This policy explains what Habikai collects, why, where it is stored and the choices you have. It covers the Habikai app on Android, the web app at app.habikai.com and this website. "Habikai", "we" and "us" mean the team that operates the service.
The short version
- We collect what you put into the app so the app can work for you on every device.
- Your text fields are encrypted at rest. We do not sell your data, show ads or use it for advertising.
- Some features send data to a service provider (for example the AI assistant). We say exactly which ones below.
- You can ask us for a copy of your data or to delete it at any time.
1. Information we collect
Account. Your email address, display name, username and a securely hashed password. We also keep the session tokens that keep you signed in.
Content you create. Everything you add to the app: habits and their entries, tasks, goals, rewards, journal entries and moods, notes, phrases, lifts and workouts, meals and nutrition, drinks sessions and your drinks profile, books, videos and audios you track, contacts and meetings you log, places, tours, visits and events, finance records (wallets, expenses, splits, investments), wishlist and closet items, photos and files you upload, chat conversations with the AI assistant and the memories it keeps, your identity answers and body measurements, and your game progress (XP, credits, gear, robots, crops and runs).
Health and wellbeing information. Some of this content can describe your health, for example workouts, meals, drinks, sleep habits, moods or body measurements. You choose whether to enter it. We use it only to provide the features you use, never for advertising, and it is stored encrypted like the rest of your content.
Device permissions (only when you use the feature).
- Camera and photos: to attach photos you choose, for example receipts, clothes or places.
- Location: only when you ask for your current position, for example when adding a place. We do not track your location in the background.
- Contacts: only when you use Import Contacts. Only the contacts you select are uploaded, with their name and first phone number or email.
- Microphone: for the dictation button. Speech recognition is handled by your device's speech service.
- Notifications: reminders are scheduled locally on your device.
Technical information. To keep the service secure and working we record a basic log of requests to our server (the route, the time and your account ID) and crash reports from the app (the error and the screen it happened on). We do not record the content of your requests in these logs.
2. How we use it
- To provide the app: store your data, sync it across your devices, calculate streaks, XP and rewards, and send the reminders you set.
- To run the features you turn on, such as AI news briefs, social digests, tour itineraries, event listings and the AI assistant.
- To keep the service secure, prevent abuse, and fix bugs and crashes.
- To reply when you contact us.
We do not use your data for advertising, we do not sell it and we do not build profiles of you for anyone else.
3. How it is stored and protected
Your data is stored in a PostgreSQL database on servers we operate. Text fields that hold your content are encrypted individually with AES-256-GCM before they are written, and uploaded files are encrypted before they are stored in object storage (Cloudflare R2). Data in transit is protected with TLS. Deleted items are first marked as deleted and hidden from every view; deleting your account removes your data permanently.
The app also keeps a cache of what you have opened on your device so it works offline. Signing out clears that cache.
4. Who we share it with
People you choose. When you share an item, a group or a resource with another user, they can see it with the role you gave them (viewer or editor). You can revoke access at any time.
Service providers that help us run Habikai, only for the purpose described:
- Hosting and storage: our server hosting provider and Cloudflare (website hosting and encrypted file storage).
- AI providers (OpenRouter and OpenCode): when you use the AI assistant, your message and the parts of your app data you allow it to see are sent to the AI model to generate a reply. Background features like news briefs and social digests send public articles and posts, not your personal content.
- Maps and geocoding (Mapbox and OpenStreetMap Nominatim): receive the place you search for or the coordinates you pick.
- Content sources: when you search for books (Project Gutenberg), videos (YouTube), shows and movies (TVMaze, Cinemeta), or place photos (Wikimedia), our server sends your search terms to that source.
- App updates (Expo): delivers app updates to your device. It does not receive your content.
We may disclose information if the law requires it, or to protect the safety of our users or the service. If Habikai is ever transferred to a new owner, this policy will continue to apply to your data.
5. How long we keep it
We keep your account and content for as long as your account is active. Technical logs are kept only as long as needed to operate and secure the service. When you delete your account, your data is removed from our database and storage; encrypted backups roll over and are erased within 30 days.
6. Your rights and choices
Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California), you have the right to access, correct, export or delete your personal data, and to object to or restrict how we process it. You can edit or delete most content directly in the app. For anything else, including a copy of your data, email support@habikai.com. We will reply within 30 days. You also have the right to complain to your local data protection authority.
We process your data to provide the service you signed up for (performance of a contract), to keep it secure (legitimate interest), and, for optional features like the AI assistant or contacts import, because you chose to use them (consent, which you can withdraw by not using or turning off the feature).
7. Children
Habikai is not directed to children under 13 (or under 16 where local law requires it), and we do not knowingly collect their data. Features like the drinks tracker are meant only for adults of legal drinking age. If you believe a child has given us data, contact us and we will delete it.
8. International transfers
Our providers may process data in countries other than yours. When they do, we rely on appropriate safeguards such as standard contractual clauses.
9. This website
This website uses no cookies, no analytics and no third-party scripts. Fonts and images are served from our own domain. Our host, Cloudflare, may process your IP address to deliver the page and protect it from attacks.
10. Changes
If we change this policy we will update the date at the top, and for meaningful changes we will tell you in the app before they take effect.
11. Contact
Questions about privacy: support@habikai.com.
