Privacy Policy for HabitPocket

App and website · Last updated: 27 October 2026 · Deutsche Fassung

This is a translation. If the versions differ, the German version prevails.

1. Controller

This policy applies to the HabitPocket app, the website habitpocket.com and the pages with the HabitPocket legal texts on punktdev.com. The controller is Real Movement Analytics GmbH, Kleines Everstal 18d, 44388 Dortmund, Germany (legal notice). Contact: habitpocket@punktdev.com.

2. Local first

HabitPocket works fully without an account. The app stores habits, schedules, reminders, entries, notes and settings in a database on your device. It saves local backups as JSON files in the app's documents folder and keeps the seven newest. Without an account we receive none of this content. If you delete a habit, older local backups and files you have exported stay unchanged; delete them yourself if needed.

The app contains no ads, no analytics or tracking SDKs and no crash reporting service of its own. The stores provide us with aggregated usage and sales figures. For purchases, individual order and transaction information may also be available to us. Depending on your permissions and settings, the platforms may provide technical crash reports. This does not give us full card or bank details.

Local storage is required for the features you ask for (Section 25(2) no. 2 TDDDG; Art. 6(1)(b) GDPR). The data stays until you delete it in the app or uninstall the app. On iOS, your device's iCloud backup may contain a copy of the app data depending on your settings. On Android, the Google backup does not include the habit database, only individual technical settings at most. Apple or Google manage these backups, not us.

You decide which habits you create. If you track habits related to health (e.g. "take medication"), they may allow conclusions about your health. We do not analyse content. Section 7 explains how we handle such content when you sync.

3. Update check

Every time the app starts, it asks our server, also without an account, whether your app version is still supported. When you return to the running app, it checks again no sooner than 6 hours after the last check. It sends the platform (iOS/Android), app and API version and, for technical reasons, your IP address. No habit content or identifiers are sent. The purpose is to tell outdated versions in time that an update is needed (Art. 6(1)(f) GDPR). We do not store these requests in our database; for logging at Cloudflare see Section 10.

The app also asks updates.habitpocket.com at every start whether there is an update for its program code. It downloads such an update in the background and uses it from the next start. This sends the platform, app version, update channel, the numbers of the program state currently in use, of the one installed with the app, of the one requested and, if any, of recently failed updates (the same for all users of that state) and, for technical reasons, your IP address. From version 1.0.8, the app does not create, store or send an identifier of your installation for the update check, and it sends no error messages. Versions up to and including 1.0.7 still send a random identifier that the update function created on its first request and, after a crash at startup, a short technical error message. We neither store nor analyse either. Version 1.0.8 deletes this identifier from the device at its first update check. The purpose is to fix bugs quickly without waiting for a store update (Art. 6(1)(f) GDPR). We do not store these requests in a database either, and the update server keeps no log of its own; for logging at Cloudflare see Section 10.

4. Reminders, widgets, Siri and app lock

Reminders are scheduled as local notifications on your device; for this the app asks for notification permission. Widgets read a local copy of today's habits. The app lock uses the operating system's unlock, such as Face ID, Touch ID, your device's biometrics or the device passcode. We receive neither biometric data nor your device passcode.

On iPhone you can also check off habits with Siri and Shortcuts. For this the app makes the names of today's habits available to the operating system. Apple handles speech recognition under its own terms; nothing is sent to us. While a timer runs, the app shows it as a Live Activity on the lock screen. The device updates this display itself, without push messages through our server.

5. Apple Health and Health Connect

If you enable it for a habit, the app reads selected values from Apple Health or Health Connect: steps, distance, workout minutes or sleep duration, and on iOS also active minutes. This only happens while the app is open and only on your device. Individual measurements (raw data) are never sent to us. From them, the app stores one daily value as a habit entry (e.g. "8,000 steps on 28 Sep").

On Android, the Health Connect integration is not included yet, so the app reads no health values there. If an update adds it, this section applies to Health Connect as well.

You grant read access through the operating system's permission prompt and can revoke it there at any time (Art. 6(1)(a), Art. 9(2)(a) GDPR).

Sync and cloud backups of these values: If you use sync (Section 7) and at least one habit on a device is linked to Health, the app asks on that device whether the daily values taken over may leave it. Your consent covers two things: syncing the values with your account and including them in cloud backups (Art. 9(2)(a) GDPR). Without consent the values stay on the device. Everything else still syncs, and cloud backups from that device then leave the Health values out. Consent applies per device; if you sign out there and back in, the app asks again.

Withdrawal: You can withdraw consent at any time under Settings › Account › "Sync Health values". The device then stops uploading Health values, and we delete your account's Health values from the sync data and from the cloud backups, including values uploaded by other devices. This covers all daily values of habits linked to Health. If the device is offline, the app completes the deletion at the next sync; you can only sign out once it is done. The values on your devices stay. If another device still has consent, it uploads Health values from there again until you withdraw there as well.

Values from Apple Health or Health Connect are not used for advertising and not sold. Cloudflare stores synced values on our behalf as our processor (Section 12). Beyond that, we do not share them with third parties.

6. Purchases (Pro)

Apple (App Store) and Google (Google Play) handle purchases and subscriptions under their own privacy policies and are responsible for that processing. We never receive bank or card details.

If you are signed in, the app passes a pseudonymous account identifier to Apple or Google at purchase so the purchase can be linked to your HabitPocket account. Our server verifies the purchase: we process the store-signed transaction data or purchase token, transaction identifiers, the product ID, purchase and expiry time and the subscription status. For Google purchases, our server retrieves this information through the Google Play interface. The legal basis is Art. 6(1)(b) GDPR and, for abuse prevention (e.g. one purchase not being linked to several accounts), Art. 6(1)(f) GDPR.

Apple and Google notify our server about purchases, renewals, cancellations and refunds. This also applies to purchases made without a HabitPocket account. Our server verifies the notification (for Google purchases and subscriptions by querying Google Play) and looks for a matching account. It matches notifications about voided Google purchases only against existing purchase records using the purchase token. If there is no matching account, we create nothing in our database; the purchase stays only with your store account. The request itself may appear in the technical logs (Section 10). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is assigning purchase changes to the right accounts.

7. Account, sync and cloud backups (optional)

An account is optional and only needed for sync and cloud backups. You sign in with Apple or Google; there is no password. We process:

• Account data: a pseudonymous identifier from Apple or Google and, if provided, your email address (with Apple possibly an anonymous relay address).
• Device data: device model (e.g. “iPhone 15 Pro”; for devices that signed in before 7 October 2026 this may still be the device name), platform, app version, time of last activity and last sync.
• Sessions: one access key per device, stored only as a cryptographic hash, with creation and last-use time.
• Sync content: habits (name, icon, colour, description, schedule, reminder times, pauses), entries, notes and week notes; Health daily values only with consent (Section 5). Settings, app lock, widget configuration and Health links are not synced.
• Cloud backups: backups of your habits, schedules, entries and notes (without settings and Health links) that you create yourself.
• Sign in with Apple: if you sign in with Apple, we also store the refresh token issued by Apple in our database (Cloudflare D1). We use it for one purpose only: when you delete your account, we use it to revoke the link between "Sign in with Apple" and HabitPocket at Apple. The legal basis for storing it is Art. 6(1)(f) GDPR; our legitimate interest is to reliably end the sign-in link when the account is deleted, as Apple requires. The revocation during deletion itself is based on Art. 6(1)(c) GDPR in conjunction with Art. 17 GDPR.
• Audit log: a log of account and purchase actions (e.g. sign-in, device removed, purchase confirmed) without habit content.
• Connection data: the IP address is processed for abuse prevention (rate limiting). We do not store it in our database; for processing by Cloudflare see Section 10.

On your device, the app also stores your access key in the operating system's protected storage and your decisions about sync and Health values with time and text version (up to 100 entries). Before the device uploads anything, it also sends these decisions to our server. We store them there with your account and device ID so we can demonstrate your consent (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR). When you sign a device out or delete the cloud data, we record the revocation there. We delete these records together with the account.

The legal basis is Art. 6(1)(b) GDPR (providing sync and backups) and Art. 6(1)(f) GDPR (secure operation, abuse prevention). Section 5 applies to Health daily values.

Content that may relate to health: you write habit names, descriptions, entries and notes freely. They may contain health data within the meaning of Art. 9 GDPR, for example a habit called "take blood pressure pill" or a note about symptoms. We cannot tell such content apart from other content and we do not analyse it. For synced content and cloud backups that may relate to health, the legal basis is therefore your explicit consent (Art. 9(2)(a) GDPR). You give it when you turn on sync. Without it you cannot use sync and cloud backups; the app itself keeps working fully on your device. You can withdraw consent at any time with effect for the future by signing out and deleting your cloud data, by deleting your account (Section 9) or by writing to us. Values from Apple Health or Health Connect additionally need the consent described in Section 5.

8. Retention and deletion

• Signing out: If you sign out under Settings › Account on your last signed-in device, we immediately delete all sync content and cloud backups on our server. If other devices are still signed in, the cloud data stays for them; the app tells you beforehand which case applies. If the deletion fails, the device stays signed in and you can try again. If you sign out during setup (at the consent step or when choosing how to merge), we only remove this device's access; existing cloud data stays. You can remove it with "Delete cloud data" or by deleting your account. Data on your device always stays.
• Delete cloud data: Under Settings › Account you can delete all sync content and cloud backups at any time. All devices are signed out; your account and Pro status stay, and data on your devices stays.
• Deleted habits: We remove their entries and notes from the sync history within 24 hours. The habit's deletion marker (only its ID, no content) is kept for 365 days so devices that were offline for a long time also apply the deletion. Deleted entries and notes likewise leave only such a marker, without the former value.
• Cloud backups: At most the latest 30 are kept; when you create a new one, we automatically delete the oldest beyond that. We do not delete them by age. A backup stays as it was created and may contain habits or entries you deleted later. You can delete single backups yourself at any time, or all of them with "Delete cloud data" or by deleting your account.
• Sessions and devices: signed-out or removed devices and their sessions are deleted 30 days after sign-out.
• Audit log: entries are deleted after 180 days.
• Account data and purchase link: until the account is deleted.
• Deleting your account: We immediately remove the account, sign-in data, devices, sync content, cloud backups, purchase link, consent records and audit log. We only keep a note without personal data that a deletion took place. If the deletion is interrupted by a fault, the account is still locked at once; we delete the rest in the following daily runs.
• Apple refresh token: deleted together with the account after we have revoked it at Apple. If revocation fails, we keep only the token for up to 7 days to retry and then delete it in any case.
• Deletion requests via the web: a request made with sign-in is deleted together with the account. If you do not confirm the deletion, we remove the request after one day. Requests via the email form are kept until we have handled them (we handle them within 30 days). We then delete the record at once.

Our automatic deletions run once a day, so a period may be extended by up to one day. For technical reasons, the databases of our hosting provider Cloudflare keep a recovery history of up to 30 days; deleted data disappears from it after this period at the latest.

9. Deleting your account

You can delete your account in the app under Settings › Account › Delete account or at habitpocket.com/en/delete-account.

If you delete without the app, you sign in with Apple or Google on api.habitpocket.com. We process the identifier from that sign-in to find your account, plus the time and status of the request. Once you confirm, we delete the account immediately. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 17 GDPR.

If you can no longer sign in, you can request deletion through the email form on the deletion page or by email to habitpocket@punktdev.com. The form stores the email address you enter and the time in our database and sends both to our mailbox by email straight away (Section 11). We check whether the address belongs to an account and ask you by email to confirm the deletion from that address. Only then do we delete, within 30 days of receipt at the latest, and confirm the result to you by email. We remove the database record as soon as the request is handled (Section 8). The legal basis is also Art. 6(1)(c) GDPR in conjunction with Art. 17 GDPR. The fastest way to delete is in the app or by signing in on the deletion page.

Cookie for deletion on the web: when you open the deletion page on api.habitpocket.com, our server sets the cookie __Host-hp_delete. It holds a random value that binds the Apple or Google sign-in to exactly this browser. This way nobody can use a sign-in issued elsewhere to delete an account. The cookie expires after 15 minutes and is removed right after the deletion. It is strictly necessary for the deletion you asked for (Section 25(2) no. 2 TDDDG; Art. 6(1)(c) GDPR in conjunction with Art. 17 GDPR).

10. Hosting, logs and website

The website and our server run on Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (Cloudflare Pages, Workers, D1, Durable Objects, R2). For every request to the website or our server, Cloudflare processes the IP address and technical request data (time, address, browser or app information, status) to deliver content and protect the service against disruption and abuse (Art. 6(1)(f) GDPR). Cloudflare also processes technical operating data under its privacy policy.

For our server api.habitpocket.com we have enabled Cloudflare's logging (Workers Logs) to find errors. It records requests to the server with technical request data as above and technical error messages from the server; our server does not write habit content to these logs. Cloudflare deletes the logs automatically after the retention period of our plan, currently after 7 days at the latest. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is stable and secure operation.

The website habitpocket.com sets no cookies and uses no analytics. Only the deletion page on api.habitpocket.com uses a strictly necessary cookie (Section 9). Fonts and images are loaded from our own server. If you choose light or dark mode on the website, your browser stores this choice in local storage (key hp-theme) until you reset it or clear your browser data. This is required for the feature you asked for (Section 25(2) no. 2 TDDDG); nothing is sent to us.

The legal pages on punktdev.com are also delivered by Cloudflare, with the same technical request data. They set no cookies and use no analytics. If you chose light or dark mode on punktdev.com, the page reads this stored display setting (key pdev-theme) from your browser's local storage; it is not transmitted (Section 25(2) no. 2 TDDDG).

11. Contact by email

If you email us, for example at habitpocket@punktdev.com, the message arrives in our company mailbox at Microsoft 365 (Microsoft Ireland Operations Ltd., Ireland). Microsoft stores the email including content and attachments as our processor under a data processing agreement (Art. 28 GDPR), generally in data centres in the EU. For transfers to Microsoft Corporation in the USA, for example for support or security, Microsoft relies on the EU-US Data Privacy Framework and EU Standard Contractual Clauses. Emails to addresses at habitpocket.com are first received by Cloudflare through its Email Routing service and forwarded there; Cloudflare processes the sender, recipient and time and does not store the content permanently.

We process your address, the content and any information you choose to provide in order to answer your request. The legal basis is Art. 6(1)(b) GDPR for contract-related requests and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering requests. We delete the message once it is no longer needed for follow-up questions, legal defence or statutory retention obligations. Providing data is voluntary; without a reply address we cannot answer. If you send diagnostic information from the app, you decide what it contains.

12. Recipients and transfers to third countries

We use these service providers for the purposes described:

• Cloudflare, Inc. (USA): hosting of the website, legal pages, server, databases and backups, server logs, forwarding of emails and delivery of deletion requests to our mailbox (Email Routing) as our processor under a data processing agreement (Art. 28 GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; EU Standard Contractual Clauses apply in addition. Details are in the Cloudflare DPA.
• Microsoft Ireland Operations Ltd. (Ireland): Microsoft 365, our email mailbox, as our processor under a data processing agreement (Art. 28 GDPR). Data is generally stored in the EU; transfers to Microsoft Corporation (USA) are covered by the EU-US Data Privacy Framework and EU Standard Contractual Clauses.

Apple and Google are independently responsible for sign-in, the App Store and Google Play, purchases and Apple Health or Health Connect (for users in the EU: Apple Distribution International Ltd., Ireland; Google Ireland Ltd., Ireland). Their privacy policies apply. Our server only exchanges the data named above with their interfaces: with Apple the sign-in code and the refresh token (sign-in, revocation when the account is deleted), with Google Play the purchase token and product ID (purchase verification, Section 6). To verify sign-ins and store notifications it downloads public keys from Apple and Google.

You can request a copy of the safeguards at habitpocket@punktdev.com.

13. Your rights

Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction of processing and data portability, and the right to withdraw any consent with effect for the future. You can export your data yourself in the app at any time (JSON or CSV).

Objection: Where we process personal data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation.

You have the right to lodge a complaint with a data protection supervisory authority, for example the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

There is no automated decision-making or profiling. Providing data is not required by law; without an account, sync and cloud backups are not available.

14. Changes and language versions

We update this policy when the app, the website or the law changes. The version published here applies. This is a translation of the German version, which prevails in case of discrepancies.