Privacy Policy

Who we are

Habit Hatch is provided by Tenura (PTY) Ltd ("Tenura", "we" or "us"). This policy explains information handled through the app, our website and support. Contact support@habit-hatch.com with privacy questions or requests.

Contact address: 12 oldfield Rd Seapoint Cape Town Western Cape 8005

Habit Hatch keeps your habit records and companion progress on your device. Other information can leave your device for purchases, support, diagnostics and, in iOS version 1.0.0 (build 5), enabled product analytics as explained below. These services have different controls; the Usage analytics switch does not turn them all off. This website does not enable app diagnostics or app product analytics; cookieless website analytics has separate privacy controls below.

Your habits and device storage

The app stores habit names, categories, icons, schedules, targets, reminders, completions and dates, along with companion names, species, progress and related history. It also stores preferences, onboarding choices, notification and analytics settings, and cached purchase-access information separately on your device. Older installations may retain legacy progress fields; these do not mean your companion loses health when you take a break.

Ordinary habit tracking does not require a Habit Hatch cloud account. We do not provide app-operated cloud backup, account synchronization or an export/import feature. Restoring a purchase restores eligible paid access, not your habits or companions.

What you enter can reveal private or sensitive information. Keep your device secure and consider what you put in habit names. The app does not apply its own database encryption; device-level security is separate. Operating-system backups may include app storage, depending on your device and settings. We cannot recover a device-only database for you.

Reminders

With your permission, the app schedules reminders locally through your operating system. A notification can include a habit or companion name, visible on a lock screen or to someone using your device. You can change reminders in the app and notification visibility in device settings. Turning off lock-screen previews is separate from turning off reminders.

Purchases and paid access

RevenueCat and Apple or Google help display offers, verify transactions, check paid access and restore eligible purchases in the prepared releases. The purchase service can connect when you start the app, before you select Buy. It is separate from the Usage analytics setting.

This processing includes a RevenueCat-generated app-user identifier, purchase and transaction details, product identifiers, entitlement status, and technical device and store metadata. The identifier is pseudonymous: it distinguishes an installation or customer record without being a name, but is still an identifier. We do not supply RevenueCat with your email address or custom customer attributes.

Apple or Google processes payment under its own terms and privacy practices. Habit Hatch does not collect your full payment-card details. Disabling analytics or resetting progress does not delete store or purchase-service records.

Product analytics and your choice

iOS version 1.0.0 (build 5) enables production product analytics, subject to your Usage analytics preference and working persistent storage. Sessions and newly recorded habit completions have been received from this version. Earlier iOS builds 3 and 4 had product analytics disabled by release configuration. Configuration can differ between releases and platforms; enabling it in iOS build 5 does not establish that it is enabled in an Android release. An ON preference alone does not override a disabled release configuration. App product analytics is separate from the optional website analytics described below.

In iOS build 5, limited usage analytics is on by default only when there is no saved analytics choice, to help us understand how Habit Hatch is used and improve the app. You can turn it off using Usage analytics in Settings. A previously saved off choice stays off after an update. An incomplete analytics purge keeps collection suspended until a successful retry. Turning it off does not disable habit tracking or other free or paid functionality. Default-on is not affirmative consent.

When configured and enabled, the feature sends limited events about onboarding, sessions, newly recorded habit completions, acquiring and hatching eggs, paywall views, and supported purchase and restoration outcomes. Details can include event times, random installation, session and operation identifiers, app version and build, platform, companion species, whether a completion is for today, onboarding choices such as whether an initial habit was created, plan type, verified billing environment and defined source or outcome codes. Technical delivery information includes SDK version and batch timing. This is not a complete native purchase funnel: events requiring a verified billing environment are omitted when it is unknown, and not every event or outcome is guaranteed to arrive. The analytics events exclude habit names, notes, other habit text and categories, companion names, email addresses and raw error messages. Automatic screen or touch capture, session recording and automatic error collection are not part of this analytics feature.

The configured destination for that feature is PostHog's EU service. A persistent random installation identifier links activity over time, including purchase outcomes and app usage, while analytics remains enabled with valid configuration. It is an installation identifier, not authenticated account attribution. RevenueCat identifiers and raw transaction or product identifiers are not exported to these analytics events. These records are pseudonymous, not anonymous or only anonymous totals. The integration disables person-profile creation and requests that GeoIP enrichment be disabled; it does not send GPS/location fields. Network services can still receive an IP address when handling a request even if it is not an event property. This is not a guarantee about provider IP records or location inference. An EU analytics destination does not mean every Habit Hatch service processes information only in the EU.

Turning Usage analytics off immediately stops future collection and attempts to clear queued local analytics and the local analytics identifier, without clearing your habits, progress or paid access. It revokes pending collection permissions so an old analytics client cannot restart collection or restore its queue. If storage cannot be updated or cleared, collection stays suspended in the running app and Settings reports an error so you can retry; an unsaved off choice cannot be guaranteed to survive an app restart. The switch cannot recall requests already sent or in flight, or itself delete provider-held records. After a successful off-and-clear operation, deliberately turning analytics on again creates a fresh identifier without backfilling past activity. Young people's information requires additional safeguards; the default setting does not establish parental authorization.

Crash and error reporting

iOS version 1.0.0 (build 5) uses Sentry for best-effort JavaScript error and purchase-stage diagnostics for fault diagnosis, not performance monitoring or performance tracing. In this iOS build, native crash handling and automatic native SDK initialization are disabled. This is not coverage of native-only crashes, failures before JavaScript starts, or internal Apple authentication steps. Development builds normally leave reporting off. Configuration does not guarantee that every error or crash will be delivered or correctly mapped to its source, or that reports survive offline use or an app termination.

For iOS build 5, the app rebuilds diagnostic reports from a limited set of allowed fields before sending them. These can include a fixed runtime-error label, static app-bundle code locations and numeric offsets, app release and build, SDK and source-map identifiers, and purchase-stage codes, states, flags and random diagnostic-run identifiers. It does not send console or network breadcrumbs, raw error messages, saved habit records, user-entered text or general device and operating-system context through this projected reporting path. Reports are not anonymous. The integration does not enable session replay, screenshots, performance profiling or a separate structured-log collection service. Sentry and its network providers can also process IP addresses and related geographic information; limiting app-supplied fields is not a guarantee about provider network records or location inference.

We do not deliberately upload your saved habit database or attach saved habit records to reports. The iOS build 5 projection is narrower than the earlier diagnostic baseline; it does not establish that Android uses the same configuration. Other release paths may include error types and messages, stack traces showing code locations, console or network breadcrumbs, and device and operating-system details. In those paths, errors and activity records can incidentally contain user-entered or other private text. We cannot promise that habit text is always excluded across every platform and native reporting path. Sentry's default personal-information protections and built-in server-side data scrubbing remain a baseline, not a substitute for the iOS projection. Server-side scrubbing happens after transmission and cannot recognize or remove every sensitive item; it is not a guarantee that sensitive information stays on your device.

Crash reporting is separate from optional product analytics and is not controlled by its Settings switch, including when product analytics is disabled by release configuration. There is no separate in-app diagnostics switch.

Support and website visits

When you email support, we receive your address, message, correspondence details and any attachments or purchase references you send. We use Google Workspace to handle correspondence and use that information to answer your request and resolve related service issues. Send only what is needed. Do not send passwords, verification codes, full card details, private habit text or sensitive health information.

This website uses AWS S3 hosting in Ireland and CloudFront to deliver pages. CloudFront can handle requests globally. AWS can process IP addresses, requested pages, request times, browser information and service or security metadata. Standard S3 and CloudFront access logging is disabled; this does not mean AWS processes no operational records. The website has no embedded advertising. Following an external link takes you to a service with its own practices.

This website uses PostHog's always-cookieless analytics to understand page views, traffic sources and store-button clicks, without a consent banner. Collection stays off when your browser sends Global Privacy Control or Do Not Track, or you have saved a website opt-out, including a prior explicit denial. Use Analytics privacy controls at the bottom of any page to turn website analytics off or resume it. The website choice is separate from app Usage analytics and does not enable app diagnostics or change the age policy; involve a parent or guardian where required by law.

Enabled events contain only a fixed website page URL without query strings or fragments, a broad predefined referral category, only the predefined campaign values we recognize, and, for store clicks, Apple or Google and the button placement, plus limited technical event timestamps, event-deduplication UUIDs and SDK version. Store clicks are not installs or cross-device attribution. No session replay or automatic click, form, text, error or screen recording is enabled. We do not send names, emails, habit data, arbitrary URL parameters, referrer paths, app identifiers or person profiles to website analytics.

The website does not save analytics cookies or identifiers in browser local or session storage. The standard SDK may access browser storage for temporary capability checks and SDK bookkeeping; this is not a guarantee of zero storage access. Our website controls save a necessary opt-out preference in local storage if you turn website analytics off; a prior saved website choice is respected, and the obsolete tab analytics identifier is removed. Resuming clears the opt-out preference, not your unrelated browser data. PostHog's EU service processes IP address, user agent and website hostname to derive a project-specific daily salted hash on its servers, rather than a stable client identifier. PostHog documents that the daily salt is deleted after processing and that cookieless tracking does not support GeoIP or bot enrichment. This limits linking across days, not a promise of anonymous totals or an exact count of people. PostHog and network services still receive technical request metadata; we cannot guarantee provider operational IP records, and an EU destination does not make all processing EU-only.

Turning website analytics off stops future collection in this page; other open pages check the saved preference before sending. No analytics SDK is loaded for an excluded visit. There is no local history backfill or SDK retry backlog. Withdrawal cannot recall requests already sent or in flight or delete provider records. If browser preference storage fails, collection remains suspended on that page and the privacy controls report the problem; a choice that could not be saved cannot be guaranteed after reload. To request deletion of provider-held information, contact support; cookieless records may be difficult to locate and we may need proportionate information. Cookieless operation is not a certification of legal compliance in every jurisdiction.

Purposes, sharing and international processing

We use information to deliver website pages, answer support requests, maintain security, provide app features and paid access, and diagnose faults through the release-specific reporting described above. Enabled product analytics in iOS build 5 helps us understand product use to improve Habit Hatch, with the default-on setting and separate off choice explained above. We do not treat that default as consent. Habit text is excluded from those product-analytics events; the separate diagnostic-information limits are explained above.

Recipients for website delivery and support include AWS and Google Workspace, and PostHog for cookieless website analytics to improve the website as described above. App recipients include Apple or Google, RevenueCat and Sentry as described above, and PostHog for enabled product analytics in iOS build 5. Analytics collection depends on the release configuration and your choice, not merely the platform name. We may also disclose information when required by law or necessary to address a lawful security or rights claim. Providers may process information in countries other than yours; local app storage and an EU hosting region do not keep every service's processing in one country.

Retention and deletion

Local records remain subject to app controls and your device's storage and backup settings. “Reset all data” resets progress; it is not comprehensive privacy erasure. Preferences, analytics identifiers and other local records may remain. It does not erase support correspondence or provider records, or cancel a subscription. Uninstalling may remove local storage, but backups and outside records are separate.

For information held outside your device, our retention approach is purpose-based: keep support correspondence while addressing the issue and for necessary follow-up; purchase information while needed to administer access, resolve disputes or meet legal obligations; and analytics or diagnostics only while needed for product analysis or fault investigation. Records needed for a legal obligation or dispute may be retained for that purpose. We aim to delete or de-identify information when its purpose ends. Provider-held records also depend on the relevant service's retention and deletion arrangements; there is no single deletion deadline for every category.

Age and younger users

Habit Hatch is intended for teenagers and adults aged 13 and over, not directed to children under 13. Its gentle content does not mean it is designed for every age group. A higher minimum age or parental authorization may be required by applicable law.

If you are under 13, please do not use Habit Hatch. If you are a teenager, involve a parent or legal guardian where the law requires their authorization. Parents and guardians can contact support about a young person's information or request its deletion. We may need limited information to locate the relevant record and confirm authority to act. If we learn that we have received personal information from someone below the applicable minimum age, we will assess and address it under applicable law, including deletion where required.

A store content rating, purchase approval or analytics setting does not by itself provide every authorization required for a young person's information. This policy does not claim an age-verification or parental-consent gate is implemented in the app.

Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction or portability of information, object to processing, withdraw consent, or complain to the relevant privacy regulator. You can also raise a privacy complaint with South Africa's Information Regulator (https://inforegulator.org.za/contact-us/) at POPIAComplaints@inforegulator.org.za. Contact support to make a request to Tenura. We may ask for proportionate identity or record-location information, not your full private habit history. Some records must be retained by law, and we cannot remotely retrieve information stored only on your device.

We will update this policy when practices change and provide appropriate notice of material changes. Your statutory privacy rights are not reduced by this policy.