Privacy Policy

1. Introduction

HabitTrail ("we," "our," or "us") operates the HabitTrail mobile application (the "App") available on iOS. This Privacy Policy explains what information we collect, how we use it, with whom we share it, and your rights regarding your data.

By creating an account or using the App, the parent or guardian managing the account agrees to the practices described in this Policy. If you do not agree, please do not use the App.

This Policy applies to:

• The HabitTrail iOS app (com.habittrail.app)
• The HabitTrail widget extension (com.habittrail.app.widget)
• Any companion web app accessible at habit-trail.com

2. Information We Collect

We collect only what is necessary to provide the habit-tracking and family management features of the App.

2.1 Account Information (Parent/Guardian)

2.2 Family Member Profiles

2.3 Habit & Activity Data

2.4 Device & Technical Data

We collect limited technical data to operate the service:

• Firebase Analytics — aggregate usage metrics (no advertising identifiers)
• Crash reports — anonymous crash logs via Firebase Crashlytics to fix bugs
• Push notification tokens — device token required to deliver reminders
• iOS version and device model — for compatibility purposes only

2.5 Biometric Data

2.6 Widget Data

The HabitTrail widget reads a limited snapshot of your next scheduled habit from a shared App Group container stored locally on your device. No additional data is collected or transmitted by the widget.

2.7 Data We Do Not Collect

• Photos, camera, or microphone data
• Location or GPS data
• Contacts or address book
• Health or HealthKit data
• Advertising identifiers (IDFA/GAID)
• Social media profiles or logins
• Payment or financial data

3. Children's Privacy (COPPA)

3.1 How Child Profiles Work

Children do not create independent accounts. A parent or guardian creates the family account using an adult email address and then adds child profiles. Each child profile contains:

• A first name (or nickname) chosen by the parent
• An age group (broad bracket, not exact birthdate)
• Game data: XP points, level, reward stars, habit completions
• A 4-digit PIN used locally to enter Kid Session — stored hashed on-device only

Children's profiles are not tied to an email address, phone number, or any unique identifier beyond an internal system ID generated by Firebase.

3.2 Parental Consent

By creating a child profile, the parent or guardian provides verifiable consent for the limited data collection described above. Parents can:

• View all data associated with a child profile at any time within the App
• Edit or rename any child profile
• Delete a child profile, which permanently erases all associated data from Firestore
• Delete the entire family account, which removes all profiles and data

3.3 Kid Session Access

The Kid Session is a restricted UI mode accessible via a PIN. Within Kid Session, children can mark habits complete, collect stars, and view their rewards. The Kid Session does not allow internet browsing, does not send analytics tied to a child identifier, and does not display advertising of any kind.

3.4 No Behavioral Advertising to Children

We do not use child profile data for advertising, profiling, or any commercial purpose beyond operating the App's core features.

3.5 International Children's Privacy

For users in the European Economic Area, we treat all child profiles as requiring explicit parental consent under GDPR Article 8. For users in the UK, we comply with the UK GDPR and the Age Appropriate Design Code (Children's Code). For Canadian users, we comply with PIPEDA requirements for minors.

4. How We Use Your Data

Legal Bases for Processing (GDPR)

5. Third-Party Services

HabitTrail uses the following third-party services. By using the App, you acknowledge these sub-processors:

Google Firebase is certified under the EU–US Data Privacy Framework and commits to GDPR-compliant data processing. All Firebase data is processed per Google's Data Processing Addendum.

We do not sell, rent, or share your personal data with advertisers, data brokers, or any commercial third parties for marketing purposes.

6. Data Retention & Deletion

6.1 Retention Periods

6.2 How to Delete Your Data

You can delete your data in the following ways:

• Delete a child profile: Go to Family > [Member Name] > Edit > Delete Member. All data for that profile is permanently removed from Firestore.
• Delete your entire account: Go to Settings > Account > Delete Account. This permanently deletes all family data, habits, rewards, and your authentication record.
• Email request: Send a deletion request to habittrail.app@gmail.com. We will process it within 30 days.

7. Data Security

We implement industry-standard measures to protect your data:

• Encryption in transit: All data transmitted between the App and Firebase is encrypted using TLS 1.2+
• Encryption at rest: Firebase Firestore encrypts data at rest by default using AES-256
• Biometric authentication: Optional Face ID / Touch ID uses Apple's Secure Enclave — no biometric data leaves your device
• PIN protection: 4-digit Kid Session PINs are hashed and stored only in the iOS Keychain on-device
• Firebase Security Rules: Firestore rules ensure each family can only access their own data
• No plaintext passwords: Passwords are managed by Firebase Authentication and never stored by us

While we take commercially reasonable steps to secure your information, no method of transmission over the internet is 100% secure. Please use a strong password and enable biometric lock for additional protection.

8. Notifications

HabitTrail may send the following types of push notifications:

• Morning habit reminders — sent at 8:30 AM by default (configurable in Settings)
• Evening check-ins — optional parent summary of daily habit completion
• Reward milestones — when a child reaches a new level or earns a reward

You can manage or disable notifications at any time via Settings > Notifications in the App, or through your device's iOS Settings > Notifications > HabitTrail.

9. Your Privacy Rights

• ✓ Access — Request a copy of all personal data we hold about your family account.
• ✓ Correction — Update or correct inaccurate information via the App or by contacting us.
• ✓ Deletion ("Right to be Forgotten") — Delete your account and all associated data within the App or by emailing us.
• ✓ Data Portability — Request an export of your habit and family data in a machine-readable format (JSON).
• ✓ Withdraw Consent — Disable push notifications or revoke permissions at any time through iOS Settings.
• ✓ Object to Processing — Object to our use of your data for analytics or other legitimate interest processing.
• ✓ Parental Rights (COPPA) — Review, edit, or delete any child profile data at any time from within the App.
• ✓ California Rights (CCPA) — California residents have the right to know, delete, and opt out of sale of personal information. We do not sell personal information.

To exercise any of these rights, contact us at habittrail.app@gmail.com. We will respond within 30 days (or 45 days where permitted by law).

10. International Data Transfers

HabitTrail is based in the United States. If you use the App from outside the U.S., your data will be transferred to and processed in the U.S. and other countries where Google maintains Firebase infrastructure.

Google participates in the EU–US Data Privacy Framework and has entered into Standard Contractual Clauses (SCCs) for transfers from the EEA, UK, and Switzerland to the U.S., providing appropriate safeguards for your personal data.

11. Changes to This Policy

We may update this Privacy Policy periodically. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Show an in-app banner prompting you to review the updated policy
• Send an email notification to the account email address for significant changes

Continued use of the App after the effective date of the revised policy constitutes your acceptance of the changes.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out: