Privacy Policy

Last updated: September 25, 2026

1. Data we collect

Habitform collects only what the app needs to function:

• Account information: your email address, and a username/display name/bio/avatar if you set one.
• Activity data: the activities, projects, and timer sessions you create or log — including dates, durations, quantities (e.g. pages read), notes, and any photos or videos you attach to a session.
• Schedule data: any recurring blocks or plans you set up in the Schedule tab.
• Social data (if you use it): who you follow, club memberships, event RSVPs, posts, comments, and kudos — all opt-in features.
• Photos: if you attach a photo/video to a session, or set a cover/avatar image, it's uploaded to our storage provider (Supabase, see below).
• Data from connected services: if you connect Strava, Apple Watch, or the Mac companion app, data flows in from those — see the dedicated sections below.

We do not collect analytics, advertising identifiers, or location data, and we don't run any third-party analytics or advertising SDKs in the app.

2. How we use it

Your data is used only to run the app for you: showing your own history, computing streaks/goals/insights, syncing between your own devices, and — for anything you explicitly share — showing it to the people you've shared it with (followers, a club, an event).

We do not sell your data, and we do not use it for advertising.

3. Where it's stored

Account and activity data is stored with Supabase, our database/backend provider, protected by row-level security policies so that, with the exception of anything you explicitly choose to share (see below), only you can read your own data. Data in transit is encrypted (HTTPS/TLS).

4. Strava integration

If you connect a Strava account in Settings:

• What we access: your Strava athlete ID and the activities on your account (via Strava's API, scope activity:read_all) — name, sport type, start time, and duration.
• What we do with it: a new activity you save on Strava is imported as a Habitform session (once you've told us which of your Habitform activities that Strava sport type should count as). We don't read or modify anything else on your Strava account, and we don't post anything back to Strava.
• Tokens: your Strava access/refresh tokens are stored server-side, never in the app itself, and used only to make the API calls above.
• Withdrawing access: disconnect Strava any time from Settings — this revokes our access on Strava's side immediately and deletes the stored connection. You can also revoke access directly from Strava's own connected-apps settings.
• Deletion: disconnecting deletes the stored tokens immediately; any sessions already imported stay in your own Habitform history (like any other session you logged) unless you delete them yourself. If you'd like us to delete imported data as well, email us — this is completed within 30 days.
• Strava's own use of your data is governed by Strava's Privacy Policy; Strava separately collects usage data about applications connected to its API for its own business, product, and compliance purposes.

5. On-device features

Some features are designed to keep data on your own device rather than send it anywhere:

• App Blocker (iOS): built on Apple's Screen Time (Family Controls) framework. Which apps you choose to block is kept private by Apple's own design — Habitform never learns which specific apps you selected, only a count.
• Apple Watch: your activity list and finished sessions sync between your phone and watch directly over Bluetooth (Apple's WatchConnectivity), not through our servers.
• Mac menu bar companion: an optional desktop app that can sign in to the same account to read your activity list and mirror your phone's running timer, and enforces its own local block list on your Mac. It doesn't collect or transmit anything beyond that sign-in.

6. What's shared with other users

By default, a new session is shared with your followers (you can turn this off in Settings, or per session) — everything else (your raw activity list, projects, schedule) stays private to your account unless a feature explicitly says otherwise (e.g. a club you join, a profile you make public). You control this in Settings and on each individual session.

7. Other third parties

Push/local notifications use Apple's and Expo's standard notification infrastructure to schedule reminders on your own device; we don't collect a push token for remote/marketing notifications. App builds/updates are delivered via Expo's own build and update infrastructure. We may add further optional integrations (e.g. media metadata providers for books/movies) — this policy will be updated before any such integration goes live.

8. Retention & deletion

We keep your data for as long as your account exists. You can delete individual sessions, projects, or activities at any time in the app. To delete your entire account and all associated cloud data, use Delete account in the app (Account screen) — it takes effect immediately — or see how to request deletion by email. Data stored only on your device stays on your device. Safety reports (see our child safety standards) are retained with the reporter's and reported person's identity detached, because they must be preserved for legal reasons; backups are overwritten on the provider's normal cycle, typically within 30 days.

9. Your rights & choices

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to withdraw consent for anything you've opted into (sharing, a connected service). Email us to exercise any of these — we'll respond and, where applicable, confirm once it's done.

10. Children's privacy

Habitform is not directed at children under 13, and we don't knowingly collect data from them; accounts we learn belong to someone under 13 are removed. See our child safety standards for how we prevent and respond to child sexual abuse and exploitation.

11. Changes to this policy

If this policy changes materially, we'll update the date at the top of this page and, where appropriate, notify you in the app.

12. Contact

Questions, requests, or concerns: jamesnvd@gmail.com.