Your data. Your choice.

Last updated: July 2026

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Nicki Eliza Schinow
Bachstr. 7
79238 Ehrenkirchen
Germany
Email: info@heyhabits.app

We are not legally required to appoint a data protection officer. For privacy questions, contact the address above directly.

What we collect

When you use hey habits, we collect the following information:

• Account data: your email address and display name, provided when you sign up.
• Habit data: your habits and the "why" behind them.
• Check-ins: the date and time you mark a habit as done.
• Reflections: your answers to the daily reflection questions.
• Coach conversations: messages you exchange with the coach.
• Usage analytics: anonymised data about how you use the app (screens visited, features used) to improve the product. This data is not sold.

What your buddy sees

If you invite a buddy, they can see your history and whether you checked in today. That's all. Your buddy never sees your reflections, your why, or your coach conversations.

How we use your data

We use your data to:

• run the coach feature and tailor answers to your goals.
• enable the buddy feature.
• send you optional notifications and reminders (controllable in your device settings).
• understand how the app is used and improve the product.

We do not sell your personal data to third parties. We do not use your habit data or reflections for advertising purposes.

Legal bases for processing

We only process your data where there is a legal basis under Art. 6 GDPR:

• Account, habits, check-ins, reflections, coach, and buddy: Art. 6(1)(b) GDPR. This processing is necessary to provide the app you want to use.
• Push notifications and reminders: Art. 6(1)(a) GDPR. You give consent when you allow notifications. You can withdraw it anytime in your device settings.
• Usage analytics in the app and website: Art. 6(1)(f) GDPR. Our legitimate interest is finding bugs and improving the app. We evaluate this data in aggregate.
• Purchase and billing: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR for tax retention obligations.

Especially sensitive content: what you write in reflections and coach conversations is up to you. hey habits is not a medical product or therapy. Please don't enter health data or other especially sensitive information under Art. 9 GDPR there. If you do, we only process it based on your explicit consent under Art. 9(2)(a) GDPR, which you can withdraw at any time by deleting the content or writing to us.

Recipients and service providers

We do not share your data with third parties, except the following service providers who support us in running the app. We have data processing agreements with them under Art. 28 GDPR:

• Supabase (database, sign-in, hosting). Your account, habit, and reflection data is stored on EU-based infrastructure.
• OpenAI (coach feature, USA). When you chat with the coach, your messages and goal context are sent to OpenAI to generate a reply. Under our contract, your content is not used to train general models.
• Google Firebase and Google Analytics (in-app usage analytics, USA and EU). We record events like screens opened and check-ins with a random device identifier, not your name.
• RevenueCat (subscription management, USA). Processes purchase status, not your payment data.
• Apple App Store and Google Play. Purchases and payment run entirely through the stores. We never see your payment data.
• Plausible Analytics (website analytics, EU). No cookies, no IP storage.

Transfers to third countries

Some of these providers are based in the USA, so data is also processed outside the EU. We base these transfers on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR. Despite these safeguards, we cannot fully exclude the possibility that US authorities access data. If you want to avoid this, please don't use the coach feature.

How long we keep your data

• Account, habits, check-ins, reflections, and coach conversations: for as long as your account exists. If you delete your account, we delete this data within 30 days.
• Usage analytics: up to 14 months, then only in aggregate with no personal reference.
• Invoicing and tax-relevant data: where we receive it, up to 10 years due to statutory retention periods (§147 German Fiscal Code).

Website analytics

We use Plausible Analytics to understand how our website is used. Plausible does not use cookies, does not store IP addresses, and does not create personal visitor profiles. Evaluation is aggregated and used solely to improve our website. Our website does not set cookies that require consent.

Data storage

hey habits is hosted on Supabase with EU-based infrastructure. Your data is transmitted and stored encrypted. Access is technically restricted so that only you can see your reflections and coach conversations. Further service providers involved are listed above under "Recipients and service providers".

Your rights (GDPR)

If you are located in the European Union or the United Kingdom, you have the right to:

• access the personal data we hold about you.
• rectification of inaccurate or incomplete data.
• erasure of your account and all associated data.
• data portability: receive your data in a portable format.
• object to certain types of processing (Art. 21 GDPR).
• restriction of processing (Art. 18 GDPR).
• withdraw consent at any time, with future effect (Art. 7(3) GDPR).

Right to complain: you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). We are supervised by the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, www.baden-wuerttemberg.datenschutz.de. You may also contact the authority in your place of residence.

To exercise any of these rights, write to us at info@heyhabits.app. For account deletion you can also use our own account deletion page. We respond within 30 days.

Children

hey habits is not directed at people under 16. In Germany, consenting to the processing of personal data for digital services requires a minimum age of 16 (Art. 8 GDPR). We do not knowingly collect data from children and teenagers under 16. If you believe a child has provided us with their data, please contact us. We will delete it promptly.

Changes to this policy

We may update this policy from time to time. If we do, we will update the date at the top of this page and inform you of material changes via the app or by email.

Contact

Questions about privacy? Write to us at info@heyhabits.app.