reads resting heart rate, sleep and steps. Access is read-only; nothing is ever written back.
Health data handled through Health Connect is used solely to calculate and display results inside the app. It is never used for advertising, shared with data brokers, or disclosed to third parties. You can revoke Health Connect permission at any time in your device settings.
The only external services used are Google Play Billing (purchases) and the Wear OS Data Layer (syncing with your watch). Google processes all payments; card details never reach the developer.
The only device permissions the phone app requests are showing notifications, re-arming reminders after a reboot and biometric unlock. Each is asked for only when you use the matching feature, and declining leaves the rest of the app usable.
The Android version also runs on Wear OS watches. Data moving between the watch and the phone is carried by the Wear OS Data Layer in Google Play services and never passes through the developer's servers. When the watch and the phone are not connected over Bluetooth, it may be relayed through Google's servers (end-to-end encrypted on that route).
The watch app asks for no permissions. It declares only permissions that Android grants without asking: vibration.
The watch app has Google cloud backup disabled, but direct device-to-device transfer when you change watches follows the Android default.
Uninstalling the app deletes the data on your device.
Controller, contact and your rights
This app is provided by Freetokyo Labs, which acts as the data controller. For any question about this policy or about personal data, contact support@freetokyolabs.com. We normally reply within five business days.
If you are in the EU, the EEA or the UK, the GDPR gives you the right to access, rectify, erase, restrict and port your personal data, to withdraw consent and to object to processing. You may also lodge a complaint with your national supervisory authority.
If you are a California resident, the CCPA/CPRA gives you the right to know, delete and correct the personal information collected about you, and to opt out of its sale or sharing. We do not sell or share personal information.
Where this app stores data only on your device, we have no access to it, so most of these rights are exercised directly on the device: delete or export inside the app, or delete the app. We will still answer any request you send us.
Retention: on-device data is kept until you delete it or remove the app. Support emails are deleted 24 months after the request is closed.