Privacy Policy
- Version:
- 2.0
- Effective:
- Last updated:
- Applies to existing accounts from:
How KeepYourHabits collects, uses, shares and protects your personal data, and the rights you have over it.
1. Who we are and how to contact us
KeepYourHabits Ltd (trading as KeepYourHabits) is the data controller responsible for your personal data when you use the KeepYourHabits mobile apps, the website at keepyourhabits.com, our newsletter, and any related services (together, the “Service”). We are a private limited company company number 17055436, registered in England and Wales.
- Registered office: 66 Paul Street, London, England, EC2A 4NA
- Privacy contact: Patrik Grohmann, Director — support@keepyourhabits.com
- Website: https://keepyourhabits.com
We have not appointed a Data Protection Officer, because the scale and nature of our processing does not require one. All privacy questions and requests go to the address above and are handled personally by our director.
We process personal data under the UK General Data Protection Regulation and the Data Protection Act 2018 (together, “UK GDPR”) and, for people in the European Economic Area, under the EU General Data Protection Regulation (“EU GDPR”). Where we say “GDPR” below we mean both.
2. Summary of key points
- We collect what the Service needs to work: your email address and name, the habits and completions you record, the circles you join, and the technical data needed to run the apps securely.
- Your habit data is stored in the European Union (Amazon Web Services, Stockholm). A small number of service providers outside the EU/UK support the website, push notifications and crash reporting; each is listed below with the safeguards we rely on.
- We do not sell personal data, we show no advertising, and we do not share your data with advertisers or data brokers.
- Website analytics run only if you click Accept in the cookie banner.
- Habits you share into a circle are visible to that circle’s members. You choose what to share and can keep any habit private.
- You can delete your account at any time from the app or the web dashboard; your data is removed from our live systems immediately and from backups within 30 days.
- You have the full set of GDPR rights — access, correction, deletion, portability, restriction and objection — and can complain to a supervisory authority.
3. What this policy covers
This policy applies to:
- the KeepYourHabits apps for iOS and Android;
- the website at keepyourhabits.com, including the blog and the signed-in web dashboard;
- our newsletter and early-access waitlist; and
- emails, push notifications and support conversations connected to the Service.
It does not cover third-party websites or services we link to (for example Google and Apple sign-in pages or the app stores). Those services have their own privacy notices. Our Terms of Service govern your use of the Service itself.
4. The data we collect
Account and profile data
When you create an account (with Google or Apple sign-in) we store:
- your email address;
- your first and last name (you may use a pseudonym);
- the account identifier that Google or Apple gives us for you, so we can recognise you when you sign in again (we never receive your Google or Apple password);
- your time zone and language, so reminders arrive at the right local time;
- your reminder settings and notification preferences;
- a referral code you may have entered when you joined, your own referral code, and how many people joined with it;
- whether you ticked the newsletter box during onboarding; and
- the date your account was created.
During sign-in we briefly hold the one-time authorisation code from Google or Apple while we exchange it for your profile information; it is deleted once sign-in completes.
Habit and progress data
- the habits you create: name, description, category, colour, schedule, target and the privacy level you choose for each habit;
- your completions: the date and time you mark a habit done, any note or measurement you attach, and edits you make to earlier completions; and
- statistics we calculate from those completions, such as streaks and completion rates.
Habits are free text. If you choose to record habits that reveal sensitive information about you — for example your health, medication, religion or sex life — we process that information solely to provide the Service to you, on the basis of the explicit consent you give by entering it, and for no other purpose. You can edit or delete it at any time.
Circles and social features
- circles you create or join: the circle’s name, description, invite code and members;
- the habits you choose to share into a circle and your progress on them, which other members of that circle can see (see “Who we share your data with”);
- nudges, cheers and similar messages you send to or receive from circle members; and
- your in-app inbox, which keeps a copy of the notifications we send you.
Device and notification data
- a push-notification token for each device you enable notifications on, the device platform (iOS or Android) and the device’s time zone;
- a device name or identifier reported by your phone, used to label your sign-in session; and
- the app version you are running.
Technical, security and diagnostic data
- server request logs: the time of the request, the URL, your IP address, browser or app user-agent string, referring page and language. Authentication tokens and cookies are deliberately excluded from our logs;
- crash reports and performance traces from the mobile apps, sent to Sentry: device model, operating system version, app version, memory and battery state, the technical stack trace of the error and a short trail of the screens visited before it. A sample of normal sessions is also traced so we can find slow screens. We do not attach your name, email or habit content to these reports; and
- security events such as failed sign-in attempts.
Website analytics (only with your consent)
If you accept analytics in the cookie banner we collect two kinds of usage data on the website:
- Vercel Web Analytics: page views, referrer, country, browser and device type. Vercel’s analytics is cookie-less and does not track you across sites.
- Our own blog statistics: which posts are read, how far down the page you scroll, how long you spend reading and which share buttons you use, together with your IP address, user-agent string, referring page and a random identifier stored in your browser so repeat visits can be counted once.
If you decline, none of this is collected. You can change your choice at any time by clearing the site data in your browser, which brings the banner back.
Blog account features
If you bookmark or react to a blog post while signed in, we store that bookmark or reaction against your account so it follows you between devices. These are actions you take deliberately and are not analytics.
Newsletter and waitlist
If you subscribe to our newsletter or join the early-access waitlist we store:
- your email address and, if you give it, your first name;
- your language, where you signed up (for example the website waitlist form or onboarding) and your topic preferences;
- the time you subscribed and the time you confirmed the subscription by clicking the link in our confirmation email (double opt-in);
- delivery and engagement events reported to us by our email provider: deliveries, bounces, complaints, opens and link clicks, each with a timestamp and, for opens and clicks, the IP address and user-agent your email client reported; and
- the time you unsubscribe, which we keep so that we never email you again by mistake.
Support conversations
When you email us we keep the correspondence, including your email address and anything you choose to tell us, for as long as needed to help you and to keep a record of how the issue was resolved.
Data we receive from others
- Google and Apple sign-in: your email address, name and account identifier. We do not request access to your contacts, calendar, photos or any other data.
- App Store and Google Play: aggregated install, crash and review statistics that cannot identify individual users.
Data we do not collect
We do not collect precise location, contacts, photos, health data from Apple Health or Google Fit, or payment card details. The Service is currently free and has no in-app purchases; if we introduce paid features we will update this policy first.
5. How we use your data and our legal bases
GDPR requires a legal basis for every use of personal data. The table below lists what we do and why we are allowed to do it.
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating your account, signing you in, syncing your habits between devices and showing your progress | Account, habit and device data | Performance of our contract with you (the Terms of Service) |
| Running circles: showing shared habits and progress to members, delivering nudges and cheers | Circle data, shared habit data, your name | Performance of our contract with you |
| Sending habit reminders and other functional notifications you have turned on | Push token, reminder settings, time zone | Performance of our contract with you; you can turn notifications off at any time |
| Sending essential service emails (for example about security, changes to these documents or your account) | Email address, name | Performance of our contract with you and our legitimate interest in keeping you informed |
| Keeping the Service secure, preventing abuse and fixing bugs | Technical, security and diagnostic data | Our legitimate interest in a secure, reliable Service |
| Understanding how the website and blog are used | Website analytics data | Your consent, given in the cookie banner |
| Sending the newsletter | Newsletter data | Your consent, confirmed by double opt-in; withdraw any time via the unsubscribe link |
| Running the referral programme and preventing referral abuse | Referral codes and counts | Performance of our contract with you and our legitimate interest in preventing abuse |
| Producing aggregated, anonymous statistics about how the Service is used (for example “most habits are completed before 9am”) | Habit and usage data, anonymised so it can no longer identify anyone | Our legitimate interest in improving the Service and demonstrating it to partners and investors |
| Answering your questions and requests | Support conversations | Our legitimate interest in supporting you; where a request concerns your rights, our legal obligation to respond |
| Complying with the law, for example responding to a lawful request from an authority | Whatever the obligation requires | Legal obligation |
Where we rely on legitimate interests we have checked that our interest is not overridden by your rights. You can object to any processing based on legitimate interests (see “Your rights”). Providing your email address, name and habit data is necessary to use the Service; without them we cannot provide it.
7. International transfers
Your account and habit data live in the European Union. The UK and the EU each recognise the other as providing adequate data protection, so data can move between them without further safeguards.
Some of the providers listed above are based in the United States or operate global networks: Vercel (website hosting), Sentry (crash reporting), Google (push delivery and sign-in) and Apple (push delivery and sign-in). Whenever personal data leaves the UK or EEA we rely on one of the following safeguards:
- an adequacy decision — including the EU–US Data Privacy Framework and the UK Extension to it, where the provider is certified;
- the European Commission’s Standard Contractual Clauses together with the UK International Data Transfer Addendum; and
- additional technical measures such as encryption in transit and at rest.
You can ask us for a copy of the safeguards that apply to a particular provider by emailing support@keepyourhabits.com.
8. How long we keep your data
| Data | How long |
|---|---|
| Account, profile, habit, circle and inbox data | For as long as your account exists. When you delete your account these records are deleted from our live database immediately and disappear from encrypted backups within 30 days. |
| Nudges and cheers you sent to others | Remain in the recipient’s inbox, but are detached from you: once your account is deleted they no longer carry your name or account reference. |
| Push-notification tokens | Until you sign out of the device, turn notifications off or delete your account. |
| Server request logs | Up to 90 days, then deleted automatically. |
| Crash reports and performance traces (Sentry) | 90 days, then deleted automatically by Sentry. |
| Website analytics records (blog statistics) | IP addresses and user-agent strings are removed or aggregated within 13 months; aggregated counts are kept indefinitely. |
| Vercel Web Analytics | Held by Vercel in aggregated form according to our plan’s retention period. |
| Newsletter subscription and engagement records | Until you unsubscribe. After that we keep only your email address on a suppression list so we never email you again, plus the fact and date of your unsubscribe. |
| Support emails | Up to 2 years after the conversation ends. |
| Records we must keep by law (for example accounting records) | For the period the law requires, typically 6 years in the UK. |
You can delete individual habits, completions and circles at any time from the app without deleting your account.
9. How we protect your data
- All traffic between your device and our servers is encrypted with TLS.
- Our database and backups are encrypted at rest with keys managed by AWS Key Management Service.
- Our servers run inside a private network with least-privilege access controls; only our director and, where strictly necessary, our processors can access production data.
- We never store your Google or Apple password. Sign-in relies on those providers’ own security, including any two-factor authentication you have enabled with them.
- Authentication tokens and cookies are excluded from our logs.
- We monitor for errors and unusual activity and keep the software we depend on up to date.
No system is completely secure. Please keep your Google or Apple account protected with a strong password and two-factor authentication, and tell us immediately at support@keepyourhabits.com if you suspect unauthorised access to your account.
10. Your rights
Under GDPR you have the right to:
- Access the personal data we hold about you and receive a copy;
- Correct inaccurate or incomplete data — you can change your name and preferences directly in the app;
- Delete your data (“right to be forgotten”) — you can delete your account yourself from the app’s profile screen or the web dashboard’s settings;
- Port your data: receive your habits and completions in a structured, machine-readable format (CSV or JSON) and transmit them to another service;
- Restrict processing while a dispute about accuracy or lawfulness is resolved;
- Object to processing based on our legitimate interests, and to direct marketing at any time;
- Withdraw consent at any time where we rely on it (newsletter, website analytics), without affecting the lawfulness of processing before withdrawal; and
- Complain to a supervisory authority (see “Contact and complaints”).
How to exercise your rights
Email support@keepyourhabits.com from the address on your account, stating which right you want to exercise. We may ask you to confirm your identity so we do not hand your data to someone else. We respond within one month; for complex or numerous requests we may extend this by up to two further months and will tell you why within the first month. Exercising your rights is free unless a request is manifestly unfounded or excessive.
12. Children
The Service is not directed at children and you must be at least 16 years old to create an account. We do not knowingly collect personal data from anyone younger. If you believe a child under 16 has given us personal data, email support@keepyourhabits.com and we will delete it.
13. Automated decision-making and profiling
We do not make decisions about you by automated means that have legal or similarly significant effects, and we do not profile you. Reminders and streak calculations are based only on the settings and completions you enter yourself.
14. Links to other services
The Service links to third-party services such as Google, Apple, the app stores and websites referenced in blog posts. We are not responsible for their privacy practices. Please read their privacy notices before using them.
15. Security incidents
If a personal data breach occurs we will contain it, investigate it and, where it is likely to result in a risk to your rights, notify the Information Commissioner’s Office within 72 hours of becoming aware of it as the law requires. Where the breach is likely to result in a high risk to you, we will also tell you directly without undue delay, explaining what happened and what you can do. You can report a suspected security issue to support@keepyourhabits.com.
16. Additional information for specific regions
Hungary and other EU countries
The Service is offered in Hungarian as well as English. EU GDPR applies to you in full, including the right to lodge a complaint with your local authority — in Hungary, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH). Where this policy is translated, the English version is the authoritative one.
United States
We do not currently meet the thresholds that make the California Consumer Privacy Act (as amended by the CPRA) or similar state laws apply to us. We nevertheless honour their core principles: you can access, correct and delete your data, we do not sell or “share” personal data for cross-context behavioural advertising, and we do not discriminate against you for exercising your rights. Email support@keepyourhabits.com with “US Privacy Request” in the subject line.
17. Changes to this policy
We will update this policy when our practices, the law or the Service change. Each version shows its version number, effective date and last-updated date at the top.
- Material changes — for example a new category of data, a new purpose or a new recipient — take effect no sooner than 30 days after we notify you by email and/or in the app, unless a change is required by law sooner.
- Minor changes — clarifications, contact details, typographical fixes — take effect when published.
If you do not agree with a change you can delete your account before it takes effect. Previous versions are available on request.
This version. Version 2.0 was published on 29 September 2026 and applies from that day to accounts created on or after it. If your account existed before 29 September 2026, version 1.0 continues to apply to you until 29 October 2026, when this version takes effect for you too. We emailed every existing account holder about the change on publication.
18. Contact and complaints
Questions, requests and complaints about this policy or your data: support@keepyourhabits.com (please address them to Patrik Grohmann, Director). We aim to acknowledge every message within 5 business days.
If you are not satisfied with our response you have the right to complain to a supervisory authority. Our lead authority is:
- Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom — ico.org.uk — helpline +44 303 123 1113.
You may also complain to the authority where you live or work, for example:
- Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11, Hungary — naih.hu — ugyfelszolgalat@naih.hu.
- Any other EU data protection authority; a list is published by the European Data Protection Board at edpb.europa.eu.
19. Version history
- Version 2.0 — effective 29 September 2026 (for accounts created before that date: 29 October 2026). Controller changed from the founder personally to KeepYourHabits Ltd; contact address moved to support@keepyourhabits.com; added circles, referrals, in-app inbox, Sentry crash reporting, Vercel website hosting and analytics, blog statistics and newsletter engagement tracking; corrected the description of the cookie banner and of newsletter opt-in during onboarding; added retention table, children’s section and regional information.
- Version 1.0 — effective 1 February 2026. Original policy published for the MVP launch.