Privacy Policy

Last updated: June 1, 2025

This Privacy Policy applies to Habitual ("we", "us", "our") and describes how we collect, use, and share information when you use our website at habitual.co and our related services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

We collect information you provide directly to us, including:

• Account information: name, email address, password when you register.
• Profile information: optional photo, bio, location (city/country), and challenge preferences.
• Challenge data: check-in records, streak counts, notes and photos you share within cohorts.
• Communications: messages you send through our in-app group chat or to our support team.
• Payment information: if you subscribe to Habitual Pro, payment is processed by Stripe. We do not store full card details.

We also collect information automatically when you use the Service:

• Log data: IP address, browser type, pages visited, time and date of visits.
• Device information: hardware model, operating system, unique device identifiers.
• Usage data: features accessed, challenge completion rates, interaction patterns.
• Cookies and similar tracking technologies (see Section 3).

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service.
• Match you with appropriate challenge cohorts.
• Send you transactional emails (check-in reminders, milestone notifications).
• Send you our weekly habit tips newsletter, if you subscribed (you may unsubscribe at any time).
• Respond to your comments, questions, and support requests.
• Monitor and analyse usage trends to improve user experience.
• Detect, prevent, and address technical issues and fraudulent activity.
• Comply with legal obligations.

3. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to track activity on our Service. Cookies are small data files stored on your device. We use:

• Essential cookies: required for the Service to function (authentication, session management).
• Analytics cookies: we use Google Analytics to understand how visitors interact with our site. This data is aggregated and anonymised.
• Advertising cookies: we use Google AdSense to display relevant advertisements. Google uses cookies to serve ads based on your prior visits to our site or other sites. See Section 5 for more.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, some parts of the Service may not function properly.

4. Third-Party Services

We share information with third parties only in the following circumstances:

• Service providers: companies that perform services on our behalf, such as Stripe (payments), SendGrid (email delivery), and Google Analytics (analytics). These providers are contractually obligated to protect your information.
• Legal requirements: we may disclose your information if required by law or in response to valid requests by public authorities.
• Business transfers: in the event of a merger, acquisition, or sale of assets, user information may be transferred.
• We do not sell your personal data to third parties.

5. Advertising — Google AdSense

We use Google AdSense to display advertisements on our Service. Google AdSense uses cookies to show ads based on your interests. Google's use of advertising cookies enables it and its partners to serve ads based on your visit to our site and/or other sites on the internet.

You may opt out of personalised advertising by visiting Google's Ad Settings. Alternatively, you may opt out of third-party vendor use of cookies for personalised advertising by visiting www.aboutads.info.

For more information about how Google uses data from sites that use its services, please visit Google's Privacy & Terms.

6. Your Data Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate data.
• Erasure: request deletion of your account and associated data.
• Portability: request your data in a machine-readable format.
• Objection: object to processing of your data for direct marketing.
• Withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@habitual.co. We will respond within 30 days.

7. Data Security

We implement industry-standard security measures including TLS encryption for data in transit, AES-256 encryption for sensitive data at rest, and regular security audits. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

8. Children's Privacy

The Service is not directed at individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete it immediately. If you believe a child has provided us with personal data, please contact privacy@habitual.co.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email (if you have an account) and by posting a notice on our site at least 14 days before the change takes effect. Your continued use of the Service after the effective date constitutes your acceptance of the updated policy.

10. Contact Us

If you have any questions about this Privacy Policy, please contact us:

• Email: privacy@habitual.co
• Mailing address: Habitual Ltd., 1 Habit Lane, London, EC1A 1BB, United Kingdom