hey habits
DE EN
Get the app
Privacy

Your data. Your call.

We collect only what we need to make hey habits work. Your reflections and coach conversations are yours alone. Your buddy never sees them.

Last updated: July 2026

Controller

The controller under the General Data Protection Regulation (GDPR) is:

Nicki Eliza Schinow
Bachstr. 7
79238 Ehrenkirchen
Germany
Email: info@heyhabits.app

We are not legally required to appoint a data protection officer. For any privacy question, write to the address above.

What we collect

When you use hey habits, we collect the following information:

  • Account data: your email address and display name, provided when you sign up.
  • Habit data: your habits and the "why" behind each habit.
  • Check-ins: the date and time you mark a habit complete.
  • Reflections: your responses to the daily reflection prompts.
  • Coach conversations: messages you exchange with the coach.
  • Usage analytics: anonymised data about how you use the app (screens visited, features used) to help us improve the product. We do not sell this data.

What your buddy sees

If you invite a buddy, they can see your history and whether you've checked in today. That's all. Your buddy never sees your reflections, your why, or any of your coach conversations.

How we use your data

We use your data to:

  • Run the coach feature and tailor responses to your goals.
  • Enable the buddy feature.
  • Send you optional notifications and reminders (you control these in your device settings).
  • Understand how the app is used and improve the product over time.

We do not sell your personal data to third parties. We do not use your habit data or reflections for advertising purposes.

Legal bases for processing

We only process your data where there is a legal basis under Art. 6 GDPR:

  • Account, habits, check-ins, reflections, coach and buddy: Art. 6(1)(b) GDPR. This processing is necessary to provide the app you asked to use.
  • Push notifications and reminders: Art. 6(1)(a) GDPR. You consent when you allow notifications, and you can withdraw that at any time in your device settings.
  • Usage analytics in the app and on the website: Art. 6(1)(f) GDPR. Our legitimate interest is finding bugs and improving the app. We evaluate this data in aggregate.
  • Purchases and billing: Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for statutory tax retention duties.

Sensitive content: what you write in reflections and coach conversations is your choice. hey habits is not a medical product and not therapy. Please do not enter health data or other special category data under Art. 9 GDPR. If you do, we process it only on the basis of your explicit consent under Art. 9(2)(a) GDPR, which you can withdraw at any time by deleting the content or writing to us.

Recipients and service providers

We do not pass your data to third parties, other than the providers below who help us run the app. We have data processing agreements with them under Art. 28 GDPR:

  • Supabase (database, sign-in, hosting). Your account, habit and reflection data sits on EU infrastructure.
  • OpenAI (the coach, USA). When you write to the coach, your messages and the context of your goal are sent to OpenAI to generate a reply. Under our agreement your content is not used to train general-purpose models.
  • Google Firebase and Google Analytics (app usage analytics, USA and EU). We record events such as screens opened and check-ins, tied to a random device identifier rather than your name.
  • RevenueCat (subscription management, USA). Processes your purchase status, not your payment details.
  • Apple App Store and Google Play. Purchases and payment run entirely through the stores. We never see your payment details.
  • Plausible Analytics (website analytics, EU). No cookies, no IP storage.

Transfers outside the EU

Some of these providers are based in the USA, so data is also processed outside the EU. We base these transfers on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR. Despite these safeguards, access by US authorities cannot be entirely ruled out. If you would rather avoid that, please do not use the coach.

How long we keep your data

  • Account, habits, check-ins, reflections and coach conversations: for as long as your account exists. If you delete your account, we delete this data within 30 days.
  • Usage analytics: at most 14 months, after which it is kept only in aggregate with no personal reference.
  • Invoicing and tax-relevant data: where we receive it, up to 10 years due to statutory retention periods (§147 AO).

Website analytics

We use Plausible Analytics to understand how our website is used. Plausible does not use cookies, does not store IP addresses, and does not create personal visitor profiles. Analytics are aggregated and used only to improve our website. Our website sets no cookies that would require consent.

Data storage

hey habits is hosted on Supabase, using EU-based infrastructure. Your data is encrypted in transit and encrypted at rest. Access is technically restricted so that only you can see your reflections and coach conversations. The other providers involved are listed above under "Recipients and service providers".

Your rights (GDPR)

If you are located in the European Union or UK, you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate or incomplete data.
  • Delete your account and all associated data.
  • Export your data in a portable format.
  • Object to certain types of processing (Art. 21 GDPR).
  • Restrict processing (Art. 18 GDPR).
  • Withdraw consent at any time, with effect for the future (Art. 7(3) GDPR).

Right to complain: you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, www.baden-wuerttemberg.datenschutz.de. You may also contact the authority where you live.

To exercise any of these rights, email us at info@heyhabits.app. To delete your account, you can also use our dedicated account deletion request page. We will respond within 30 days.

Children

hey habits is not intended for anyone under the age of 16. In Germany, consent to the processing of personal data by digital services requires an age of at least 16 (Art. 8 GDPR). We do not knowingly collect data from anyone under 16. If you believe a child has given us their data, please write to us and we will delete it promptly.

Changes to this policy

We may update this policy from time to time. When we do, we'll update the date at the top of this page and, for significant changes, notify you via the app or email.

Contact

Questions about privacy? Email us at info@heyhabits.app.