Privacy policy

Last updated: 7 November 2026

Habitaap ("the app", "we") is a personal habit-tracking app. This policy explains what data the app collects, why, and the choices you have. Contact: contact@habitaap.com

What we collect

Account information

• If you sign up with email and password: your email address. Your password is stored only as a secure hash, and we cannot read it.
• If you sign in with Google: your Google account ID, email address, name and profile picture URL, as provided by Google.
• An optional display name you choose in the app.

Content you create

• Habits (name, description, category, schedule, time of day, reminder time, and the dates you paused them).
• Check-ins: the date and time you complete a habit, and optionally how long you spent on it and a note.
• Challenges you create or join and the achievements you unlock.
• Shared challenges. If you share a challenge with a code, or join one, the other participants can see your display name, the titles of the challenge's habits, and your check-ins and progress on them (completion rate, streaks, whether you did a habit today). They never see your email address. When you leave a challenge, or its owner removes you or deletes it, your copies of its habits and check-ins are deleted.
• Messages you send us. If you use the in-app form to ask for more habits, your message, display name, account email and habit count are emailed to contact@habitaap.com so we can reply. The app itself only keeps the time you sent it (to limit how many requests can be sent per day).

Confirmation and password reset emails

• When you sign up with email, or reset your password, we email a one-time code to your address from contact@habitaap.com (sent through our email provider, Hostinger). Codes expire after 15 minutes.

Breached-password check

• When you choose a new password, our server checks it against known data breaches using Have I Been Pwned's Pwned Passwords service. Only the first 5 characters of a one-way hash of the password are sent, never the password itself, so the service cannot learn it.

Stored only on your device

• An encrypted cached copy of your recent data, so the app opens quickly and works offline. It is removed when you sign out and is excluded from device and cloud backups. On a new device, your data is restored from your account when you sign in.
• Scheduled habit reminders. These are local notifications created on your device and are never sent through a server.

Crash reports

• If the app crashes or hits an error, a report is sent to our error-monitoring provider, Sentry. It contains the technical error, the screen you were on, your device model, operating system and app version. It does not contain your name, email, account ID, IP address, or your habits, notes or check-ins. Reports are used only to find and fix bugs.

We do not collect your location, contacts, photos or advertising ID. We do not use analytics or advertising SDKs, and we do not track you across other apps or websites.

How we use it

Only to provide the app's features: signing you in, syncing your habits across your devices, sending reminders, and calculating your streaks, statistics and achievements. We do not sell your data, share it for advertising, or use it to profile you.

Who we share it with

We share data only with the service providers that run the app on our behalf, and only what each one needs:

• Convex: hosts our database and backend (servers in the United States).
• Hostinger: sends our emails.
• Sentry: receives crash reports (no personal data, see above).
• Google: if you choose Google Sign-In, subject to Google's Privacy Policy.

Other people see your data only inside a shared challenge you chose to join, as described above.

Security

Data is encrypted in transit (HTTPS/TLS). Every request to our server is checked against your signed-in account, so no one else can read or change your habits. On your device, your sign-in session is kept in the operating system's secure storage and the offline cache is encrypted.

Retention and deletion

We keep your data for as long as you have an account.

You can delete your account at any time in the app: Profile → Edit → Delete account. This permanently deletes your account and all of your habits, check-ins, challenges and achievements from our servers. Deletion is immediate and cannot be undone. Residual copies in backups are removed when those backups expire.

If you can no longer access the app, email contact@habitaap.com from the address on your account and ask for deletion. We will delete your account within 30 days. See Delete your account for details.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, or to object to how it is used. You can edit your name and habits in the app at any time and delete everything yourself. For any other request, email contact@habitaap.com.

Children

The app is not directed at children under 13, and we do not knowingly collect data from them.

Changes

If this policy changes, we'll update the date above. Significant changes will be announced in the app.