Privacy Policy
HabitChallenge is a one-person project. We collect the minimum we need to run the Service and we never sell your data. This page explains what we store, why, and how to delete it.
What we collect
- Email address — used to sign you in via magic link and send challenge reminders. We never share or sell it.
- Your name — only what you type into the onboarding form.
- Habit data — the daily habits you log, scores, streaks. Private to your account.
- Tribe membership — if you join or create a tribe, we store that association and your display name is visible to other tribe members (but not your email).
- Payment status — whether you have paid for Pro access. We do not store your card details; Stripe handles those.
- Referral codes — your personal code and any code you used at signup, for the referral credit system.
- Anonymized usage data — Google Analytics records page views, approximate location (country level), browser type, and session duration. Your IP is anonymized before storage.
What we don't collect
- Browsing activity outside HabitChallenge
- Device identifiers beyond what GA records
- Contacts, calendars, photos, or anything else from your device
- Any health data unless you choose to log it as a custom habit
Who we share it with (the only third parties)
- Supabase — hosts the database and handles authentication (privacy policy)
- Stripe — processes payments (privacy policy)
- Resend — sends reminder emails (privacy policy)
- Google Analytics — anonymized traffic analytics (privacy policy)
- Vercel — hosts the website (privacy policy)
That's the full list. We do not sell your data to anyone, ever.
Email you'll receive
- Sign-in magic links when you request them
- Order and refund confirmations
- Daily challenge reminders (opt-in during onboarding, opt-out anytime from Settings)
- Occasional product updates and major announcements (not more than once a month)
No marketing emails from third parties, ever.
Cookies and local storage
We use browser localStorage to keep you signed in and remember your preferences. We use one Google Analytics cookie for anonymized traffic measurement. We do not use advertising cookies, cross-site trackers, or fingerprinting.
Your rights (GDPR, CCPA, and good sense)
You can at any time:
- Access all data we hold on you — export is one click in Settings → Data
- Correct inaccurate data — edit in the app
- Delete your account and all associated data — Settings → Reset, or email us
- Export your data as JSON — Settings → Data → Download
- Withdraw consent for reminder emails — Settings → Reminders → Off
Data retention
We keep your data while your account is active. If you delete your account, we remove your data from our active systems within 30 days. We may keep anonymized payment records (not linked to you) for up to 7 years to meet legal and accounting obligations.
Data location
Supabase stores your data in the EU (eu-central-1 by default). Stripe and Google may process payment and analytics data in the US and other countries under standard data-protection safeguards.
Children's privacy
HabitChallenge is not directed at children under 16. If you believe a child has provided us with personal data, email us and we will delete it.
Security
We use industry-standard encryption in transit (HTTPS) and at rest (Supabase default). Payments are PCI-compliant via Stripe. We do not store passwords — authentication is magic-link only.
Changes to this policy
If we change this policy materially, we will notify you by email. The "Last updated" date at the top always reflects the most recent change.
Contact
Questions? Email lazurca.va@gmail.com. We respond within a few days.