Privacy Policy

Last updated: 14 October 2026

Data controller: [to complete: publisher name], [to complete: address] — [to complete: contact e-mail].

What we collect

Account: e-mail address, password (stored only as an irreversible hash), creation date.
Profile (optional): name, username, phone number, age range, gender, profile photo, language, theme, reminder preferences.
Welcome questionnaire: your answers (goals, preferences).
App content: habits and their sub-tasks, planned days, check-ins, events and their reminders, rewards, finished Focus sessions (date, length, status, number of blocked apps), water counter (goal, containers, amounts drunk per day).
Subscription: plan, status, dates, technical identifiers at RevenueCat. We never receive your card details.
Technical: session cookie or token to keep you signed in, server logs (IP address, date, page requested) kept for at most 30 days for security.

What we do not collect

No advertising, no ad trackers, no sale of data, no cross-app tracking.
Focus mode: on iPhone, apps are chosen in Apple's list and stay on your device as anonymous tokens — HabitFlow does not know which ones you chose. On Android, the list of chosen apps stays on your phone; the accessibility service does not read screen content and sends nothing.
Reminders are scheduled on your device (local notifications).

Why (legal bases)

Providing the service and your subscription: performance of the contract.
Security (rate limiting, logs): legitimate interest.
Billing and accounting: legal obligation.
Photo, phone, age, gender: optional, provided by you, removable at any time.

Service providers (processors)

Hosting: Railway Corporation, San Francisco, États-Unis / USA.
In-app purchases: Apple (App Store), Google (Google Play) and RevenueCat.
E-mails (confirmation, password reset): Brevo (Sendinblue SAS, France); verification SMS: Twilio.

Some are located outside the European Union (notably in the United States); transfers rely on the European Commission's standard contractual clauses or the Data Privacy Framework.

Retention

For as long as your account exists. When you delete your account, all your data is erased from the database immediately (any technical backups are overwritten within 30 days). Invoices are kept by the payment provider for the legally required period.

Your rights

At any time you can access and download your data (Profile → Download my data), correct it (Profile) and delete your account (Profile → Delete my account, or this page). You can also object to or restrict processing, or write to us at [to complete: contact e-mail]. You may lodge a complaint with your data protection authority (in France, the CNIL).

Children

HabitFlow is intended for people aged 13 and over.

Security

Encrypted connections (HTTPS), hashed passwords, revocable sessions, data access limited to the account holder.