Privacy Policy

1. Who we are

Habiroot (formerly “Roots – Streak Tracker”) is a habit-tracking app published by the independent developer of Habiroot (“we”, “us”). We are the controller of the personal data described here. Questions about privacy can go to [email protected].

This policy covers the Habiroot app for iPhone and Apple Watch, its widgets, and this website. It explains what we collect, why, who processes it, how long we keep it and the choices you have.

2. Data stored in your Habiroot account

To sync your habits and keep them safe if you change phones, Habiroot uses an account. Account data is stored with our backend provider, Supabase.

Sign-in information

• Sign in with Apple: a stable identifier from Apple, your email address (which can be an Apple private relay address if you choose “Hide My Email”), and your name if you choose to share it the first time you sign in.
• Sign in with Google: your email address, name and profile picture link, as provided by Google.
• Name and password: the name you choose (saved as an internal identifier, not a real email address) or the email address you enter, and your password, which our provider stores only as a salted hash.
• Technical account records kept by our provider for security, such as when the account was created, sign-in times, and the IP address and device type used to sign in.

Profile

• Your display name, email address and (for Google accounts) profile picture link.
• Whether your account has Habiroot Plus, and the product and date of your latest purchase, so that Plus works on every sign-in.

Habits

• For each habit: its name, whether you’re building or quitting it, its current streak, the date you last completed it (or last slipped, for habits you’re quitting), when it was created, whether it’s paused, how it’s chained to other habits, and whether a reminder is on and at what time.

Habit names are whatever you type. Please don’t put sensitive information in them that you wouldn’t want stored on a server.

3. Data that stays on your device

Some data never leaves your iPhone (or your paired Apple Watch). We don’t receive it:

• Your garden: which plant each habit grows and which species you own.
• Your coins and the milestones you’ve been rewarded for. (If you buy a coin pack, the purchase itself is recorded by Apple or Google and RevenueCat, as described under Purchases.)
• Focus sessions, focus history and custom focus projects.
• Preferences such as sounds and the evening review reminder, and scheduled notifications.
• Widgets and Apple Watch: the app shares today’s progress, your running focus timer and today’s habits with its own widgets through an on-device App Group, and with Habiroot on your paired Apple Watch through Apple’s Watch Connectivity. This data moves between your own devices only.
• App blocking (when available): blocking uses Apple’s Screen Time frameworks (Family Controls, Device Activity and Managed Settings). The apps, categories and websites you pick are stored by iOS as opaque tokens that Habiroot cannot read or turn into app names, and blocking runs entirely on your device. No information about your app usage is sent to us or anyone else.

Because this data is stored on the device, it’s removed when you delete the app, and it doesn’t transfer to a new phone.

4. Purchases

Habiroot Plus is sold through Apple’s App Store. Apple processes the payment; we never receive your card or bank details. We use RevenueCat to validate purchases, restore them and know whether your account has Plus. RevenueCat receives your Habiroot account identifier, App Store transaction information (such as the product, purchase and renewal dates, price, currency and store country) and basic technical information (such as app version, operating system and IP address).

5. Notifications and other device features

• Reminders are local notifications scheduled on your iPhone. We don’t use push notifications and don’t collect a push token.
• Ratings: the app may show Apple’s standard rating prompt. Apple handles it; we only see ratings and reviews that you post publicly on the App Store.
• Feedback you send by email (including from the app) reaches us with your email address and whatever you write. We use it to reply and to improve the app.

6. No analytics, ads or tracking

Habiroot doesn’t include advertising, analytics, attribution or crash-reporting SDKs, and we don’t track you across other companies’ apps or websites. If you’ve chosen to share analytics with app developers in your iPhone’s settings, Apple may give us aggregated, anonymous usage and crash statistics through App Store Connect.

7. How we use data, and our legal bases

• To provide the app (your account, sync, habits, streaks, Plus): necessary to perform our contract with you.
• To keep the service secure, prevent abuse and fix problems: our legitimate interest in running a safe, working service.
• To answer support requests and feedback: our legitimate interest, or your request.
• Optional permissions (notifications, Screen Time access, sharing your name with Sign in with Apple): your consent, which you can withdraw at any time in your iPhone’s Settings.
• To meet legal obligations, such as responding to lawful requests.

We don’t sell personal data, and we don’t use it for advertising or profiling.

8. Service providers

We share data only with providers that help us run Habiroot, under contracts that limit how they can use it:

• Supabase: sign-in, database and server functions (including account deletion).
• RevenueCat: purchase validation and subscription status.
• Apple: App Store payments, Sign in with Apple, Screen Time, widgets and Apple Watch.
• Google: only if you choose Sign in with Google.
• Our website host (Cloudflare or Vercel), which processes IP addresses to deliver this website securely.

We may also disclose information if required by law, or to protect the rights and safety of our users or others.

9. International transfers

Our providers may process data in the United States and other countries outside where you live. Where the law requires it, transfers are protected by safeguards such as the European Commission’s Standard Contractual Clauses.

10. How long we keep data, and deleting your account

• We keep account, profile and habit data for as long as your account exists.
• Delete your account in the app: open your profile, tap Delete Account and confirm. This immediately and permanently deletes your habits, your profile and your sign-in account from our database. Copies in our provider’s encrypted backups are overwritten in the normal backup cycle, within 30 days.
• If you can’t use the app, email [email protected] and we’ll delete your account for you after confirming it’s yours.
• Deleting your account doesn’t cancel an App Store subscription; cancel it in your iPhone’s Settings. Apple and RevenueCat keep transaction records as required for accounting, tax and fraud prevention. You can ask us to delete your RevenueCat customer record too.
• Data stored only on your device is removed when you delete the app.
• Support emails are kept as long as needed to help you, and deleted on request.

11. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy of it;
• correct inaccurate data (you can edit your name and habits in the app);
• delete your data (see section 10);
• object to or restrict certain processing, and withdraw consent;
• receive your data in a portable format;
• complain to your local data protection authority.

To use these rights, email [email protected]. We’ll respond within one month, or sooner if your local law requires. California residents: we don’t sell or share personal information for cross-context behavioral advertising, and we won’t treat you differently for exercising your privacy rights.

12. Security

Data travels between the app and our providers over encrypted connections (HTTPS/TLS), and access to the database is restricted to authorized systems. Your session is stored on your device. No system is perfectly secure, so please use a strong, unique password if you sign in with a name and password.

13. Children

Habiroot isn’t directed at children under 13, and we don’t knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we’ll delete it.

14. This website

This website doesn’t use cookies, analytics, advertising or local storage. Our hosting provider processes your IP address and request details in its logs to deliver the site and protect it from abuse. Links to the App Store and other sites are governed by those sites’ own policies.

15. Changes to this policy

We’ll update this page if our practices change and revise the “Last updated” date above. If a change is significant, we’ll also let you know in the app.

16. Contact

Email: [email protected]