Privacy Policy

1. Controller

Controller within the meaning of Article 4(7) GDPR:

Rebekka Orth Software Solutions, Dorotheenstrasse 188, 22299 Hamburg, Germany; Email: habiton-business@outlook.com; Telephone: 01607907210; We are not required to appoint a data protection officer under Article 37 GDPR and have not appointed one voluntarily.

2. Overview

Habiton is built so that your data stays on your device. The app has no user account, sends nothing to us, and contains no analytics or tracking.

Three things happen outside your device, and all three are described below: the website serving this page produces server log files (section 3), Apple handles your purchase (section 8), and any email you send us reaches us through our email provider (section 11).

3. The website: hosting and server log files

This page is hosted by Netlify, Inc., 101 2nd Street, Suite 300, San Francisco, CA 94105, USA.

When you access it, Netlify automatically records the information your browser transmits: the IP address of the requesting device, the date and time of the request, the page requested, the volume of data transferred, the referrer URL, and your browser type and operating system.

This is necessary in order to deliver the page and to keep the service stable and secure. It is not combined with other data and is not used to identify you.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is the technically sound and secure presentation of our website.

Retention: log data is retained by Netlify only for as long as is necessary for delivery, stability and security, and is then deleted, unless it is needed to investigate a specific security incident.

Netlify acts as our processor under Article 28 GDPR on the basis of its data processing addendum, which forms part of its terms of service.

Transfer to the United States. Netlify processes this data in the USA. Netlify, Inc. is certified under the EU–U.S. Data Privacy Framework, so the transfer takes place on the basis of the European Commission's adequacy decision of 10 July 2023 under Article 45(1) GDPR. Netlify's data processing addendum additionally incorporates the European Commission's standard contractual clauses under Article 46(2)(c) GDPR, which apply should the adequacy decision cease to be available.

Netlify's own privacy policy: https://www.netlify.com/privacy/

4. Cookies and consent

This website sets no cookies and uses no analytics or tracking of any kind.

Nothing is stored on your device and no information is read from it, so no consent is required under § 25(1) TDDDG and no consent banner is shown. The server log files described in section 3 are not an exception: they consist of data your browser transmits in the ordinary course of requesting the page, recorded on the server, and involve no access to your device.

5. Data on your device

The app stores the following in its protected storage area on your device: the name you enter, your habits (title, days, time, chosen form of proof), your setup answers, your pledge, your history of confirmed and missed days, your streak, and app settings.

None of this is transmitted to us or to anyone else. The app makes no network requests to any server operated by us. We have no technical means of accessing this data — not individually, not in aggregate, not in anonymised form, and not on request.

Retention: the data stays on your device until you delete the habit concerned or the app itself. We cannot delete it for you, because we do not hold it.

6. Camera and proof photos

To confirm a habit, the app opens the camera and you take a photo.

The photo is taken live; the app has no access to your photo library and does not request it. It is analysed on your device using image analysis provided by the operating system. No image data is transmitted to us or to any third party. Only the result is recorded — confirmed or not confirmed — and the photo itself is deleted after analysis. It is not saved to your photo library and not kept inside the app.

You decide what you photograph and are responsible for the rights of any third parties depicted.

7. Automated evaluation

The evaluation described in section 6 is automated: software decides, without human involvement, whether a habit counts as confirmed.

It runs exclusively on your device and produces neither legal effects concerning you nor any comparably significant impairment within the meaning of Article 22(1) GDPR — the result affects only a counter inside the app, which you can change or delete at any time. Article 22 GDPR therefore does not apply.

No profiling within the meaning of Article 4(4) GDPR takes place: no personality profile is built and no prediction about you is made.

8. Purchases

Use of the app requires a paid subscription. Payment runs exclusively through Apple's in-app purchase system.

Apple is the seller. Apple handles the payment method, billing, tax and refunds, acting as an independent controller. We receive no name, no email address and no payment data. The app learns only whether a valid subscription exists.

Legal basis: Article 6(1)(b) GDPR — performance of the contract for use of the app.

The contracting party for purchases within the European Union is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Apple's own privacy policy governs its processing: https://www.apple.com/legal/privacy/

We use no third-party service for payment or subscription management.

9. Aggregate App Store statistics

Apple provides every developer with aggregated statistics in App Store Connect, such as download figures by country and the number of active subscriptions.

This information reaches us in aggregated form only. It does not enable us to identify any individual user, and we have no means of establishing such a link — we receive no names, no email addresses and no device identifiers with it.

We therefore hold no personal data within the meaning of Article 4(1) GDPR from this source.

10. Device permissions

You can grant or withdraw each permission at any time in your device settings. Granting them is voluntary; refusing has no consequence beyond the loss of that function.

11. Contact by email

If you write to us, we process your email address and the content of your message solely in order to deal with your enquiry.

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in answering enquiries addressed to us; and Article 6(1)(b) GDPR where your enquiry concerns a contract.

Retention: your message is deleted once the matter is closed, unless statutory retention periods apply.

Our email address is operated by Microsoft (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland), which receives the content of your message in the course of transmitting and storing it.

12. Recipients

Apart from what is described above, no data is passed on. Nothing is sold, no advertising network is used, and there is no tracking of any kind.

The only recipients are Netlify (section 3) as our processor, Apple (section 8) as an independent controller, and Microsoft (section 11) as the operator of our email service.

13. No analytics, no tracking

The app contains no analytics software, no crash reporting, no advertising identifier and no attribution tool. No processing based on consent under Article 6(1)(a) GDPR takes place within the app.

The website carries no analytics either. We do not measure visits, and we hold no statistics about who reads this page. The server log files described in section 3 are produced by our host in order to deliver the site and are not evaluated by us for any other purpose.

14. Backups

Because the data in section 5 is stored on your device in the ordinary way, it is included in your device backups — iCloud or an encrypted local backup — if you have enabled them. Those backups are yours and are administered by Apple under Apple's terms. We have no access to them and can neither retrieve nor restore your data.

15. Special categories of data

Information about habits may relate to health, and information of that kind can fall within Article 9(1) GDPR.

Whatever its classification, this information stays where you entered it. As set out in section 5, it is not transmitted to us, we do not receive it, and we have no technical means of accessing it. We hold no health-related information about you, and there is none in our hands to use, disclose or delete.

16. Your rights

You have the right to information (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), objection (Article 21), withdrawal of consent with effect for the future (Article 7(3)) and to lodge a complaint with a supervisory authority (Article 77).

Please note that we hold almost no data about you. What is described in section 5 is on your device: you can view, change and delete it yourself in the app at any time, and deleting the app removes all of it.

To exercise a right, write to habiton-business@outlook.com. We will respond within one month of receiving your request. Where a request is unusually complex, Article 12(3) GDPR allows that period to be extended by up to two further months; if that is ever necessary we will tell you within the first month, and tell you why.

Right to object. Where we process data on the basis of Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop that processing unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms.

Supervisory authority. The authority competent for us is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, https://datenschutz-hamburg.de. You may also complain to the authority for your habitual residence or place of work.

17. Obligation to provide data

You are under no statutory or contractual obligation to provide personal data. Using the app requires you to give us none. If you decline a permission under section 10, only that function is unavailable.

18. Minors

The app is not directed at children. You must be at least 16 to use it, and if you are under 18 the paid subscription requires the consent of a parent or guardian; our terms of service set this out.

We do not knowingly process data concerning persons under 16. As section 13 records, we currently carry out no processing that rests on consent at all. Should that ever change, consent from a person under 16 would require the authorisation of a parent or guardian (Article 8(1) GDPR in conjunction with § 22 BDSG).

19. Users outside the European Union

This policy is written to the standard of the GDPR, which we apply to everyone who uses the app, wherever you are.

The app transmits nothing. We receive no personal data through it, so there is nothing in it for us to disclose, sell, share or delete. In particular, we do not sell or share personal information within the meaning of the California Consumer Privacy Act, and we do not process personal information for behavioural advertising, profiling or automated decision-making under any law.

Two exceptions, both described above. Visiting this website produces server log files at our host (section 3), and writing to us means we hold your message (section 11). Those are the only circumstances in which we hold anything about you.

Whichever law applies where you live, a request relating to that information — for access to it, correction of it, or its deletion — is handled in the same way and at the same address as a request under section 16. We will not treat you differently for making one.

20. Amendments

We will amend this privacy policy if the app or the legal position changes. The version in force is the one dated above.

Where an amendment concerns something material — in particular the introduction of analytics, a user account, the storage of proof photos, or a further processor — we will publish the amended version here before releasing the app version that makes it necessary, so that it is available to you before any new processing begins.

Because the app has no user account and we hold no contact details for you, we cannot write to you individually about a change. That is a consequence of collecting nothing, and we prefer it that way. The date at the top of this page is the reliable way to see whether anything has changed.