Privacy Policy — HabitBox

Last updated: 23 September 2026

This policy explains what personal data the HabitBox app and the website habitbox.app handle, why, and what you can do about it. We have tried to keep it short and plain. If anything is unclear, email support@habitbox.app.

The short version

HabitBox has no accounts. The app never asks for your name, email address or age.
Your habits and check-ins are stored on your phone. On iPhone they also sync with the private database of your own iCloud account. This is on by default, and we can't read it. On Android there is no cloud sync.
To handle HabitBox Plus, the app contacts our subscription provider RevenueCat each time it starts, using a random ID and basic device details. On iPhone it also passes on Apple Ads attribution data once after you install the app.
The app shows no ads. Apart from RevenueCat and that Apple Ads attribution, it contains no analytics or advertising software, and it doesn't use your phone's advertising ID. All notifications are created on your phone.
The website uses one analytics tool, Fathom, which sets no cookies and doesn't identify you. There is no Google Analytics, no Meta (Facebook) Pixel and no other tracking or advertising tool on the website. In blog posts with a video, YouTube's player loads only if you press play (section 11).
We don't sell personal data. You have rights over your data, including the right to object to the processing we base on our legitimate interests, and you can use them by emailing us.

Contents

Who we are
App: what stays on your device
App: iCloud sync on iPhone
App: Android
App: purchases and HabitBox Plus
App: Apple Ads attribution on iPhone
App: notifications, permissions and other connections
Website: hosting and server logs
Website: analytics (Fathom only)
Website: cookies and browser storage
Website: images, videos and share links
Store links and campaign tags
When you email us
No selling of data, no ads in the app
Why we use data (legal bases)
How long we keep data
Who receives data
Transfers outside the EU
Security
Children
Your rights
Complaints
Changes to this policy
Contact us

1. Who we are

HabitBox is made by Iaroslav Morgunov, an individual sole trader in Portugal who trades as Last Stand Studio (laststand.studio). In this policy, "we", "us" and "our" mean him. He is the data controller for the personal data described here.

Name: Iaroslav Morgunov, trading as Last Stand Studio
Address: Rua Alfredo Keil 571, 4150-047 Porto, Portugal
Email (privacy, support and everything else): support@habitbox.app
Phone: +351 924 331 054
Tax number (NIF): 310038588

We have not appointed a data protection officer, because the law does not require one for a business like ours. You can contact us directly about anything in this policy.

This policy covers:

the app: HabitBox for iPhone and for Android;
the website: habitbox.app, including its pages that open inside the app.

Where this policy says "iPhone", it also covers the iPhone app when it runs on another Apple device.

Sections 2 to 7 are about the app. Sections 8 to 12 are about the website and our store links. Sections 13 onwards apply to both.

2. App: what stays on your device

HabitBox has no accounts and no sign-up. The app does not ask for your name, email address, age, gender, location or health data.

Everything you create in the app is saved in the app's own storage on your phone:

your habits: name, optional description, icon or emoji, colour, type, target and unit, active days, order and archive status;
your daily check-ins and progress, your streaks and streak freezes;
your reminders (times and days);
your preferences, such as theme, units, first day of the week, layout and which optional notifications you turned on;
small pieces of app state, such as whether you finished onboarding and when the app last asked you for a rating.

We have no servers that receive this data, and we can't see it. Habit names and check-ins can say a lot about a person (for example, a habit about drinking less). That is why they stay with you.

Automatic backups. On each day you use the app, it saves a backup file of your habits in its own storage on your phone (one file per day). It keeps the last 7. You can restore one in Settings > Restore from Backup. The app doesn't send these files anywhere. On iPhone they may be included in your normal iPhone backup (iCloud Backup or a backup to your computer), depending on your settings. On Android, see section 4.

Random device ID. The app creates a random identifier and saves it on your phone. It is never sent to us or to anyone else.

Widget (iPhone). The home-screen widget reads your habits from storage that the app and the widget share on your iPhone. This stays on the device.

Habit Coach. Habit Coach tips are worked out on your phone using fixed rules. No AI service is involved, and nothing is sent anywhere.

Export and import. With HabitBox Plus you can export your habits to a file. The app creates the file and opens your phone's share sheet. You choose where it goes (for example the Files app, an email or a cloud drive), and the app then deletes its temporary copy. You can also import a file that you pick. Exported files are yours, and you decide where they are kept. We never receive them unless you send one to us.

3. App: iCloud sync on iPhone

What syncs: your habits (with details from section 2 such as name, description, icon, colour, target, active days, reminder times and streak freezes), your daily check-ins and progress, and some settings (theme, units, first day of the week and layout).
Where it goes: the private database of the iCloud account you are signed in to on your iPhone, using Apple's CloudKit service. Only you can access that database. We can't read it, and we don't receive your Apple ID, name or email address.
Is it on by default? Yes. If you are signed in to iCloud, HabitBox syncs automatically. The app does not have its own on/off switch for sync.
How to turn it off: open the iOS Settings app, tap your name, then tap iCloud. Find HabitBox in the list of apps using iCloud (you may need to tap Show All or See All) and turn it off. Signing out of iCloud also stops it. Turning sync off does not delete what is already stored in iCloud. Section 21 explains how to delete it.
Deleted habits: when you delete a habit, the app marks it as deleted in iCloud instead of erasing it. The deleted habit's details, such as its name and description, stay in your private iCloud database until you delete HabitBox's iCloud data (section 21).

Apple stores this data under your iCloud agreement with Apple and Apple's Privacy Policy.

4. App: Android

On Android, HabitBox has no cloud sync. Your habits stay on your device.

Android has its own system backup. If you have it turned on, Android may include HabitBox's data (your habits, settings and the automatic backup files) in the device backup that it stores in your Google account. Google handles this under Google's Privacy Policy, and we can't access it. Android uses this backup to restore your apps. It is not a sync between devices. You can turn it off in your phone's backup settings (the exact menu depends on your phone).

5. App: purchases and HabitBox Plus

HabitBox is free to use, with some limits. HabitBox Plus unlocks more features and is sold as an auto-renewing subscription. Some people have a one-time Lifetime purchase instead.

Payments. Apple (App Store) or Google (Google Play) handle all payments. We never see your card or bank details, and we don't receive your Apple ID or Google account. In the EU, the seller of in-app purchases is Apple Distribution International Ltd. or Google Commerce Limited, both in Ireland. They process payment data under their own privacy policies (Apple, Google). You manage and cancel purchases with Apple or Google. Refunds are explained in our Terms of Use. Apple and Google also give us sales reports, such as which products were bought, when, at what price and in which country. Google Play also lists individual orders by order number.

RevenueCat. We use RevenueCat, Inc. (USA) to check purchases and manage subscriptions. RevenueCat processes this data on our behalf, as our processor. It also shows us overall figures, such as how many subscriptions were started, renewed or cancelled. Each time the app starts, it contacts RevenueCat to check whether you have HabitBox Plus. This happens for everyone, including people who have never bought anything. On Android, the app also shares your existing Google Play purchases with RevenueCat at each start so your plan stays correct.

RevenueCat receives:

a random, anonymous ID that RevenueCat's software creates in the app (we don't link it to your name, email address or store account);
purchase information from Apple or Google: receipts or purchase tokens, which product you bought, purchase and expiry dates, and whether Plus is active;
your device model, operating system version, app version, language settings, and the country of your App Store or Google Play account;
on iPhone, Apple's "identifier for vendor": an ID that iOS gives to all of our apps on your phone. It is not the advertising ID, and iOS changes it if you delete all of our apps;
when the app was last opened;
on iPhone, Apple Ads attribution data (section 6);
your IP address, as with any internet connection.

RevenueCat does not receive your habits or anything else you type into the app. It stores data on Amazon Web Services servers in the USA. RevenueCat's software also saves the anonymous ID and your purchase status on your phone, so the app knows your plan. See RevenueCat's privacy policy.

6. App: Apple Ads attribution on iPhone

On iPhone, after you install the app, it gets an attribution token from Apple's AdServices framework and sends it to RevenueCat once (if sending fails, it tries again at a later start). RevenueCat uses the token to ask Apple whether HabitBox was installed after one of our Apple Ads ads. If so, Apple returns details such as the campaign, ad group, search keyword and country, and whether the ad was tapped or only seen. RevenueCat stores this with the anonymous ID from section 5.

We use this only to learn which of our Apple Ads campaigns lead to installs and purchases. It does not use your advertising identifier (IDFA) and does not follow you across other companies' apps or websites. Under Apple's rules it does not need the "Allow Apps to Request to Track" permission, so the app never shows that prompt. You can object to this processing (section 21).

7. App: notifications, permissions and other connections

Notifications

All HabitBox notifications are local: your phone schedules and shows them. The app does not use push notifications, does not create a push token and sends nothing to a notification server. Notifications include:

your habit reminders;
the optional streak alert and weekly recap;
occasional reminders if you haven't opened the app for 3, 7 or 14 days (only if you allowed notifications and have habits).

Tapping "Mark as done" on a notification updates your data on the phone. The app asks for notification permission the first time it needs to schedule a notification, for example when you save a habit with a reminder or turn on the streak alert or weekly recap. You can turn notifications off at any time in your phone's settings.

Permissions

Notifications are the only permission the app asks you for. The app does not access your camera, microphone, photos, contacts, location or health data. It does not collect your phone's advertising ID. On Android the app also uses standard permissions that don't show a prompt, such as internet access and restoring your reminders after the phone restarts.

Other connections from the app

No analytics or ads. Apart from RevenueCat (section 5) and the Apple Ads attribution (section 6), the app contains no analytics, crash-reporting or advertising software.
No over-the-air updates. App updates come only through the App Store or Google Play.
Apple, Google and iCloud. The app connects to Apple or Google for purchases and, on iPhone, to iCloud (section 3).
Web pages inside the app. Support, Terms of Use and this Privacy Policy open inside the app as pages from habitbox.app. They work like the rest of the website, as described in sections 8 to 11.
Feedback survey. Settings has an optional survey hosted by Tally (Tally BV, Belgium). Tally processes the answers for us and stores them in the EU. The survey doesn't ask for your name or email address. Please don't type personal details into the free-text answers. When the form loads, Tally receives standard technical data such as your IP address and browser details.
Rating the app. The app may show Apple's or Google's built-in rating prompt once, after a streak milestone. You can also open it from Settings. Apple or Google handle your rating and review. The app only saves, on your phone, the date it showed the prompt. If you tap Rate the App in Settings and the prompt isn't available, the app opens the HabitBox page on the App Store or Google Play inside the app.
Crash reports from Apple and Google. If you chose in your phone's settings to share analytics with app developers, Apple or Google may give us crash reports and combined usage statistics through App Store Connect and Google Play Console. You control this in your phone's settings (on iPhone: Settings > Privacy & Security > Analytics & Improvements).

8. Website: hosting and server logs

The website is hosted by Vercel Inc. (USA). When you open a page, Vercel receives your IP address, browser and device details, the page address, the page you came from and the time. Vercel keeps these request logs for a limited time under its own settings. We use them only to run the site and keep it secure. Vercel does not set cookies for us.

The website has no accounts, sign-up forms, newsletter, comments or contact form.

9. Website: analytics (Fathom only)

The only analytics tool on our website is Fathom Analytics. We don't use Google Analytics, Google Tag Manager, the Meta (Facebook) Pixel or any other tracking or advertising tool.

Provider: Conva Ventures Inc. (Canada), as our processor. Fathom counts page views and records the page address, the site you came from, campaign tags in the address, and general browser, device and country information. It also records a few events we set up: clicks on our App Store and Google Play buttons (and where on the page the button was), visits through our QR code, when our "before you go" pop-up is shown, and clicks on app links in blog posts.

Fathom does not use cookies or save anything on your device, and it doesn't build a profile of you or follow you to other websites. It turns your IP address and browser details into a scrambled code (a hash) that changes every day, and it doesn't keep your raw IP address in its analytics. For visitors in the EU, this step happens on servers in the EU. Fathom says it keeps raw data for no longer than 24 hours. We only see combined statistics, such as how many people viewed a page. See Fathom's privacy policy.

Some of our articles and tools cover health topics, such as alcohol, sleep or mental health, so the page address Fathom counts shows which pages were visited, but not by whom. Our tools run entirely in your browser. What you type into them is not sent to us and is not added to the page address.

Our tool pages also offer code that other websites can use to embed some of our free tools. An embedded tool is counted by Fathom in the same way.

If you don't want to be counted, you can use a content blocker, most of which block Fathom, or email us to object (section 21).

10. Website: cookies and browser storage

Our website sets no cookies, and neither does Fathom, Vercel or Cloudflare. (YouTube may store data in your browser if you press play on a video; see section 11.)

Browser storage. Our own code uses your browser's local storage to:

remember that you closed a promo banner (for 24 hours) or our "before you go" pop-up (for 30 days, or for good after you tap our store link);
save your progress in some tools, such as your Pomodoro count, your plank best time and challenge day, and your two-minute-timer counts (the name of that entry includes the first few words of the task you typed).

This data stays in your browser, and we never receive it. You can clear it at any time in your browser settings.

11. Website: images, videos and share links

Blog images. Many images in blog posts load straight from our image storage at files.screensnap.pro, which runs on Cloudflare (Cloudflare, Inc., USA). Your browser then sends Cloudflare your IP address, browser details and our site's address. No cookies are set. Other images on the site are delivered through Vercel.
YouTube videos. Posts with a video show a preview image from YouTube's servers (i.ytimg.com). The preview loads without a click and sends Google your IP address and browser details. The video player loads only when you press play, from youtube-nocookie.com. Once it plays, YouTube may store data in your browser under Google's Privacy Policy.
Sharing on X. Two quizzes let you share your result on X (formerly Twitter). This happens only if you click. Your result text goes into the link to X, and X's privacy policy applies there.
Other websites. Links to other websites, such as sources in our articles, are covered by those websites' own policies.

12. Store links and campaign tags

Our App Store and Google Play buttons add a short campaign tag to the link, so we can see which part of the website leads to downloads.

App Store links include pt=124948386 (our Apple provider number), ct= followed by a placement name such as web_home or web_footer, and mt=8 (Apple's code for apps).
Google Play links include a referrer value with utm_source=habitbox_web, utm_medium=website and utm_campaign= followed by the same kind of placement name.

These tags only say where on our site the button was. They contain nothing about you. Apple and Google may connect the tag to your visit to the store and your download. They then show us totals, such as how many downloads came from the website footer, in App Store Connect and Google Play Console. What happens on the store pages is covered by Apple's and Google's own privacy policies. Fathom also counts clicks on store buttons (section 9).

13. When you email us

If you email support@habitbox.app, we receive your email address, your name if your email shows it, your message, any attachments (for example a screenshot or an exported habits file you choose to send) and the time you sent it. We use this only to reply and help you, and to spot common problems. Our mailbox is hosted by Proton AG in Switzerland.

Please don't send more personal or health details than you need to. We keep support emails for up to 2 years after our last exchange, then delete them. We keep an email longer only if we need it for a legal claim or the law requires it.

14. No selling of data, no ads in the app

We don't sell personal data, and we don't pass it to data brokers.
The app shows no ads. Apart from RevenueCat (section 5) and the Apple Ads attribution (section 6), it contains no advertising or analytics software. It doesn't use your phone's advertising ID and doesn't track you across other companies' apps and websites.
Our only advertising-related processing is the Apple Ads attribution in the iPhone app (section 6). Apart from the YouTube player, which loads only if you press play on a video (section 11), the website runs no advertising or tracking tools.

15. Why we use data (legal bases)

Data protection law (the GDPR) says we need a legal basis for each use of personal data. Here are ours.

What we do	Legal basis
Syncing your habits with your own iCloud (iPhone)	Contract (Art. 6(1)(b)): it is a feature of the app you use. The data goes to your iCloud, not to us.
Checking your plan, and selling and restoring HabitBox Plus through Apple, Google and RevenueCat	Contract (Art. 6(1)(b)): providing the app and its free and paid plans.
Apple Ads attribution (iPhone), and overall sales figures from RevenueCat, Apple and Google	Legitimate interests (Art. 6(1)(f)): knowing which of our own Apple Ads campaigns work and how HabitBox Plus sells, without tracking you across other apps.
Crash reports and usage statistics from Apple and Google (only if you chose to share them)	Legitimate interests (Art. 6(1)(f)): finding and fixing bugs.
Answering your emails	Legitimate interests (Art. 6(1)(f)): helping you. Contract (Art. 6(1)(b)) when your email is about a purchase.
Health details you choose to include in an email, a survey answer or an exported file you send us	Your explicit consent (Art. 9(2)(a)), given by choosing to send them. We use them only to help you, and you can ask us to delete them at any time.
Feedback survey	Legitimate interests (Art. 6(1)(f)): improving the app. Taking part is optional.
Running the website and keeping it secure (Vercel logs)	Legitimate interests (Art. 6(1)(f)): delivering the site and protecting it from abuse.
Cookie-free statistics (Fathom)	Legitimate interests (Art. 6(1)(f)): learning which pages help people and which store buttons get clicked.
Remembering closed pop-ups and saving your tool progress in your browser's storage (section 10)	Legitimate interests (Art. 6(1)(f)): making the features you use work. This storage is needed for those features and never leaves your browser.
Showing blog images and video previews	Legitimate interests (Art. 6(1)(f)): showing the content of our articles.
Playing a YouTube video or sharing a quiz result on X	Consent (Art. 6(1)(a)): these happen only when you click.
Campaign tags on store links	Legitimate interests (Art. 6(1)(f)): knowing which parts of our site lead to downloads. The tags carry no data about you.
Meeting legal duties, such as keeping tax and accounting records, and handling legal claims	Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)).

Where we rely on legitimate interests, you have the right to object (section 21).

Do you have to give us data? No law requires you to give us personal data, and you can use HabitBox without an account. But the app needs the RevenueCat connection in section 5 to know which plan you have, so it happens whenever you use the app. To buy or restore HabitBox Plus, purchase data has to pass through Apple or Google and RevenueCat. Without it, we can't deliver Plus. Emailing us and taking the survey are optional.

Automated decisions. We don't make decisions about you based only on automated processing, including profiling, that have legal or similarly significant effects on you.

16. How long we keep data

Data	How long
Habits, settings and automatic backups on your phone	Until you delete them or the app. The app keeps only the last 7 daily backup files.
HabitBox data in your iCloud (iPhone)	Until you delete it from iCloud (section 21). Deleted habits stay there as "deleted" records until then.
Android device backup	Controlled by Android and your Google account.
Purchase and Apple Ads attribution data at RevenueCat	As long as we use RevenueCat for HabitBox purchases, so that purchases can be checked and restored (a Lifetime purchase has no end date). We delete a record on request when we can find it, unless the law requires us to keep it.
Sales reports, crash reports and usage statistics from Apple and Google	As long as Apple and Google keep them in App Store Connect and Google Play Console. Any copies we keep for our accounts: as long as tax and accounting law requires.
Support emails	Up to 2 years after our last exchange. Longer only if needed for a legal claim or required by law.
Feedback survey answers (Tally)	Up to 2 years, then deleted.
Website request logs (Vercel)	A limited period set by Vercel.
Fathom	Raw IP address and browser details: no longer than 24 hours. Combined statistics: as long as we use Fathom.
Browser storage set by our own code	Until you clear it in your browser.

When we stop using a service listed here, we delete our data held with it, unless the law requires us to keep it.

17. Who receives data

We share data only with the companies below, and only for the purposes in this policy. Processors act on our instructions. Independent controllers decide for themselves how they use data, under their own privacy policies.

Recipient	Role	What they receive
RevenueCat, Inc. (USA)	Processor: purchase checks and subscription management	Anonymous app user ID, purchase information, device model, OS and app version, language settings, store country, identifier for vendor (iPhone), last-opened time, Apple Ads attribution (iPhone), IP address
Apple	Independent controller: App Store, payments, iCloud, Apple Ads, rating prompt	Payment and purchase data; your HabitBox data in your private iCloud database (which we can't access); Apple Ads attribution
Google (Google Play and Android)	Independent controller: Google Play, payments, Android backup, rating prompt	Payment and purchase data; your Android device backup, if you turned it on (which we can't access)
Tally BV (Belgium)	Processor: feedback survey	Your survey answers, IP address and browser details
Proton AG (Switzerland)	Processor: email hosting	Emails you send us
Vercel Inc. (USA)	Processor: website hosting	IP address, browser details, page address, referring page, time
Conva Ventures Inc. (Fathom) (Canada)	Processor: cookie-free website analytics	Page and event data; IP address and browser details, hashed
Cloudflare, Inc. (USA)	Processor: blog image storage and delivery	IP address, browser details, our site's address
Google (YouTube)	Independent controller: video previews and player	IP address and browser details; playback data if you press play
X Corp.	Independent controller, only if you share a quiz result	The result text you choose to share

Each processor works under a data processing agreement, usually part of its standard terms. The agreement lets it use the data only to provide its service to us, and requires it to keep the data confidential and secure as the GDPR requires, giving it the same protection this policy describes. Apart from our website pages that open inside it (section 7), the app shares data only with RevenueCat and Tally (processors) and with Apple and Google (the platforms it runs on).

We may also share data:

if the law requires it, for example with a court, the tax authority or another public authority;
with professional advisers, such as an accountant or a lawyer, only as far as they need it and under a duty of confidentiality;
if HabitBox is sold or passed to someone else. The new owner would receive only the data we hold (such as support emails and purchase records at RevenueCat) and would have to follow this policy. We will tell you on the website before this happens.

18. Transfers outside the EU

Some recipients are outside the European Economic Area (EEA). When data goes there, it is protected as follows.

Recipient	Where	Safeguard
RevenueCat	USA (Amazon Web Services)	Standard Contractual Clauses approved by the European Commission, in RevenueCat's data processing agreement. RevenueCat is not certified under the EU-US Data Privacy Framework.
Google (YouTube previews and player)	USA	EU-US Data Privacy Framework (Google LLC is certified)
Vercel	USA (pages are served from nearby servers, for example in Paris)	EU-US Data Privacy Framework (Vercel Inc. is certified)
Cloudflare	USA and worldwide network	EU-US Data Privacy Framework (Cloudflare, Inc. is certified)
Fathom	Canada. For visitors in the EU, Fathom hashes the IP address on EU servers first, so the data it then stores with Amazon Web Services in the USA no longer contains your IP address. Fathom treats that data as anonymous. For visitors outside the EEA, Fathom processes data with Amazon Web Services in the USA.	EU adequacy decision for Canada. For its own service providers, Fathom's data processing agreement binds them to the same obligations.
Proton	Switzerland	EU adequacy decision for Switzerland

Tally stores survey answers in the EU (Belgium). Some of Tally's own service providers are in the USA, for example Cloudflare for bot protection; see Tally's GDPR page. Apple and Google handle transfers of the data they control under their own terms.

The EU-US Data Privacy Framework is currently being challenged in court. If it stops applying, we will rely on the Standard Contractual Clauses instead. You can ask us for a copy of the safeguards for any transfer by emailing support@habitbox.app.

19. Security

The best protection is not collecting data in the first place. Your habits never reach our systems unless you send them to us.
Data on your phone is protected by your phone's own security, such as your passcode and device encryption. Data in iCloud is protected by Apple.
The app talks to RevenueCat over encrypted connections, and RevenueCat encrypts data in transit.
The website works only over HTTPS. It uses HSTS and other security headers, and it blocks access to your camera, microphone and location.
Access to our service accounts (RevenueCat, analytics and email) is limited to the developer.

No system is perfectly secure. If a data breach puts your rights at risk, we will tell you and the authorities as the law requires.

20. Children

HabitBox is rated 4+ on the App Store and "Everyone" on Google Play, and the app doesn't ask for your age. The app does not ask anyone for a name, email address or contact details. Habit data stays on the phone, in the user's own iCloud on iPhone, and in any device backups the user makes.

In Portugal, children under 13 can't give valid consent to online services by themselves (Lei n.º 58/2019, article 16). Where we rely on consent, a parent or guardian has to give it for a child under 13. Other EU countries set this age between 13 and 16. If you are under that age where you live, please ask a parent or guardian before you email us or fill in the survey.

Purchases go through Apple or Google. Parents can use Apple's Ask to Buy or Google Play's parental controls to approve purchases. If you think a child has sent us personal data, email us and we will delete it.

21. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you and get a copy;
correct data that is wrong;
delete your data;
restrict how we use it;
data portability: receive data you gave us in a common machine-readable format, where we use it based on consent or contract;
withdraw consent at any time, where we rely on it. This doesn't affect what happened before you withdrew;
not be subject to decisions based only on automated processing that have legal or similarly significant effects (we don't make any).

Your right to object

Where we rely on legitimate interests (see section 15), you can object at any time for reasons related to your situation. We will then stop, unless we have compelling legitimate grounds or need the data for a legal claim. You can always object to the use of your data for direct marketing, and we will then stop.

How to use your rights

Email support@habitbox.app. It's free. We answer within one month. If a request is complex, we may need up to two more months, and we will tell you why. We may ask for information to confirm the request is yours.

Because HabitBox has no accounts, we often can't link data to a person. For example, to find your purchase record at RevenueCat, we will usually need the order ID from your Apple or Google receipt. If you never bought anything, your record at RevenueCat is linked only to a random ID that you can't see, so we may not be able to find it. If we can't identify you, we will tell you. In that case the law doesn't require us to act on the request unless you give us details that let us find your data.

Data we don't hold

Most HabitBox data never reaches us, so you control it directly:

On your phone: edit or delete habits in the app. Deleting the app deletes all its data on the phone, including the automatic backups. On Android you can also use your phone's app settings to clear HabitBox's storage.
iCloud (iPhone): to delete HabitBox's data from iCloud, first delete the app or turn off iCloud for HabitBox (section 3), so the app doesn't upload it again. Then open the iOS Settings app, tap your name, then iCloud, then Manage Account Storage (called Manage Storage on some versions). Choose HabitBox and delete its data. This also removes habits you deleted earlier that are still stored as "deleted" records.
Android backup: manage or delete it in your phone's backup settings or your Google account.
Exported files: delete them wherever you saved them.
Purchases: Apple and Google hold your payment and purchase history. Contact them for their records.
Website: clear browser storage for habitbox.app in your browser settings.

UK and US users

If you are in the UK, you have the same rights under the UK GDPR, and you can complain to the Information Commissioner's Office (ico.org.uk).

If you live in a US state with a privacy law, such as California, you can ask to know, correct or delete your personal data by emailing us. We don't sell personal data. We won't treat you differently for using your rights.

22. Complaints

We would like to hear from you first at support@habitbox.app, so we can try to fix the problem. You also have the right to complain to a data protection authority, in particular in the EU country where you live, work or where the problem happened. Our lead authority is the Portuguese one:

Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal
Phone: +351 213 928 400
Email: geral@cnpd.pt
Website: www.cnpd.pt
Complaint form: www.cnpd.pt/cidadaos/participacoes

23. Changes to this policy

We will update this policy when the app, the website or the law changes. The date at the top shows the latest version. If we make important changes, we will point them out on the website or in the app's update notes. Before we use your data for a new purpose, we will tell you first.

24. Contact us

Iaroslav Morgunov, trading as Last Stand Studio
Rua Alfredo Keil 571, 4150-047 Porto, Portugal
Email: support@habitbox.app
Phone: +351 924 331 054
NIF: 310038588