Last updated: 23 October 2026
Quit by Heart (“we”, “us”) operates quitbyheart.com. Quit by Heart is not incorporated; it is operated by an individual, who is the data controller for the information described in this policy.
Address: Centre for Entrepreneurship, University of Toronto, W640 – 108 College St, Toronto, Canada, M5G 0C6
Contact for privacy questions and data requests: founder@quitbyheart.com
When you complete the early-access form, we ask for:
| What | Required |
|---|---|
| Your name | Yes |
| Email address | Yes |
| How you use nicotine (cigarettes, vape, chew, pouch, snus) | No |
| How much you use per day | No |
| How many years you have used nicotine | No |
| The age you started | No |
| Preferred brand(s) | No |
| Phone number | No |
| Anything else you choose to tell us | No |
Our shorter registration form asks only for your name and email address.
When you visit the site, we and our providers may collect your IP address, browser and device type, pages viewed, referring page, and approximate location derived from your IP. This happens through the website analytics and security tooling described in sections 5 and 6.
We do not ask for payment details. The site has no user accounts. We do not knowingly collect information from children — see section 11.
Information about your nicotine use — whether you smoke or vape, how much, for how long, and the age you started — says something about your health. Under UK and EU data protection law this is “special category” data (Article 9 UK/EU GDPR) and gets stronger protection than ordinary contact details. Canadian law (PIPEDA) likewise treats health information as sensitive.
We treat it accordingly:
| Purpose | Lawful basis (UK/EU GDPR) |
|---|---|
| To contact you about early access and launch | Consent |
| To understand how Quit by Heart would fit your nicotine use | Explicit consent (Art. 9(2)(a)) |
| To keep the website secure and prevent spam submissions | Legitimate interests |
| To understand how the site is used, in aggregate | Consent |
Under PIPEDA we rely on your knowledge and consent for all of the above.
Some cookies are essential — they make the site work and are always on. Separately, we use analytics cookies set by Google Analytics and by Jetpack to understand how the site is used.
Analytics cookies are switched off until you allow them. If you visit from the UK or the European Economic Area, we show a notice asking for your choice, and the analytics scripts stay inactive until you accept. If you reject them, they stay inactive and we delete any analytics cookies already stored on your device.
You can change your choice at any time:
You can also block or delete cookies through your browser settings. Doing so will not prevent you from using the site.
We do not sell your information and we do not share it for advertising. We use the following service providers, who process information on our behalf:
| Provider | What it does | Where |
|---|---|---|
| Bluehost / Newfold Digital | Website hosting and storage | United States |
| Automattic (Jetpack) | Site statistics, image delivery, security, uptime monitoring and encrypted backups — backups include form submissions | United States |
| Automattic (Akismet) | Checks form submissions for spam | United States |
| Google (Analytics) | Website analytics | United States |
| OptinMonster | On-site messaging | United States |
| Novamira | Site management tooling with access to the website database, including form submissions | United States |
| Proton | Delivers email we send you | Switzerland |
We may also disclose information where we are legally required to, or to protect our rights or the safety of others.
We are based in Canada. Several of our providers are in the United States, and one is in Switzerland. This means your information is transferred outside Canada, the UK and the European Economic Area.
Where information is transferred out of the UK or EEA, we rely on the safeguards our providers have in place, including Standard Contractual Clauses and, where applicable, the EU–US and UK–US Data Privacy Framework.
Wherever you live, you can ask us to:
If you are in the UK or EEA these are rights under UK/EU GDPR. If you are in Canada, PIPEDA gives you rights of access and correction and the right to withdraw consent.
To exercise any of them, email founder@quitbyheart.com. We will respond within 30 days.
If you are not satisfied with our response you can complain to:
The site is served over HTTPS. Form submissions are stored in a non-public area of our website that is not published or exposed through our public interface, and access is limited to the founder. Backups are encrypted by our backup provider.
No method of transmission or storage is completely secure. If a breach occurs that is likely to put your rights at risk, we will notify you and the relevant regulator as required by law.
Quit by Heart is not intended for children. We do not knowingly collect information from anyone under 16.
Our form asks the age at which you started using nicotine. That is a question about your past, not an invitation for anyone under 16 to sign up.
If you believe a child has given us their information, email us and we will delete it.
If we change this policy we will update the date at the top. If the change materially affects how we use information you have already given us, we will contact you.
Email: founder@quitbyheart.com
Post: Centre for Entrepreneurship, University of Toronto, W640 – 108 College St, Toronto, Canada, M5G 0C6