Privacy Policy for Habitly

01 Introduction

This Privacy Policy explains how your information is handled when you use Habitly ("the App"), a habit tracking application for mobile devices. Habitly is built to keep your data on your own device. It has no user accounts, shows no ads, and its developer does not collect or receive the habits, notes, or activity you log.

This policy sits alongside our Terms of Service, which set out the agreement between you and the developer.

This policy exists because a small number of essential services (the app store you download from and the service that manages your subscription) do process limited data on their own. This document explains exactly what that means, in plain language.

Habitly is developed and provided by Trif Iulian, an individual developer based in Romania, European Union (referred to in this policy as "we," "us," or "the developer"). For the purposes of the EU General Data Protection Regulation (GDPR), Trif Iulian is the "data controller" for the limited processing described below. Contact details are in Section 14.

02 The short version

03 Information stored on your device

When you use Habitly, the App creates and stores data locally on your device, including:

• The habits you create and their settings (names, schedules, targets)
• Your completion history, streaks, and statistics
• Reminders and notification preferences
• App settings and preferences

This information stays in the App's local storage on your device. Reminders are scheduled and delivered locally by your device, without any server we control. We do not have access to your data, we do not receive copies of it, and it is not transmitted to any server we operate. If you delete the App, this local data is removed from your device (subject to any backup you have chosen to keep, see Section 6).

04 Information we do not collect

To be explicit, the developer does not collect, store, or receive:

• Your name, email address, phone number, or any contact details
• Your habit data, notes, logs, or any content you enter into the App
• Your location
• Analytics or usage-behavior data from inside the App
• Advertising identifiers for ad targeting

05 Data processed by essential third-party services

Some functions of the App rely on trusted third parties. These companies act as independent controllers or as our processors and handle data under their own privacy policies. We have configured the App to share only what is necessary for these services to work.

a) Google Play (app distribution, diagnostics, and payments)

When you download Habitly and make a purchase through the Google Play Store, Google collects and processes information such as your Google Play account details, purchase and transaction records, and device and diagnostic information (including crash reports and basic technical data that Google may make available to us in aggregated, non-identifying form through the Play Console). Google acts as the payment processor. We never see or store your full payment card details. Google's handling of this data is governed by the Google Privacy Policy at https://policies.google.com/privacy.

b) RevenueCat (subscription management)

We use RevenueCat to manage subscriptions, validate purchases, and unlock the App. When you start a trial or purchase a subscription, RevenueCat processes a randomly generated, anonymous app user ID, your purchase and transaction history, and technical information such as your device model, operating system version, country, and IP address. RevenueCat does not receive your name or email, and it does not receive the habits you log. RevenueCat's handling of this data is governed by the RevenueCat Privacy Policy at https://www.revenuecat.com/privacy.

The purpose of this processing is to provide the paid subscription you requested, verify that purchases are valid, restore purchases across your devices, and prevent fraud.

06 Optional device backup

Your device's operating system may offer to back up app data. On Android, if you have enabled Google Backup, a copy of your Habitly data may be saved to your personal Google account so you can restore it on a new device. This backup is controlled entirely by you and your device settings. The data goes to your own cloud storage. We have no access to it and receive no copy. You can disable this at any time in your device's backup settings.

When Habitly becomes available on iOS, equivalent device-level backup (such as iCloud) will work the same way: any backup goes to your personal account, not to us.

07 Exporting your data

Because your data lives on your device, Habitly lets you export it at any time through the App. This saves a copy of your information as a file on your device, in a portable format that you control.

08 This website

This site is a set of static pages. It sets no cookies, runs no analytics or tracking scripts, and embeds nothing from a third party. Fonts, images and styles are served from this site itself, so visiting it does not send your details to anyone else.

The site is hosted by Vercel Inc., which processes standard server request data such as your IP address and browser type in order to deliver the pages and to protect against abuse. Vercel acts as our hosting provider under Article 28 of the GDPR. We do not receive or store this data ourselves, and there is no visitor-level reporting behind it.

Links out to Google Play open Google's own site, which has its own privacy policy.

09 Legal bases for processing (GDPR)

For the limited processing described in Section 5, we rely on the following legal bases under the GDPR:

• Performance of a contract (Article 6(1)(b)): Processing purchase and subscription data through Google Play and RevenueCat is necessary to provide the subscription you have requested and to give you access to the App.
• Legitimate interests (Article 6(1)(f)): Receiving aggregated, non-identifying diagnostic and crash information from Google Play helps us keep the App stable and secure. We balance this against your privacy, and this data is not used to identify you.
• Consent (Article 6(1)(a)): Any optional device backup happens only if you enable it in your device settings.

10 Data sharing and international transfers

We do not sell your personal data, and we do not share it with third parties for advertising or marketing.

The essential service providers named in Section 5 (Google and RevenueCat) are based in or transfer data to the United States. Where these transfers involve personal data of users in the European Economic Area, the transfers are governed by the providers' own safeguards, which include the European Commission's Standard Contractual Clauses and, where applicable, certification under the EU-US Data Privacy Framework. Please refer to their privacy policies, linked above, for details.

11 Data retention

We do not hold your personal data on our own systems, so there is nothing for us to retain or delete on our side. Data stored on your device remains until you delete it or uninstall the App. Purchase and subscription records held by Google and RevenueCat are retained according to their respective retention policies and applicable tax and accounting laws.

12 Your rights

Under the GDPR, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and the right to data portability. Because we do not hold your personal data ourselves, you can exercise most of these rights directly:

• Access and portability: Your data is on your device and can be exported from within the App at any time.
• Deletion: Delete your data within the App, or uninstall the App, to remove local data from your device. To request deletion of purchase records, contact Google Play or RevenueCat, or contact us and we will assist.
• Correction and restriction: You can edit or remove your entries directly in the App.

If you have any request or question about your data, contact us using the details in Section 14. You also have the right to lodge a complaint with your local data protection authority. In Romania, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro.

13 Children's privacy

Habitly is not directed at children. The App is intended for adults aged 18 and over, and our Terms of Service require you to be 18 to use it. We do not knowingly permit use by anyone under that age, and we do not knowingly collect or process the personal data of children under 13 (or under the equivalent minimum age set by your local law, such as 16 in Romania).

If you believe a child has used the App or has provided personal data through the essential services described above, please contact us and we will take appropriate action.

14 Contact

If you have questions about this Privacy Policy or how your data is handled, you can contact the data controller, Trif Iulian, at:

julien.trif@gmail.com

We aim to respond to privacy requests within 30 days.

15 Changes to this policy

We may update this Privacy Policy from time to time, for example if we add a feature or change a service provider. When we make material changes, we will update the "Last updated" date at the top and, where appropriate, provide notice within the App or on our website. We encourage you to review this policy periodically.

16 Governing law

This Privacy Policy is governed by the laws of Romania and the applicable data protection law of the European Union.