Introduction

HabitFlame ("we", "our" or "us") is a habit tracker for iPhone and iPad. This policy explains what the app stores, what it sends, who receives it and how you can remove it. HabitFlame does not ask you to create an account.

What is stored on your device and in iCloud

Your habits, their entries and streaks, your achievements, your settings and your partner records are stored on your device. The app also syncs them automatically to your private iCloud database. There is no sync switch inside the app. iCloud is controlled in the iOS Settings app. We cannot read your private iCloud database.

The optional "Email or Phone" field on a partner card is stored only on your device and in your private iCloud. It is not sent anywhere else. If you choose someone to invite from your contacts, the app uses the system contact picker and keeps only the name you chose, on your device, to label the invite.

Accountability partners and the pairing service

Pairing with a partner uses an invite link and HabitFlame's pairing service, a backend we operate for the app on Supabase.

When you create an invite, the pairing service stores your device's push token, a random device identifier, the invite code and a random invite identifier. An invite expires after 7 days. An invite nobody accepts is deleted the next time the pairing service runs its cleanup after it expires; that cleanup runs while the service is in use rather than on a fixed schedule. An accepted invite stays with its pairing, as described below. Invites made through the older pairing service also stored your display name and a random user identifier; those records become eligible for deletion 30 days after the invite expires.

While you are paired, the pairing service stores each device's push token, random device identifiers, hashed secrets and timestamps, along with the pair's weekly counts and the completion records described under Push notifications.

Only the habits you choose to share are sent to your partner. Habits you do not share are never named or shown to a partner, but their completions count toward the pair's weekly count, which shows each person's total.

When you remove a partner, the app asks the pairing service to end the pairing, and retries later if it cannot reach it, for example while you are offline. Once the pairing service receives the request, the device records for that pairing, with their push tokens, are deleted at once. The pairing record, its weekly counts, its completion records and the accepted invite, which still holds the inviter's push token and device identifier, are kept, marked as removed, and become eligible for deletion 30 days later; they are removed the next time the pairing service runs its cleanup. Some records from older pairings are marked as revoked instead of deleted.

When another of your own devices joins a pairing automatically through your iCloud account, the pairing service keeps a small record of that join with no end date, so it can never be used twice: two random identifiers, a counter and whether it was used. It holds no name, push token or habit data.

When a pairing made with an older version of the app moves to the current pairing service, the pairing service keeps a record of the invite used for the move with no end date, so it can never be reused: the invite's random identifier, the inviting device's random identifier, a random pairing identifier, what the invite was for, how it ended and when. It holds no name, push token or habit data.

To limit abuse, the pairing service keeps request counters for each IP address, pairing and device that uses it, labelled with that address or identifier, with the time the current counting period began. These counters are not deleted.

Push notifications

When you have Premium and complete a shared habit, the app sends your partner a push notification through the pairing service and Apple's push notification service. It also sends milestone alerts and, at most once a day when the app is started in the evening, a streak-at-risk alert for one habit that runs every day or on specific days. The message carries the habit name, your streak count, your display name and the identifiers needed to deliver it. Only your paired partner's device receives it. The pairing service does not keep these messages after delivery. Nudges and reactions you send, on any plan, are delivered to your partner the same way, through the pairing service and Apple's push notification service. They carry your display name, the message or reaction you chose, for a reaction the name of the habit you reacted to, and the identifiers needed to deliver them, and the pairing service does not keep them after delivery. Whatever your plan, when you complete a habit, shared or not, the app also sends the pairing service a record for the pair's combined weekly count: the day of the completion and a one-way hash of the habit's identifier, so the same completion is never counted twice. It carries no habit name.

Analytics and diagnostics

The app uses PostHog, an analytics service with servers in the United States, to understand how the app is used. The app sends PostHog:

  • usage events, for example a habit completed or a screen opened
  • the app version and build type
  • your device model and type, iOS version, screen size, language and timezone
  • your network type, wifi or cellular
  • a random identifier the app creates for you, which is the same on your devices that share an iCloud account
  • your IP address, which reaches PostHog with each request; PostHog is set to discard it, and no location is derived from it
  • crash and hang diagnostics, such as durations and technical fingerprints

Habit names, partner names, display names, email addresses and push tokens are removed from event details before they are sent. From version 4.5.3, details of the buttons and other elements you tap are not collected.

From version 4.5.3, you can turn analytics off in Settings, under Privacy, with the Share usage analytics switch. The app then stops sending analytics, does not load remote settings, and deletes the analytics data queued on your device. Requests already in progress at that moment complete. Earlier versions have no switch.

Screen recordings

Session replay is turned off. Before it was turned off, PostHog could record sessions in the app as a series of screen images. Text fields were masked, but other text on the screen, including habit names, could appear in them. Those recordings are deleted 30 days after they were made. Version 4.5.3 also turns session replay off in the app itself, and its first launch deletes any recording still waiting on your device.

Apple Health

If you give permission, the app reads step count, active energy, exercise minutes, water intake, body mass, mindful minutes and workouts from Apple Health, so it can complete habits for you automatically. It does not write anything to Apple Health. Health values are stored with your habits on your device and in your private iCloud database. They are never sent to partners, to the pairing service or to analytics. Analytics never receives Health measurements. When a Health reading completes a habit, analytics receives the same completion event as any other completion: the habit's tracking type, its time of day and the streak length.

Purchases

Purchases are handled by Apple through the App Store. No receipt or payment details are sent anywhere other than Apple. Analytics receives the product identifier and price tier of a purchase.

Reminders

Habit reminders are local notifications scheduled on your device.

What we do not do

  • We do not show advertising or use ad networks.
  • We do not sell your data.
  • We do not share your data with data brokers.

Data retention and deletion

Deleting the app removes the data stored on your device, except the random device identifier and pairing credentials the app keeps in the iOS keychain on this device only. iOS can keep those after the app is deleted, and the app reuses them if you install it again. They are never synced and hold no habit data. It does not remove the copy in your private iCloud, which you can delete through your iCloud settings. It also does not remove the pairing records described above, so remove your partner in the app, while you are online, before you delete it. For any other deletion request, email us at the address below.

Children

HabitFlame has no age check and is not directed at children under 13. If a child has used the app and you want their data removed, contact us.

Changes

We may update this policy. When we do, we will post the new version on this page and change the "Last updated" date.

Contact

If you have questions about this policy or want data removed, email support@freedom-terminal.com.