Privacy Policy

Last updated: April 29, 2026

1. Who We Are

HabitFlow ("we," "our," or "us") is the developer and publisher of the HabitFlow habit tracking application, available on iOS and Android, and the website at habitflow.app.

For GDPR purposes, HabitFlow acts as the data controller for any personal data collected through our website, and as a data processor for habit data you choose to store in the app.

Contact: support@habitflow.app

2. Information We Collect

In the mobile app

• Email address: Used solely for account authentication and recovery. Never used for marketing without your explicit consent.
• Habit data: Habit names, colors, completion records, and streaks — stored locally on your device via AsyncStorage. This data is not uploaded to our servers unless you enable AI coaching.

On our website (habitflow.app)

• Analytics data (with consent only): If you accept analytics cookies, we collect anonymous usage data via Google Analytics 4 — including pages visited, time spent, device type, and approximate geographic region. This data cannot identify you personally.
• Consent preference: We store your cookie choice ("granted" or "denied") in your browser's localStorage under the key habitflow_cookie_consent. This is not a tracking cookie.

3. Cookies and Tracking Technologies

We use Google Analytics 4 on our website to understand how visitors interact with our pages, so we can improve the experience. This service uses cookies to collect anonymous usage data.

Cookie / Storage	Provider	Purpose	Duration	Requires consent?
habitflow_cookie_consent	HabitFlow	Stores your cookie consent choice (localStorage — not a cookie)	Until cleared	No (functional)
_ga	Google Analytics	Distinguishes unique visitors (anonymous)	2 years	Yes — analytics consent
_ga_*	Google Analytics	Session persistence for Analytics 4	2 years	Yes — analytics consent

We use Google Consent Mode v2. Google Analytics is loaded in a restricted state by default and only starts collecting data after you click "Accept analytics" in the cookie banner. If you decline, no analytics cookies are set and no usage data is sent to Google.

You can withdraw consent at any time by clearing your browser's localStorage or cookies. The banner will reappear on your next visit.

For more information on how Google uses data, visit Google's Privacy Policy and Google Analytics data practices.

4. How We Use Your Information

• Provide and maintain the HabitFlow service
• Authenticate your account and enable account recovery
• Generate personalized AI coaching suggestions (only when you explicitly opt in)
• Understand website usage in aggregate to improve our product (only with your analytics consent)

We do not use your data for advertising, profiling, or automated decision-making that produces legal effects.

5. AI Coaching Data

When you enable the AI Coach feature, anonymized summaries of your habit data (habit names, streaks, completion rates — never your email or any identifier) are sent to OpenRouter and processed by the Meta Llama 3.3 70B language model. Explicit consent is required in-app before any data is transmitted. You can revoke this consent at any time in Settings.

6. Data Sharing

We do not sell, trade, or rent your personal information to third parties. Data is shared only in these circumstances:

• With your explicit consent (e.g., AI coaching, analytics)
• Payment processors: Stripe, Paddle, PayPal, or BTCPay process subscription payments. We share only the data necessary to complete a transaction (email, payment details). We never store full card numbers.
• Legal compliance: If required by law or to protect our legal rights

7. Data Storage and Security

Habit data is stored locally on your device and never uploaded to our servers unless you opt into AI coaching. Account information (email, subscription status) is stored in our database hosted on Replit's infrastructure in the United States.

We implement appropriate technical and organizational security measures to protect your data against unauthorized access, alteration, disclosure, or destruction.

8. International Transfers

If you are located in the European Economic Area (EEA), your data may be transferred to and processed in the United States, where our servers and third-party services (Google Analytics, OpenRouter, Stripe) operate. These transfers are governed by appropriate safeguards including Standard Contractual Clauses.

9. Your Rights (GDPR / EEA Users)

If you are located in the EEA, the UK, or Switzerland, you have the following rights under the GDPR:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate personal data.
• Right to erasure: Delete your account and all associated data at any time via Settings → Delete Account in the app, or by emailing us.
• Right to restriction: Request we restrict processing of your data in certain circumstances.
• Right to data portability: Export your habit data via Settings → Export Data.
• Right to object: Object to processing based on our legitimate interests.
• Right to withdraw consent: Withdraw AI coaching consent or analytics consent at any time without affecting prior processing.
• Right to lodge a complaint: You may lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at support@habitflow.app. We will respond within 30 days.

10. Legal Basis for Processing (GDPR)

Processing activity	Legal basis
Account authentication (email)	Contract performance (Art. 6(1)(b))
Subscription management	Contract performance (Art. 6(1)(b))
AI coaching (habit data summaries)	Consent (Art. 6(1)(a))
Website analytics (Google Analytics)	Consent (Art. 6(1)(a))

11. Children's Privacy

HabitFlow is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify users of material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we may send an in-app notification.