Privacy Policy

Who's responsible for your data

Habit Pocket is operated by Bohdan Stefaniuk, a sole proprietor based in Ontario, Canada. For privacy questions, email habit-pocket@stefaniuk.me.

Our approach to privacy

We respect your privacy. The goal is to collect as little data as possible while still giving you a reliable, useful service. We do not sell your data to anyone, not to advertisers, data brokers, or third parties. Your habits and entries are yours alone. You own your data: export your full history as CSV or JSON any time, free on every tier, and delete your account in one click — it erases everything from our database immediately, with no soft-delete and no waiting period.

What we collect

We collect only what we need to run the service:

• Account information: Your email address. If you sign up with Google or Apple, we also store the identifier we receive from them so we can link your account on subsequent sign-ins. We use this to identify you and to email you about your account if needed.
• Your content: The data you create in Habit Pocket: habits, daily entries, sections, chart configurations, and the streaks computed from your entries. This data is necessary to provide the core functionality of the app.
• Account preferences: Your timezone, week-start day, and time format. We pick reasonable defaults from your sign-up environment and let you change them in Settings.
• Billing metadata: If you upgrade to Pro, we store the subscription identifiers tied to your account so we can manage your plan — a Stripe customer ID for web subscribers, or a RevenueCat-issued identifier for App Store subscribers. We never see or store your card number; that lives with the payment processor.
• Device information: A per-device identifier and an optional device name (for example, “Bohdan's iPhone”), so we can list your active sessions in Settings and revoke them individually. The identifier is generated on first launch and stays on your device — it is not the IDFA or any advertising ID.
• Apple Health data (optional, iOS only): If you create a Health habit in the iOS app, the app reads the specific Health metrics you pick — for example steps, weight, or water — with read-only permission that iOS asks you to grant per metric. What we store is only the resulting daily number for each metric you chose (for example, “8,542 steps on August 6”), saved with your habits so it shows on all your devices. We never see or store your raw Health samples, workout routes, or anything you didn't pick; we never write to Apple Health; and we never use Health data for advertising, never share it, and never sell it — to anyone. You can revoke access anytime in the Health app (your profile → Apps), and deleting a Health habit or your account deletes the stored values.

Beyond the optional Apple Health metrics you explicitly choose, we don't ask you for sensitive personal data — financial details, precise location, or health information. If you choose to put any of that into a habit name, description, or numeric value, we treat it the same way as the rest of your content: privately, and only for your use.

How we use your data and why we're allowed to

Under EU and UK law we have to tell you the legal ground for each thing we do with your data. Here it is, in plain terms.

We do not use the contents of your habits or entries for advertising, profiling, model training, or any third-party analytics. We don't make decisions about you using only automated processing.

We do not sell your data

Your personal data and your content are not sold to anyone. We do not share them with advertisers or data brokers. We share data only with the service providers that help us run the product:

• DigitalOcean — our managed database and server host in Canada.
• Stripe — web subscription payments.
• RevenueCat — mediates App Store subscriptions and shares purchase events with us so we can grant or revoke access to Pro features.
• MailTrap — delivers transactional emails such as your welcome email and password resets.
• Sentry — receives crash reports and basic performance data from the app so we can diagnose problems.
• PostHog — provides page-view analytics on the marketing site so we can see which pages people visit. It is not loaded inside the logged-in app.
• DataFast — lightweight product analytics. It records anonymous milestones — that someone visited, signed up, finished onboarding, or upgraded to Pro — so we can see how people get started. We never send it your email, your habits, or anything you create; only that the event happened.
• Reddit — while we advertise on Reddit, a temporary conversion pixel on the marketing site reports which visits and sign-ups came from those ads. It receives standard technical data and conversion events, never your email or your habit data. It comes out when the campaign ends.
• Telegram — we receive the feedback you choose to submit through the in-app feedback form as a message in Telegram.

Each of these providers handles your data under confidentiality and data-processing terms, only for the purpose described above, or when required by law.

Where your data lives

Server data is stored on managed DigitalOcean infrastructure in Canada. On mobile, your data is also kept locally in SQLite so the app works without a connection. Local data syncs back to the server when you reconnect. Connections between your device and our servers are always over HTTPS.

International transfers

If you're in the European Economic Area or the United Kingdom, your data is transferred to Canada when you use Habit Pocket. The European Commission has recognised Canada as providing an adequate level of data protection for transfers to private-sector organisations covered by Canada's federal privacy law (PIPEDA), which we are, so no additional safeguard is required for that hop.

Some of the providers listed in “We do not sell your data” are based in the United States — Stripe, RevenueCat, Sentry, PostHog, DataFast, and Reddit. They handle personal data from the EEA and the UK under the European Commission's Standard Contractual Clauses or, where applicable, the EU–US Data Privacy Framework.

Analytics

To be upfront about the split: the native mobile app carries no ads and no advertising trackers — only crash diagnostics. This marketing website and the web app use a few privacy-respecting analytics tools, and while we're running ads, the marketing site also carries a temporary attribution pixel. None of them ever receives your habits, entries, or anything you create:

• PostHog — page-view analytics on the marketing site (habitpocket.io) only; it is not loaded inside the logged-in app. We see general location (country or region), device type, and which page was viewed.
• DataFast — product analytics on the marketing site and inside the app. It records anonymous milestones — that someone signed up, finished onboarding, or upgraded to Pro — so we can understand how people get started. Like most analytics tools it sets a cookie and sees standard technical data (approximate location, device, and browser); it never receives your email or your habit data.
• Reddit Pixel— a temporary advertising-attribution pixel on the marketing site only; it is not loaded inside the app. While we run ads on Reddit, it reports which visits and sign-ups came from those ads so we don't waste money on them. It sees standard technical data and the fact that a page visit or sign-up happened; it never receives your email or your habit data. We'll remove it when the ad campaign ends.

Your habit data is never sent to any analytics or advertising provider.

Retention and deletion

We retain your account and your content for as long as your account is active. When you delete your account from Settings › Account › Delete account, every habit, entry, section, chart configuration, and account record is removed from our database in one click. Your data may still exist briefly in recent backups, but it will be overwritten as newer backups are created and old ones rotate out within 30 days.

You own your data. Before deleting — or any time — you can export your full history as CSV or JSON straight from Settings, free on every tier. It's live for everyone, with no request or support ticket needed.

Security

We use industry-standard measures to protect your data in transit and at rest, including encrypted connections, hashed passwords, and secure handling of session tokens. No system is perfect; if we ever become aware of a breach that affects you, we'll let you know as the law requires.

App Store privacy label

The disclosures below mirror the privacy nutrition label on our App Store listing. Apple categorises data into three buckets, and we want the website policy and the App Store label to say the same thing.

Data not used to track you

We do not collect any data used to track you across other apps or websites. No advertising SDKs, no third-party trackers, no fingerprinting. The corresponding category on our App Store label is empty.

Data linked to your identity

• Contact info: your email address, used for sign-in and account communication.
• Purchases: your subscription status (Free or Pro). The card number itself lives with Stripe; we never see it.
• Identifiers: a user ID we generate internally so we can attach your habits and entries to your account.
• Diagnostics: crash reports and basic performance metrics from the mobile app. Diagnostics include technical information — stack traces, error codes, device/OS, the screen you were on, and an opaque account id — but never your email, and never the habits, entries, or notes you create.
• User content: the habits, entries, sections, and chart configurations you create.

Data not linked to your identity

We do not collect any data that isn't tied to your account.

Children's privacy

Habit Pocketis not directed at children. We don't knowingly collect personal data from anyone under 13. If you're a parent and believe your child has created an account, contact us at habit-pocket@stefaniuk.me and we'll delete it.

Your rights

Depending on where you live, you have rights over the personal data we hold about you, including the right to access it, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent where we relied on consent. You can do most of these directly from Settings (export your data as CSV or JSON; delete your account). For anything you can't do yourself, email us at habit-pocket@stefaniuk.me and we'll respond within 30 days, or sooner if we can. For unusually complex requests we may extend that period as the law allows, and we'll tell you why. We may also need to verify it's really you before acting on the request.

If you're in the European Economic Area, the United Kingdom, or Switzerland and you believe we're not handling your data properly, you have the right to lodge a complaint with your local data protection authority. We'd appreciate the chance to address your concern first.

California residents

California law requires that we tell you, in plain terms, the categories of personal information we collect about you (described in “What we collect” above), the purposes we use it for (in “How we use your data”), and who we share it with (in “We do not sell your data”). We do not sell or share your personal information for cross-context behavioural advertising, and we have not done so in the previous twelve months. California residents have the same rights of access, deletion, correction, and non-discrimination as described in “Your rights” above.

If the business changes hands

If Habit Pocketis sold, merged, or otherwise transferred to a new owner, your data may transfer with it. We'll tell you before that happens and you'll have a chance to delete your account first.

Changes to this policy

We may update this privacy policy from time to time. The updated version goes on this page and the “Last updated” date at the top changes. If changes are significant, we'll notify you by email or in the product.

Contact

Questions about this privacy policy or your data? Email habit-pocket@stefaniuk.me.