Privacy Policy
Last Updated: September 15, 2026
1) Information about the collection of personal data and contact details of the person responsible
1.1
We are pleased that you are using our application (hereinafter "app"). In the following we inform you about the handling of your personal data when using our app. Personal data includes information that can identify you directly or indirectly, including online identifiers where applicable. A randomly generated identifier does not, by itself, make data anonymous.
1.2
Responsible for data processing regarding this app within the meaning of the General Data Protection Regulation (GDPR) is Alpsu Dilbilir, email: alpsudilbilir@gmail.com. The person responsible for the processing of personal data is the natural or legal person who alone or jointly with others decides on the purposes and means of the processing of personal data.
2) Data Collection and Storage
2.1
Your habit names, notes, schedules and completion history are stored locally on your device for the app's functionality. HabitBit does not send the contents of your habits or notes to Firebase Analytics or RevenueCat. Purchase verification and reporting involve limited data processing as described below.
2.2
HabitBit does not provide cloud synchronization of your habit records. Deleting the app can remove these local records; keep an export if you need a backup. Files you choose to export or share are handled by the destination you select. Deleting the app does not by itself erase records already held by analytics or purchase service providers.
2.3 Usage analytics
The HabitBit 2.0.0 release build has Firebase Analytics disabled and removed from its runtime dependencies. It does not send screen views, onboarding steps, habit interactions, analytics installation identifiers or approximate location to Firebase. There is no Usage Analytics permission screen or switch in this release. Purchase processing and purchase reporting through RevenueCat remain separate, as described in section 3.
Disabling analytics does not automatically delete records previously sent by a testing or earlier analytics-enabled build. Any such records remain subject to the provider's retention and deletion controls. The previously configured Google Analytics retention periods were 2 months for event-level data and 14 months for user-level data, with user retention restarting on new activity; most aggregated reports are separate. Contact us about access or deletion requests. We may not be able to identify an installation from an email address alone.
2.4 Service-provider safeguards
We use RevenueCat under its applicable service and data-protection terms. We require service providers handling data on our behalf to protect it consistently with this policy and applicable privacy requirements, including confidentiality, security, and restrictions on processing. We do not send habit names or notes to RevenueCat, sell your habit data, or use this purchase integration to track you across other companies' apps for advertising.
3) Data processing for contract processing
3.1
For the processing of in-app purchases, we work together with the following service provider, who supports us in the implementation of transactions.
3.2 - RevenueCat
Apple processes App Store payments. We do not receive your payment card details. RevenueCat helps validate purchases, restore purchases and manage access to paid features, and provides purchase reporting. It processes purchase history, transaction and entitlement information, a generated app user identifier, and app/device information needed to provide this service. Purchase reporting is separate from in-app behavioral analytics, which is disabled. Processing necessary to provide purchased features is based on performance of our contract with you (Article 6(1)(b) GDPR). Purchase records may be retained for entitlement restoration, fraud prevention and applicable legal obligations. RevenueCat is based in the United States and may process data outside your country.
Further information on data protection by RevenueCat can be found here: https://www.revenuecat.com/privacy
4) Contact
When contacting us (e.g. via contact form or e-mail), personal data is collected. This data is stored and used exclusively for the purpose of answering your request or for contacting you and the associated technical administration. The legal basis for the processing of this data is our legitimate interest in answering your request in accordance with Article 6 (1) (f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 (1) (b) GDPR. Your data will be deleted once your request has been processed. This is the case if it can be inferred from the circumstances that the facts in question have been finally clarified and provided that there are no legal storage obligations to the contrary.
For questions about privacy, please contact us at alpsudilbilir@gmail.com.
5) Rights of the data subject
5.1
The applicable data protection law grants you comprehensive data subject rights (rights to information and intervention) vis-à-vis the person responsible for the processing of your personal data, about which we will inform you below:
- Right to information in accordance with Art. 15 GDPR: In particular, you have a right to information about your personal data processed by us, the processing purposes, the categories of personal data processed, the recipients or categories of recipients to whom your data was or will be disclosed, planned storage period or the criteria for determining the storage period, the existence of a right to correction, deletion, restriction of processing, objection to processing, complaint to a supervisory authority, the origin of your data if they were not collected from you by us, the existence of automated decision-making including profiling and, if applicable, meaningful information about the logic involved and the scope and intended effects of such processing on you, as well as your right to be informed which guarantees pursuant to Art. 46 GDPR when your data is forwarded to third countries exist;
- Right to rectification in accordance with Art. 16 GDPR: You have the right to immediate rectification of incorrect data concerning you and/or completion of your incomplete data stored by us;
- Right to deletion according to Art. 17 GDPR: You have the right to request the deletion of your personal data if the requirements of Art. 17 Para. 1 GDPR are met. However, this right does not apply in particular if the processing is necessary to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims;
- Right to restriction of processing in accordance with Art. 18 GDPR: You have the right to request the restriction of the processing of your personal data as long as the accuracy of your data, which you dispute, is being checked, if you refuse to delete your data because of inadmissible data processing and instead request the restriction of the processing of your data if you need your data to assert, exercise or defend legal claims after we no longer need this data after the purpose has been achieved or if you have lodged an objection for reasons of your particular situation, as long as it is not yet clear whether our legitimate reasons prevail;
- Right to information in accordance with Art. 19 GDPR: If you have asserted the right to correction, deletion or restriction of processing against the person responsible, he is obliged to inform all recipients to whom the personal data concerning you have been disclosed of this correction or deletion of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort. You have the right to be informed about these recipients.
- Right to data portability in accordance with Art. 20 GDPR: You have the right to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request transmission to another person responsible, insofar as this is technically feasible;
- Right to revoke granted consent in accordance with Art. 7 Para. 3 GDPR: Where processing relies on consent, you can withdraw that consent with effect for the future by contacting us. Firebase usage analytics is disabled in the 2.0.0 release described above. You can also contact us to request deletion of previously collected records. We will handle identifiable records under applicable deletion requirements and explain any lawful retention or identification limitations. Withdrawal does not affect the lawfulness of processing before consent was withdrawn;
- Right to lodge a complaint pursuant to Art. 77 GDPR: If you believe that the processing of your personal data violates the GDPR, you have - without prejudice to any other administrative or judicial remedy - the right to lodge a complaint with a supervisory authority, in particular in the Member State where you live, work or where the alleged infringement took place.
5.2 RIGHT TO OBJECT
IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING FOR REASONS RESULTING FROM YOUR PARTICULAR SITUATION WITH EFFECT FOR THE FUTURE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP THE PROCESSING OF THE DATA INVOLVED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN PROVE COMPREHENSIVE REASONS FOR PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FUNDAMENTAL FREEDOMS, OR IF THE PROCESSING IS FOR THE CERTIFICATION, EXERCISE OR DEFENSE OF LEGAL CLAIMS.
IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT ADVERTISING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR THE PURPOSES OF SUCH ADVERTISING. YOU MAY OBJECT AS DESCRIBED ABOVE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP THE PROCESSING OF THE DATA INVOLVED FOR DIRECT MARKETING PURPOSES.