Privacy

Ilma is made by Barking Studio. This page says what the app does with information, in plain words. Last changed 8 October 2026.

The short version

• Ilma has no account. Your quit plan, your counters and your craving history live on your iPhone and in its widgets. There is no full plan or history copy on our servers.
• Personal AI requests leave your phone only after you explicitly allow them. Subscription records are separate. Crash reports and usage counts start off and are sent only if you enable reporting in Settings.
• HealthKit readings never leave your phone.
• No advertising, no tracking, no selling of anything.

What stays on your phone

The original quit plan and craving history are stored in a file on your phone, shared with Ilma's widgets. This includes cigarettes a day, pack price, your reason for quitting, your hard moment, your goal, your quit date and craving outcomes. If you allow personal AI, selected words and derived behavior are also sent as described below. Deleting the app removes its local data; it does not erase records already held by Apple or a processor under its own retention policy.

If you connect Health, Ilma reads your resting heart rate and heart rate variability to show them next to your quit date. When you record “It passed”, Ilma writes the completed activity interval to Health as mindful minutes. Those readings are shown on the phone and are never sent anywhere: not to us, not to the AI service below, and not in the crash reports or usage counts.

Optional personal AI

Ilma asks for explicit permission before its first personal AI request, including when an older permission covered personal lines but not activity selection. You can decline and still use on-device activity support, counters and your saved history. This choice does not change your subscription or payment. You can allow or withdraw permission under Settings → Data & privacy → Personal AI support. Withdrawing stops new requests, cancels requests still in progress and clears the app's cached AI lines. Information already sent cannot be unsent.

With your permission, there are three kinds of request to Ilma's server, hosted on Vercel, which forwards the writing context to OpenAI:

• Cached personal lines: requested when the local batch is empty, stale or in the wrong language, usually every few days while the app is open. It contains your optional why-now and hard-moment notes, goal word, quit approach, selected difficulty and craving-moment choices, language, weekday/time-of-day bucket and calculated display counts such as time smoke-free, cigarettes avoided, money saved and cravings beaten. It includes an app-generated random install token for abuse limits. Raw pack price and cigarettes-per-day answers are not included.
• Live home note: requested when the app opens or returns to the foreground, with reuse for up to ten minutes. It includes the same derived plan context, the local clock time without a time zone, recent completed craving times and outcomes as days relative to today and local HH:mm values, plus grouped craving counts from the last three weeks. These are smoking/craving behavior, distinct from raw HealthKit readings. If the optional Jev classifier is enabled, Jev (typesafe.ai) receives this recent-craving context, local time, quit approach and calculated counts to select the note's focus; it does not receive the personal free-text plan notes. Walked-away countdowns are excluded; at most 500 recent completed craving entries are included.

Activity selection: requested on the suggestion screen if personal AI is allowed and Ilma Plus is available. It uses the same derived plan context and time/day bucket, plus recent activity IDs to avoid repeating an idea. OpenAI selects from the shared activity catalog; the app displays its own localized activity wording and duration. Choosing another idea can rotate locally without another paid request. Once an activity starts, later AI responses cannot change its timer.

None of the app-generated AI payloads includes a name or email field, Apple ID, advertising/device identifier, GPS coordinates, time zone, raw quit-date timestamp or HealthKit reading. Hosting connection metadata is separate, as described below. Your own free-text notes could contain identifying details, so avoid entering anything you do not want the named AI processors to receive. We disclose this personal writing and smoking/craving context as data linked to you. The random token is separate from analytics identifiers and is removed with the app.

Ilma's server does not retain the full personal request or generated answer. For abuse and budget controls, it sends limited counters to Upstash Redis. Upstash stores integer request counts with rotating keyed hashes of install and network identifiers. It receives no raw IP address, install token, personal notes, craving history or generated lines. Counter keys are set to expire within 120 seconds for minute limits, 48 hours for daily limits and 62 days for the aggregate monthly count. A separate monthly spending ledger stores amounts and random reservation IDs, with no personal context or user identifier; it expires at the start of the second following UTC month. These are configured key lifetimes, not a deletion guarantee for every provider backup or operational record.

Vercel receives connection metadata, including the IP address a request arrives from. Its Privacy Notice says it collects end-user city and country derived from IP for service operations, security and analytics. This is approximate network location, not your phone's GPS. We disclose this hosting metadata as linked coarse-location data rather than promise it is anonymous. Vercel's current runtime-log default for our hosting plan is one day. That does not cover every platform security log or service-generated metadata copy: its public terms provide no fixed deadline for those records, and its DPA allows service-generated information to remain after the hosting contract ends while needed for its stated purposes.

OpenAI and, when enabled, Jev process received information under their own API and privacy policies. OpenAI does not use API content to train models by default; its standard abuse-monitoring policy allows content to be kept for up to 30 days, with legal and safety exceptions. Ilma does not claim zero retention. Jev has no fixed deletion period in its public terms and is disabled until its processing and retention terms are approved for Ilma. Ilma cannot promise provider copies are deleted immediately. AI selects from suitable activities and writes personal lines; it is not used to make a diagnosis or calculate health facts; the app checks generated lines locally and uses on-device support if a request fails or a line is unsuitable.

Ilma Plus

The craving button, its activity countdown and your country's quit helpline are free and always on. Ilma Plus is the rest — the air clearing, Ilma's notes, your money, the Health card, the Lock Screen countdown — and is a subscription through the App Store: a yearly plan that starts with a free week, or a monthly plan. Both renew until you cancel, which you can do any time in Ilma (Settings → Ilma Plus → Manage Ilma Plus) or in your Apple Account's subscriptions.

Apple handles the payment; Apple's own privacy policy covers it. The subscription record is also kept by RevenueCat, the service we use to keep subscriptions straight across devices. RevenueCat assigns an anonymous customer ID and associates subscription purchases and the screen where an offer was shown with that ID. Ilma does not send RevenueCat your quit plan or craving history. RevenueCat also uses subscription records for subscription analytics; its SDK sends technical information such as device type, iOS version and last use. Cancelling a subscription or deleting Ilma does not automatically erase these records. You can contact us to request deletion; contractual and legal retention may still apply.

Usage and crash reports

Only if you enable Usage and crash reports in Settings, Ilma sends crash reports and usage counts. Reporting starts off; a saved choice is kept. They help us fix crashes and understand which parts of the app help. The app does not attach your name, email or quit plan.

Crash reports go to Sentry, hosted in Frankfurt (Sentry's EU region). When the app crashes, hangs or is stopped by the system, it sends the technical record of what went wrong: where in the code it happened, the app and iOS version, the iPhone model, and the screens and app events just before it. Roughly one time in ten it also sends how long the app took to start and to draw a screen. Sentry counts crash-free sessions with a random installation identifier it creates on the phone and keeps across launches. Crash and hang session records can carry that identifier, so these diagnostics are disclosed as linked to your device. It is not your name, email or Apple ID.

Usage counts go to TelemetryDeck, hosted in the EU. They are a fixed list of events, each with a name and at most a few labels: which screen of Ilma Plus was seen and from where, which plan was chosen, whether an offer was taken or passed on, that a craving started, passed or was a slip (one event each time, never how many you have had), that Health was connected, that the widget guide was seen. Like any event, each is sent when it happens. Each also carries the app version, the iPhone model and iOS version, the language (never the region), the time zone's offset from UTC, the hour and weekday it was sent, the screen size, display and accessibility settings such as text size, the day the app was first opened, and how often and for how long it has been used. The app makes up a random identifier for this on first launch and scrambles it before sending, and TelemetryDeck scrambles it again; it is not your Apple ID, not the phone's identifier. Deleting the app removes the local identifier, not reports already received by TelemetryDeck.

What is never in either: your name, email or any account; anything you typed; your cigarettes a day, pack price, money or any of your counters' values; your quit date or any date from your history; your goal; the helpline you called; the lines Ilma showed you; Health readings; your location or region. The app includes no IP-address field in a report. TelemetryDeck says it never stores the connection IP address. Sentry may process connection metadata under its own policies. Screenshots, screen recordings and the app's network traffic are never captured.

Switching reports off stops future collection; it does not delete reports already received. Our current Sentry plan has a 30-day default for technical events. This is not a guarantee that every backup or operational record is deleted on that date; Sentry retains information under its service terms. TelemetryDeck currently sets no guaranteed deletion date for stored events and keeps analytics data when a developer account is closed.

You can enable or switch both off under Settings → Data & privacy → "Usage and crash reports". Off stops future collection within a few seconds; the app starts neither service again until you enable it. Information already sent cannot be unsent. These reports are declared as crash data, performance data, other diagnostic data, product interaction, a user ID and a device ID, with no tracking. Sentry diagnostics and its persistent device identifier are disclosed as linked; TelemetryDeck's separate hashed usage counts do not use that identifier. The optional AI behavior and personal writing described above are separate data flows.

The craving-start, pass and slip events describe smoking behavior and are included in the Health data disclosure for analytics. They do not contain your full craving history or HealthKit readings. The reporting switch is separate from personal AI permission: declining AI does not switch reporting off.

What we don't do

Ilma has no advertising, account, login or email list. Ilma does not sell or rent your information or use it for advertising tracking across apps or websites. The named providers process selected information and technical metadata under the terms described above, including Vercel's own hosting operations, security and service analytics.

Your choices

• Decline or withdraw personal AI permission any time in Settings → Data & privacy → Personal AI support. On-device craving support remains available.
• Enable or switch off usage and crash reports any time in Settings → Data & privacy.
• Turn Health access off any time in Settings → Health, or in the iOS Settings app.
• Cancel Ilma Plus any time in Settings → Ilma Plus → Manage Ilma Plus, or in your Apple Account's subscriptions. What you have counted stays on your phone either way.
• Delete Ilma's local app data by deleting the app. Health entries written to Apple's Health app are managed there separately.
• Contact support@ilma.club about privacy or to request access or deletion where applicable. Support messages include the information you choose to send; there is no Ilma account holding your full plan or craving history.

Children

Ilma is for adults who smoke. It is not directed at children under 13 and carries a 13+ rating on the App Store.

Changes

If this page changes, the date at the top changes with it, and the app links here so you can always read the current version.