Privacy Policy

1. Who is responsible

The controller under the GDPR for habiloop is: Leuchter.ORG Daniel Leuchter Gorch-Fock-Str. 4 26188 Edewecht Germany Phone: +49 4486 915 7874 Email: [email protected] Web: https://habiloop.com

Questions about privacy? Just drop me a line at the email address above.

2. The short version

Your habit data (habits, categories, entries, notes, streaks, badges and XP) is used for exactly one thing: running the app for you. I don't share it, sell it or analyse it for advertising. Google Analytics and Google AdSense never receive habit data.

3. Hosting, Cloudflare and server logs

habiloop runs on servers of Hetzner Online GmbH in its Falkenstein data centre in Germany, under a data processing agreement (Art. 28 GDPR). Cloudflare, Inc. acts as a content delivery network and shields habiloop from attacks; requests may pass through Cloudflare servers outside the EU (certified under the EU-US Data Privacy Framework).

The web server automatically logs access data (IP address, date and time, page, browser type) to keep the service secure and stable and to stop abuse such as login spam (Art. 6 (1) (f) GDPR). Logs are deleted after 14 days at the latest.

4. Your account and magic-link login

An account only needs your email address. When you log in, you get a link and a 6-digit code, both valid for 15 minutes; only cryptographic hashes of them are stored. Your account is created on your first successful login. You may add a first name. I also store language, time zone, week start, XP and the date you were last active. Legal basis: performance of the contract (Art. 6 (1) (b) GDPR).

5. Session cookie

After login habiloop sets the cookie "hl_session". It holds a random session identifier, can only be read by the habiloop server (HttpOnly) and expires 30 days after you last used habiloop. For each session I store the browser identifier (user agent), IP address and time of last use, so you can see your devices in settings and log them out. This cookie is strictly necessary (Section 25 (2) no. 2 TDDDG).

6. Habit data

Habits, categories, daily entries (including skipped days), notes, pauses with their dates and optional reason (vacation, sick, other), calculated streaks and freeze days, unlocked badges, XP and settings such as calm mode are kept as long as your account exists, purely so you can see and analyse them yourself (Art. 6 (1) (b) GDPR). The reason for a pause is optional and only that one word; I never ask about an illness. "Export your data" in settings gives you a full copy as JSON or CSV at any time.

7. Emails

Login emails (magic link and code) and notices are sent from [email protected] via Brevo (Sendinblue GmbH, Berlin), which processes data in the EU under a data processing agreement. Each email is logged with recipient, subject and status so I can sort out delivery problems (Art. 6 (1) (f) GDPR). The log is deleted after 90 days. Emails you send to [email protected] are forwarded to my mailbox via Cloudflare Email Routing (EU-US Data Privacy Framework) and only used to reply to you.

8. Newsletter (Brevo, double opt-in)

You only get the newsletter if you explicitly ask for it (Art. 6 (1) (a) GDPR) and then confirm via the link in the confirmation email. I record time, IP address, user agent and the wording of your consent as proof. After confirmation I pass your email address, first name and the source "habiloop" to Brevo (Sendinblue GmbH, Berlin), which processes them in the EU on my behalf. Unsubscribe anytime via the link in every email or the toggle in settings.

9. Cookies and consent

On your first visit habiloop's own banner asks whether you agree to statistics and personalized ads. Your choice is stored for 12 months in the cookie "hl_consent" (strictly necessary). Statistics and personalized ads only load with your consent (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR). Change or withdraw it anytime via "Cookie settings" in the footer or in the app settings. I use Google Consent Mode v2: until you decide, every Google signal is set to "denied".

10. Statistics with Google Analytics 4

Only if you allow "Statistics" do I load Google Analytics 4 (Google Ireland Limited, Dublin). It measures which pages are visited and how the site is used, with shortened IP addresses. Data may be transferred to Google LLC in the USA (EU-US Data Privacy Framework) and is deleted after 14 months. No habit data is sent.

11. Advertising with Google AdSense

habiloop is free and paid for by ads from Google AdSense (Google Ireland Limited). Ads only appear on the home page, the stats page and the badges page, never while you tick off habits. The AdSense script only loads if you allow "Advertising" in the banner.

If you allow "Advertising", Google may use cookies and similar technologies for personalized ads. Without that consent I don't load AdSense at all: no request goes to Google and no ad cookies are set. Data may be transferred to Google LLC in the USA (EU-US Data Privacy Framework). Google never receives your habit data. More at policies.google.com/technologies/ads.

12. Push reminders

Reminders and the evening check are sent as web push notifications, but only if you switch them on for a device with a click and your browser grants permission. I store the push endpoint and keys created by your browser, the user agent and your reminder times (Art. 6 (1) (b) GDPR). Delivery runs through your browser vendor's push service (e.g. Google, Apple, Mozilla), with end-to-end encrypted content. Turn push off anytime in settings or in your browser; invalid endpoints are removed automatically.

13. Inactive accounts

I don't hoard data. If you don't log in for 3 months (90 days), you get a single reminder email with a login link. If you still don't log in within the following 30 days, I permanently delete your account and all habit data, 4 months (120 days) after your last activity, and remove you from the newsletter list. You'll get a short confirmation email. Any login or use of the app resets the clock. A pause doesn't count as activity and doesn't protect your account from deletion, even while it's running.

14. How long data is kept

Account and habit data are deleted when you delete your account or when it's deleted for inactivity (see section 13). Login requests expire after 15 minutes and are removed within 24 hours. Sessions end 30 days after last use. Proof of consent (terms, newsletter) is kept for up to three years after your account ends. Server logs: 14 days. Email log: 90 days.

15. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object (Art. 15 to 21 GDPR), and you can withdraw consent at any time for the future. Export and account deletion are built right into settings. You can also complain to a supervisory authority; the responsible one is the Data Protection Commissioner of Lower Saxony (Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany).