Habito Privacy Policy

Policy version: 2026-10-27.1 ยท Effective date: 2026-10-27

Habito helps you discover, try and share everyday habits through 24-hour experiences. This policy explains the information used by the app, where it is stored and the choices available to you. You can read this policy in the app before signing in and without an internet connection.

Information we process

Accounts and sessions

Registration creates a salted password verifier in your account record; the entered password is not saved in that record. The app checks this verifier when you sign in. Credential checking takes place in the app, while the service issues and manages session tokens separately. The service token endpoint does not itself check your password. An issued service token can remain valid for up to 30 days.

Shared content and service storage

Habito uses habito.habito.top for account and application records. Public profiles, published habits, replies and submitted practice records can be read by other signed-in users. Review the information you include before sharing it. Practice records submitted through the service are public; keep confidential information out of shared content.

When you choose an image to upload, the app requests an upload address and sends the selected file to image storage. Uploaded images have public URLs that may be accessible to anyone with the link. Removing a record that references an image does not remove the uploaded file.

Conversation text and read markers are stored separately for each account on this device. They are not uploaded to the application service, transmitted to chat contacts or synchronized between devices. Signing out hides the account's conversations while keeping its saved history on the device. Deleting a conversation removes its saved messages from the app's device storage.

Camera, microphone and other permissions

Opening the camera view requests camera and microphone access through the operating system. Video is displayed on your device, and audio and video streams are processed on the device without being uploaded, recorded to a file or transmitted to another user. Closing the view stops these streams. You can turn the camera off or mute the microphone in the view and change permissions in system settings.

Image selection uses the system image picker. Practice reminders use device notifications when enabled. Habito does not request access to your contacts or GPS location. A city you enter in your profile is profile information, not a device location reading.

Purchases and service providers

Coin purchases use the device's app store payment interface. On iOS, Apple processes the payment through StoreKit. After the store reports a successful purchase, the app records the transaction and credits the corresponding coins to your account. If saving is interrupted, the app retains the pending transaction for retry. Transaction identifiers are used to prevent duplicate credits. Habito does not receive your payment-card number.

Application hosting, image storage and app store services process the information needed for their respective functions. Network connections expose connection details, such as an IP address, to the receiving service. The app does not include an advertising SDK or request advertising tracking permission. Store payment records and device backups are handled separately by their providers.

Your controls and account deletion

You can edit profile information, manage notification and media permissions, delete saved conversations, and use the report and block controls in the app. These controls apply to the data or permissions described by each action.

To delete your account, open Account, select Delete account, enter DELETE and confirm. The app disables the account, marks the account and other owned business records as deleted, clears the account's saved conversation data on this device, and returns to sign-in. If processing is interrupted, the app signs out and retries the remaining cleanup at the next launch or sign-in.

Record deletion is a logical deletion in the service and does not confirm physical erasure of records or backups. Uploaded files are not erased by account deletion. Previously issued service tokens may remain usable outside the app until they expire. Signing out or uninstalling the app does not delete server records. Device backups may retain copies according to your operating system and backup settings.

Retention

Account and application records remain in the service until removed through the applicable controls. Logical deletion does not set a physical-erasure deadline. Uploaded files remain in image storage after their associated records are deleted. Conversation history remains on the device until you delete the conversation, complete account deletion or clear the app's data. Store transaction records and provider logs follow the respective provider's retention arrangements.

Children and safety

Habito is intended for people aged 13 or older, or the higher minimum age that applies where they live. Minors should obtain permission from a parent or guardian before making purchases. Habit content is shared for everyday reflection and is not professional medical, legal or safety advice. Avoid including sensitive personal information in public posts or uploaded images.

Policy updates

The version and effective date above identify this policy. Updates are included in the app and the corresponding website policy. Review the policy when you update the app to understand how information is handled.