Most privacy policies are written to protect the company, not to inform you. This one is short because there's genuinely little to tell: accounts are optional and anonymous, we don't ask who you are, and we don't collect personal data. Here's exactly what that means.
Last updated: September 2026
To understand what's useful and what isn't, we count page visits using a self-hosted, open-source, privacy-first analytics tool on servers we run in the UK. It is cookieless: it stores nothing on your device and never tracks you across other sites.
For each visit it records the page you looked at, where you arrived from (the referring site or a campaign link), your browser's language and time zone, and rough loading-speed timings. It does not store your IP address, and it holds no personal data. Visitor numbers are counted in aggregate, not tied to you. We don't record sessions, mouse movements or anything you type.
This site sets no tracking cookies. If you create an account, we set a single strictly-necessary cookie to keep you signed in. It holds only a random session token, nothing about you, and it's never used for tracking or advertising. The one future exception is advertising (below): if and when ads run, the ad provider may set cookies, but only after you've agreed through the consent banner. You can review or withdraw that choice any time via "Cookie settings" at the bottom of any page.
Accounts are optional. The whole site works without one. An account exists only to save your own progress as you moderate, take a break or stop, so it's there next time you visit.
It's deliberately anonymous. We don't ask for, and can't store, your name, email or address. You're given a random handle (like calm-otter) and you choose a passphrase; that passphrase is the only way back in, so you also get a one-time recovery code to keep as a backup. We can't see or reset either, which is the point: there's nothing about you for us to lose or hand over.
We do not log or store your IP address. Our content-delivery network, Cloudflare, handles IP addresses in transit to deliver and protect the site, as it does for essentially every website, but we keep none of it, and nothing in your account is tied to an IP or a device.
Your account data stays on our own UK servers, is never sold or shared, and is never linked to ads. If you don't log in for 12 months, the account and everything in it is automatically deleted, and it ages out of our encrypted backups on the same timeframe. You can also export everything we hold, or delete your account for good, in one tap from the account page. No email, no questions.
The interactive tools (the spend calculator, the self-checks, the quit planner) still run entirely in your browser; whatever you enter into them stays on your device and is never sent to us.
If you choose to support the site through the "Buy us a coffee" button, you're taken to a secure checkout run by Stripe, our payment processor. Stripe handles the payment and your card details entirely on their side. We never see or store your card number, and we don't receive your personal details. Stripe processes your information under its own privacy policy. Donating is completely optional, and the whole site is free whether you do or not.
We're preparing to show ads through Google AdSense to help keep the site free and independent. Ads are not running yet. When they are, here's how it will work:
Because we're in the UK and EU, ads will load in a way that shows nothing personalised until you consent. When you first visit, you'll see a banner asking whether you're happy with ad cookies. If you agree, Google and its advertising partners may set cookies to show ads and, if you allow it, tailor them to your interests. If you don't agree, you'll still see ads, but non-personalised ones, and no advertising cookies tied to your interests are set.
You can change your answer at any time through "Cookie settings" in the footer. You can also manage or turn off personalised ads across Google at My Ad Center, and read how Google uses advertising data at policies.google.com/technologies/ads. Any data Google collects through ads is handled by Google under its own policies, not by us.
We link out to primary sources (GOV.UK, the NHS, journals and the like) and to Stripe and Google as above. Once you follow a link off this site, that site's own privacy policy applies, not ours.
If what we do changes, most likely when ads go live, we'll update this page and move the "last updated" date at the top. Since we hold no contact details, we can't email you about it, so this page is always the current word.
Questions about any of this? Email [email protected]. Smoke Smartly is run from the UK; where data-protection law applies, that's the UK GDPR and the Data Protection Act 2018.