Privacy policy

What we collect and why

Your account

• Your name, as you enter it. Friends in your Habits see it.
• Your phone number, proven with a one-time code sent by SMS. Friends who have your number can add you to a Habit, and each number belongs to one account. Friends do not see your number in the app.
• Your email address, if you sign up with an email and password, or the one your Google or Apple account shares with us (Apple may give a private relay address). We use it to sign you in. Firebase sends the email that confirms an email address is yours.
• How you sign in: email and password, Google or Apple, and the account ID that service gives us. Your password goes to Firebase Authentication, which checks it; our server never sees it.
• A profile photo, only if you add one: the one photo you choose. Friends in your Habits see it. You can remove it at any time.

Your Habits and progress

The Habits you create or join and their settings, your check-ins and the amounts you record (with any corrections), your daily results, your Races and their results, Daily wins, streaks, Badges, and your pets. This is what the app shows you and your friends. Each Habit keeps its time zone so days start and end at the right time.

Health data, only for Habits you link

• On Android, from Health Connect: your daily totals of steps, distance and water.
• On iPhone, from Apple Health: your daily totals of steps and water.
• Habits reads them only for the Habits you choose to link, to fill in those Habits' daily amounts. It never writes to Health Connect or Apple Health.
• Only each day's total leaves your phone. It is saved as that Habit's amount for the day, which friends in that Habit see. No single record, its source or its time is stored or sent.
• You can unlink a Habit, or remove Habits' access in Health Connect or the Health app, at any time.

Health data is used only to show your own progress and your Races' progress. It is never used for ads, never sold, and never transferred to anyone except as needed to provide this feature.

Screen time, only for Screen time Habits

On iPhone, Habits never reads your screen time. If you make a Screen time Habit there, you type the amount yourself, and friends in that Habit see it.

On Android, if you link a screen-time Habit, you turn on Usage access for Habits yourself in Android's settings. Habits then reads your phone's total screen time for each day, in minutes. No app names, sessions or times leave your phone; only each day's total is saved to that Habit, which friends in it see. Like health data, it is never used for ads, sold or transferred. You can turn Usage access off at any time.

Contacts, only if you allow it

• When you add friends to a Habit, the app can show your contacts so you can pick people. With your permission it reads the names and phone numbers in your contacts, on your phone only. You can also type a number instead.
• Your contact list is never uploaded. Only the phone numbers you pick or type are sent to our server, to add those people to the Habit. The names you saved for them are not sent.
• If a number belongs to someone on Habits, they are added (or asked back) and may get a notification. If not, we keep a coded form of the number (a hash), not the number itself, so the invitation can reach them if they join with that number. The invitation expires after 30 days.
• An invite message to someone who is not on Habits is sent from your own WhatsApp or SMS app, by you. We do not send it.

Notifications

If you allow notifications, we keep your phone's push token (from Firebase Cloud Messaging, through Apple's push service on iPhone), your phone's time zone, whether notifications are allowed, and your notification choices. We use them to send reminders, friends' progress and invitations at the right local time, and keep a record of what was sent so nothing is sent twice or too often.

Help requests

If you send a help request in the app, it holds the kind of problem you chose and, if you were signed in, which account sent it. It is deleted after one day. If you email us, we use your message only to answer you.

Reports and blocks

• If you send a report, we store it so we can review it: who sent it, who and what it names, and any note you add. Reports are deleted after 180 days, or sooner if the account that sent one or that it names is deleted.
• If you block someone, we store that block so they cannot add you to a Habit again. It stays until you undo it in Settings or delete your account.

Keeping the service safe and running

• To stop abuse of SMS codes, we keep a coded form of a phone number for 48 hours after a code is sent to it, and daily counts of codes sent. Firebase may also check that a code request comes from the real Habits app.
• When the app talks to our server, Google Cloud keeps technical logs of the requests (such as the time, the IP address and which part of the server answered). We use them only to keep Habits working and safe.
• The app keeps a copy of your data on your phone, in encrypted storage, so it works offline.

What we don't do

• We show no ads, and we never sell, rent or share your data for advertising.
• Habits has no advertising ID and does not track you.
• On iPhone, the app holds no tracking tools.
• On Android, the app removes the advertising ID permission. It also holds Facebook's sign-in kit, which is switched off: Habits does not offer Facebook sign-in, and the kit's app events and advertising ID collection are turned off.
• Habits has no analytics or crash-reporting tools.
• Habits does not ask for your location.

Who can see your information

• Friends in the same Habit see your name, your profile photo and your progress in that Habit: check-ins, daily amounts, results, Race standings and Daily wins. They may get notifications about your progress in it, for example when you finish for the day.
• People who have your phone number can add you to a Habit. You can block someone who adds you.
• Only you see your phone number, your email, how you sign in, your pets and your Badges. If you share a Badge, the picture goes only where you send it.
• Our services, listed below, process data for us to run Habits.

Services that process data for us

• Google Firebase and Google Cloud: sign-in, SMS codes and email confirmations (Firebase Authentication), our database (Cloud Firestore), our server (Cloud Functions), profile photos (Cloud Storage), notifications (Firebase Cloud Messaging) and these pages (Firebase Hosting). Your data is stored and processed in the United States.
• Google and Apple sign-in, only if you choose one. That service tells us your account ID, name and email, and knows you used it to sign in to Habits.
• Apple's push notification service, for notifications on iPhone.
• Health Connect and Apple Health run on your phone. Habits only reads from them, as described above.

How long we keep it

• Your account and Habits are kept while your account exists. We do not delete accounts for being inactive.
• A photo you replace or remove is deleted from storage.
• Help requests are deleted after one day, and the SMS anti-abuse codes after 48 hours.
• Reports are deleted after 180 days. A block stays until you undo it or delete your account.
• When you delete your account, your data is deleted within about 5 minutes, except what is kept for your friends: your past results in Races with friends stay in their history, without your name, photo or contact details. See exactly what is deleted and kept.

Your choices

• Change your photo, or remove it, in Profile.
• Leave any Habit you are in.
• Turn notifications off in Settings, or in your phone's settings.
• Unlink health Habits (and screen-time Habits on Android), and remove Habits' access to contacts, health data or Usage access (Android) in your phone's settings.
• Undo a block in Settings.
• Delete your account in the app, or by email.
• To ask for a copy of your data or to correct it, write to devamrgamal@gmail.com.

Security

Data travels encrypted between the app and our server. Your data in our database can be read and changed only through our server, which checks who is asking. On your phone, the app keeps its data in encrypted storage. No system is perfectly secure, but we work to protect your data.

Children

Habits is not directed at children under 13, and we do not knowingly collect their data. If you think a child under 13 has given us data, write to us and we will delete it.

Changes to this policy

If we change this policy, we will post the new version on this page with a new effective date at the top. Please check back from time to time.

Contact

Habits is developed by Amr Gamal. Questions or requests about your data:

devamrgamal@gmail.com