Privacy Policy

Last updated: October 22, 2026

Habidu ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains what we collect, how it's used and processed, and the rights you have over your data when you use the Habidu app and website.

1. Information We Collect

We collect the information you provide while using Habidu:

• Account data - your email address and authentication details, managed by Firebase Authentication.
• Tasks & schedule - your tasks, routines, timers, streaks, and settings.
• Coach conversations - messages, voice notes, and images you send to the AI coach, plus a short-term memory of facts the coach learns to personalize its help.
• Journal entries - your morning intentions and evening reflections.
• Support messages - anything you send via "Chat with the founder" and the feature-request board.
• Device data - a push-notification token and your timezone (so reminders arrive at your local time).
• Mission alarm codes - if you set an alarm that only stops when you scan a QR code or barcode, the name you give the code and a scrambled fingerprint of it (a salted hash). We never store the code itself or any picture.
• Usage analytics - product events such as "app opened" or "task completed" (see Section 4).

2. How We Use Your Information

• Provide and improve the Habidu coaching service
• Personalize your schedule, nudges, and coaching interactions
• Send you task reminders and coach nudges (you control these in Settings)
• Track your streaks and progress over time
• Respond when you contact support
• Understand aggregate usage so we can improve the product

3. AI Processing

Habidu's coach is powered by third-party AI services. When you chat with the coach (text, voice, or images), your messages and relevant context (such as your tasks for the day) are processed by Google's Gemini models via Google Cloud, or by Anthropic's Claude models via Anthropic's API, to generate responses (we are testing Claude with some users, so your coach may use either). If you enable read-aloud / voice replies, the coach's text replies are converted to speech by Cartesia. These providers process your content to provide the service; we do not allow them to use it to advertise to you. Your conversations are stored in your account so the coach can remember context between sessions.

Your consent. The AI coach is central to Habidu. On iOS, before any of your content is sent to an AI provider (Google's Gemini or Anthropic's Claude), Habidu shows a disclosure describing what is shared and who processes it; by continuing past that screen you consent to this processing. On all platforms your ongoing control is the AI coach toggle in Settings - turning it off stops all sending to the AI at any time. AI features require this processing to work; with the AI coach off, the rest of Habidu (timeline, focus timer, habits, inbox) remains fully usable.

Third-party protection. Under Google's paid Gemini API, your content is not used to train Google's models, and Google processes it only to return the coach's response. Under Anthropic's commercial API terms, Anthropic does not use your content to train its models and processes it only to return the coach's response. Google, Anthropic and Cartesia are bound by their own confidentiality and data-protection terms, which provide protections equivalent to those described in this policy. See Google's Gemini API terms, Anthropic's commercial terms and Cartesia's privacy policy.

Google Calendar & Limited Use

If you choose to connect Google Calendar, Habidu requests read-only access to your calendar events (the calendar.events.readonly scope) solely to display your events alongside your schedule on the Timeline and Flow screens and to help you plan around them. We request the narrowest scope needed for this feature and nothing more.

Limited Use. Habidu's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use, transfer, or sell your Google Workspace (Google Calendar) data - raw, aggregated, or derived - to develop, improve, or train any generalized or foundational artificial-intelligence or machine-learning models, and we do not use it for advertising. Your calendar events are read on your device to build your schedule and are not sent to our AI provider. So your events can ring as alarms, Habidu saves the title and time of your upcoming timed events from your connected calendar to your account, unless you turn off Remind me for all calendar events in Settings (then only the events whose Alarm switch you turn on are saved). A saved event follows the event if it moves, is removed if the event is cancelled or you switch off its alarm, is removed when you turn that setting off or disconnect Google Calendar, and is never sent to our AI provider. When that event rings, the spoken reminder says only "Time for your calendar event." - its name is spoken only if you turn on Say calendar event names in Settings, and in that case the name is sent to our voice provider, Cartesia, to create the audio. You can disconnect Google Calendar at any time in Settings, which immediately stops all access.

Connected apps (Notion, Todoist, Zapier, Assindo)

You can choose to connect other apps to your coach in Settings - Connected apps. Today these are Notion, Todoist, Zapier and Assindo. You sign in on that app's own page and approve the access it asks for; Habidu never sees your password for it.

What is used, and where it goes. When you ask the coach for something that needs a connected app (for example, "add my Notion tasks for this week to my Inbox"), the coach reads what it needs from that app, and that content (such as page titles, task names and their text) is sent to our AI provider (Google's Gemini or Anthropic's Claude, as described in section 3) so the coach can answer you. Items you ask the coach to bring into Habidu are saved to your account like any other task. The coach sends a connected app only what your request needs, and it asks you before it changes anything there (you can choose "Always allow" for a specific action and turn that off again in Settings).

How we store the connection. The sign-in tokens a connected app gives us are encrypted before they are stored, are used only to make the requests you ask for, and are never shown to the app or to anyone else. Your conversation with the coach, including what it tells you from a connected app, is stored like any other coach conversation; an action held for your approval is kept until you answer it. Disconnecting an app in Settings, or deleting your Habidu account, deletes those tokens and asks the app to revoke them. Each connected app handles your data under its own privacy policy.

Camera (mission alarms)

On Android you can give an alarm a mission: it keeps ringing until you scan a QR code or barcode you registered in Settings - Reminders & alarms - Mission codes. Habidu asks for camera access only when you register or scan a code, and uses the camera only to read that code on your phone. No photo or video is saved or sent anywhere. What we keep is the name you gave the code and a scrambled fingerprint of its value (a salted hash), stored with your settings so the alarm can check your scan; the code's value itself is never stored. Deleting a code in Settings, or deleting your account, deletes its fingerprint.

Motion sensor (shake and walk missions)

If you give an alarm a shake mission, Habidu reads your phone's motion sensor (the accelerometer) while that alarm rings, only to count your shakes. If you give an alarm a walk mission, Habidu asks for step counting (Physical activity on Android, Motion & Fitness on iPhone) when you choose the mission, and reads your phone's step count only while that alarm rings, to count the steps you take from the moment it starts ringing. Both happen on your phone only: no motion data or step count is stored or sent anywhere. You can turn the permission off in your phone's settings at any time; the alarm then asks a math problem instead.

Subscriptions and paywalls

In the iOS and Android apps, subscription purchases go through the App Store or Google Play and are managed by RevenueCat, which receives your account ID and your purchase and subscription status so your Premium access works on your devices. We use Superwall to show and test subscription offers (for example, the offer screen at the end of setup). Superwall receives your account ID, basic device details (such as app version, platform, language and country), which offer screens you saw, how you interacted with them, and your subscription status. Neither receives the content of your tasks, journals, or coach conversations. Both process this data under their own data-protection terms; see RevenueCat's privacy policy and Superwall's privacy policy. Payment details are handled by Apple or Google and are never seen by Habidu.

4. Analytics

We use PostHog and Google Firebase Analytics to collect product-usage events (e.g. app opened, task completed, feature used) tied to your account ID, along with basic technical details such as your app version, platform, browser, and approximate location (country/region derived from your IP address, not precise GPS). We use this to understand which features help people, see where our users are, and improve Habidu. We do not send the content of your tasks, journals, or coach conversations to analytics.

We also use PostHog session replay in the web and mobile apps, which records how the app's screens are used during a session (taps, navigation, and what is rendered) tied to your account ID, so we can diagnose problems you report and fix confusing flows. In the mobile apps, text you type and images are masked (redacted) in recordings - the content of your tasks, journal entries, and coach conversations is not readable in a replay. Replays are stored by PostHog under their data-protection terms, retained for a limited period, and are viewed only for support and product improvement.

5. Where Your Data Lives

Your data is stored in Google Firebase (Firestore and Firebase Authentication), protected by per-user security rules so only your signed-in account can access your data. The web app is served via Cloudflare. All data is encrypted in transit, and journal entries, coach conversations, and support messages are never visible to other users.

Protection of sensitive data. Sensitive data - including any Google Calendar information you connect - is encrypted in transit (TLS) and at rest, access-controlled by per-user security rules so only your signed-in account can read it, retained only as long as needed to provide the feature, and never used to train artificial-intelligence or machine-learning models. You can revoke access or delete your data at any time from Settings.

6. Data Sharing

We do not sell, trade, or rent your personal information. We share data only:

• with the service providers above (Google, Anthropic, Cartesia, PostHog, Cloudflare, RevenueCat, Superwall) as needed to operate Habidu, under their confidentiality and data-protection terms;
• with a connected app you chose (see Connected apps above), only what your request needs;
• with your explicit consent;
• to comply with applicable law or valid legal process;
• to protect the rights, property, or safety of Habidu or our users.

7. Your Rights (GDPR / CCPA)

Wherever you live, you can:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Export your data in a portable format
• Withdraw consent at any time

To exercise any of these rights, use Settings → Support → Chat with the founder in the app, or email [email protected]. If you are in the EU/EEA or California, you also have the right to complain to your local data-protection authority.

8. Data Retention & Deletion

We keep your data while your account is active. When you delete your account, we delete your data (tasks, journals, coach conversations, settings, support threads) within 30 days, except where the law requires longer retention.

9. Children's Privacy

Habidu is not intended for individuals under the age of 13, and we do not knowingly collect personal information from children under 13.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or by email. Continued use of Habidu after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

Questions about this policy: [email protected], or message us in the app via Settings → Support.