demi.st

Privacy Policy

Last updated 24 October 2026

Who we are

OATFOX LTD (“we”), a company registered in England and Wales; company number 17519607, registered office 71-75 Shelton Street, London WC2H 9JQ, United Kingdom. We are the data controller for the information below. Contact: support@demi.st.

What we collect

Identifiers. The app generates two random identifiers on your phone, an installation id and a user id, and sends them with every request along with the platform and app version. They are not derived from your device or any account. A reinstall generates new ones.

Your log. Each session you log — its date, time and time zone, its length, whether it was edited or deleted, and how it was logged — and each day you answer as vape-free or untracked. These are stored on your phone and on our server, which computes daily and weekly summaries from them.

Spending. Each purchase’s amount, currency and date, and any words you type for it.

Profile. Your nickname, your goal, and a stop day if you set one.

The chat. Your question and a summary of the days it is about — counts, times, gaps and spending totals, never your name — go to our server and to an AI model provider, which writes the answer. We send it with storage switched off, so the provider keeps nothing and does not train on it. We keep a count of questions per day. If you report an answer, we keep that question, the answer and your reason. The conversation is stored with your history on our server, so it comes back with it on another phone.

Sign-in, if you use it. Sign in with Apple or Google runs through a sign-in service. We store the provider, an opaque identifier it gives us for you, and the date it was linked — not your password, name or email address.

Recovery key, if you make one. Stored hashed and encrypted, with the dates it was made and used.

Diagnostics. Crash reports and the app’s short diagnostic messages — device model, operating system and app version, and the crash — go to a crash-reporting service. Our server writes one log line per request — the operation, your identifiers, platform, app version, duration and whether it failed — to our hosting provider and a log service. What you log, ask or are answered is never in these logs.

How the app is used. Which screens you open and which controls you use, with details such as a session’s length, your goal or a yes-or-no answer, but never a time of day, an amount of money or anything you type. These go, with your user id, device model, operating system, app version and language, to a product analytics service, which also decides which features are switched on for you.

The website. demi.st sets no cookies and runs no analytics. It stores one value in your browser so the sample day plays once. Our hosting provider keeps standard access logs.

We do not use advertising SDKs, sell personal information, or ask for your email, contacts, location or health data.

Why we use it

To provide the app: storing and syncing your history, bringing it back on another phone, and answering your questions. This is the performance of our contract with you.
To keep the app working and improve it: crash reports, request logs and how the app is used in aggregate. This is our legitimate interest.
To comply with the law.

Service providers acting for us: a hosting provider for our server, database and website; a log service; a crash-reporting service; a product analytics service; a sign-in service; an AI model provider for the chat; and the app stores. Each receives only what its job needs, under its own terms, and none of it for advertising. We disclose information where the law requires.

Transfers

Our server and the providers above process data in the United States. Where UK law requires a safeguard, we rely on the International Data Transfer Agreement or Addendum, or on the provider’s certification under the UK–US data bridge.

How long we keep it

Your history is kept until you delete it. Crash reports, logs and usage events are kept for a limited period and then deleted. The question count resets each day; a reported answer is kept until the problem is fixed or you delete your history.

Deleting your history

In the app: Preferences › More › Delete history. This removes everything from your phone and your name from our server, revokes your recovery key, unlinks any sign-in, and detaches the history from your phone, so nothing can bring it back.

The detached records — sessions, day answers and purchases, with no name, key or sign-in attached — stay in our database and are used only in aggregate to understand how demi.st is used. To have them erased as well, email support@demi.st; we may ask for your recovery key or linked sign-in to find them, and will confirm within one month. Deleting the app without using Delete history leaves your history on our server in the same way.

Your rights

Under UK data protection law you can ask for a copy of your information, to correct or erase it, to restrict or object to its use, and to receive it in a portable form, at support@demi.st. You can also complain to a data protection supervisory authority, such as the one where you live.

Age

demi.st is for adults. It is not for anyone under 18, or under the legal age for vaping products where you live if that is higher, and we do not knowingly collect their information. If you believe a child has used demi.st, tell us and we will delete what was stored.

Security

Everything travels over TLS, recovery keys are stored hashed and encrypted, and access to the database is limited to the people who run it. No method of transmission or storage is completely secure.

Changes

The latest version of this policy is at demi.st/privacy with its date at the top.