Privacy policy

1. Who we are

Habitual is made by Wildemark Oy (business ID 3660865-9), Vaniljakuja 1b, 00990 Helsinki, Finland (“we”, “us”), the controller of the personal data this policy describes. Write to us at [email protected]. This policy covers the Habitual app and this website, from October 26, 2026.

2. Your data stays on your phone

Everything you put into Habitual, and your settings, is saved only on your phone. We never receive it and can’t see or recover it. You can change or delete it in the app, and deleting the app deletes it.

• If your phone backs up to iCloud or Google, the backup may include Habitual’s data. Apple or Google keep it under their own terms, and we have no access to it.
• Anything you export or share from the app, such as an export file or a picture, goes only where you send it. Export files hold your data as plain text, so anyone who has one can read it.

3. Permissions

The app asks for a permission only when you use something that needs it, and you can turn each one off in your phone’s settings. Notifications are scheduled on your phone, without a server. For speech input, the microphone is on only while you’re speaking, and your phone’s own speech recognition, Apple’s or Google’s, turns it into text. Apple or Google may process the audio on their servers. The app keeps no audio.

4. Crash reports

When the app crashes or hits an error, it sends a report to Sentry (Functional Software, Inc.) so we can fix it. A report holds technical details only: the error, the app’s version, the phone’s model and system, and a random installation ID. It never holds what you’ve written or tapped. Sentry receives your IP address with the report but is set not to store it or the location it suggests.

5. Purchases

Habitual Plus is bought through the App Store or Google Play. Apple or Google take the payment, and we never see your payment details, name or email address. RevenueCat (RevenueCat, Inc.) checks purchases for us. It receives the store receipts, an anonymous ID created on your phone, technical details such as the app version and the store’s country, and when the Plus offer is shown or used, which gives us sales figures.

6. Email

If you email us, we get your address, your message and anything in it, such as the app and phone details the app adds to a feedback draft. We use them only to reply to you.

7. This website

This website is served by Vercel (Vercel Inc.) through Cloudflare (Cloudflare, Inc.). Like any website, they receive your IP address and browser details to deliver the pages. Cloudflare also runs scripts, and may set a short-lived cookie, to protect the site from bots and spam, and counts visits with Cloudflare Web Analytics, which uses no cookies and doesn’t follow you across websites. If you pick light or dark, your browser remembers it on your device.

8. Legal bases

Under the EU and UK GDPR:

• crash reports, email and the website rely on our legitimate interest in keeping the app and the site working, secure and supported (Article 6(1)(f));
• purchases rely on giving you what you bought (Article 6(1)(b)) and our duty to keep accounting records (Article 6(1)(c)).

We don’t process the data on your phone at all.

9. Where data is kept, and for how long

• Crash reports stay in Sentry’s EU region and are deleted after 30 days.
• Purchase data is kept while your purchases need it and as long as accounting law requires.
• Emails are kept while we need them to help you, or until you ask us to delete them.
• Website logs are kept by Vercel and Cloudflare only as long as they need them to run and secure the site.

RevenueCat, Vercel and Cloudflare are based in the United States, and Sentry is too. Data that goes there is protected by each company’s data processing terms, such as the EU’s Standard Contractual Clauses.

10. Your rights

You can ask to access, correct, delete or receive your data, or to restrict or object to its use, by writing to [email protected]. We’ll answer within one month. As we don’t know who you are, we may ask for something to find your data, such as a purchase’s order number. The data on your phone is already only yours to see, change, export and delete. You can also complain to the Data Protection Ombudsman in Finland or the authority where you live.

11. Children

Habitual is for people aged 13 and over. We don’t knowingly collect children’s data. If a child has written to us, tell us and we’ll delete the email.

12. Changes to this policy

If we start handling data differently, we’ll update this policy and its date. If a change matters, such as new data leaving your phone, we’ll say so in the app first.