HabitStats Privacy Policy

Effective October 21, 2026.

HabitStats helps you track habits, workouts, food and drink, sleep and time, and see your stats. It's operated by Certified Cloud Consulting LLC ("we"). We collect only what the features need, and keep it only as long as they need it.

What we store, and why

Data	Why
Email address and sign-in identifier	To sign you in with an emailed code. One sign-in is shared with our HabitStats Home app.
Optional display name, time zone and app preferences	To show your name to groups you join, and to count your days in your time zone
Your habits and everything you log: counts, times, measurements (including body weight), workouts, food and drinks with nutrients, sleep and wake times, journal entries, notes	The core features: your history, goals, streaks, records and stats
Reminder times you set on a habit	So your reminders follow you to your other devices and survive a reinstall. The reminders themselves are local notifications your phone schedules and shows; they don't pass through us or any push service
Foods and food groups you save, and diet-plan settings (for example goal weight and protein target)	Faster food logging and goals
Groups, memberships, invites, shares and cheers	Sharing habits with people you choose
Reports you make about a group or member, and people you block	Keeping groups safe (below)
Tasks a connected task service adds for you: a title, an optional due date, a category name and an optional short note or link. Only if a service is connected to your account (today this is available only to our own operator's account, not to other users)	To show those tasks on Today and tell the service when you've done them. The service can see and change only the tasks it added, never your other habits or entries
Push notification tokens, only if you turn on notifications	To tell you when someone cheers you on, and (for HabitStats Home parents) when a chore or reward needs your approval, a kiosk goes offline, or a calendar or calendar link needs attention

Your habit data is encrypted on your devices. Habit names and goals, everything you log, and the foods and routines you save are encrypted on your iPhone with a key kept in your iCloud Keychain before they're sent to us. We store them but can't read them, and neither can anyone who gets into our servers. What we can see: when you log (the date and time of each entry, not what), how many entries you make, which days you met your goals (groups you share with see your streaks), your habits' types, schedules and reminder times, and the name you give a habit while you share it with a group. An export from habitstats.com contains the encrypted values; export from the app to read them. If you lose every device and haven't kept your recovery code, the encrypted values can't be recovered, by us or anyone.

Nutrition-label photos you choose to scan are sent to Anthropic's API to read the label, and the result comes back to you as a draft food. We don't store the photo, and we send Anthropic nothing else about you. Photos are re-encoded on your phone first, which drops location and camera metadata.

We don't collect location, contacts, advertising identifiers or analytics profiles, and we don't read Apple Health. The app contains no analytics, advertising or crash-reporting code. We don't sell data, show ads, or track you across other companies' apps and websites. Health-related entries (weight, food, sleep) are used only to show your own stats, and never for advertising.

If you run a HabitStats Home family (the Home tab)

HabitStats is also the parents' app for HabitStats Home, our kitchen-wall app for families. The Home tab appears only if you're a parent in a HabitStats Home family, or when you choose to set one up. What you enter or connect there is stored by HabitStats Home, not in your HabitStats data, and is covered by the HabitStats Home privacy policy:

your family's name, and the first names (or nicknames), avatars and colours of the children and co-parents you add; children's chores, points and reward requests, and your approvals;
your kiosks' names and health, and the kiosk PIN (stored only as a salted hash);
Google Calendar and Google Photos, if you connect them: you grant read-only access on Google's own consent screen. The calendar consent code goes to HabitStats Home, which keeps the calendar access server-side to show events on the wall. For photos, the Google token stays on your phone: your phone downloads the photos you pick, removes their location and camera metadata, and encrypts them before they leave it. HabitStats Home stores only that encrypted copy, which we can't open; only your family's own devices (your kiosks and parents' phones) hold the key, and your phone shares it with them directly;
calendar links you add (for example an iCloud "Public Calendar" or Outlook "Publish a calendar" link), so other calendars can appear on the wall too, read-only. The link goes to HabitStats Home once; it keeps it encrypted, reads that calendar at most every 15 minutes, and never shows the link again;
co-parent invite links you create;
this phone's notification token, if notifications are on, so HabitStats Home can tell you about approvals, an offline kiosk, or a calendar or calendar link that needs attention.

What others can see

Nothing, until you choose. Every habit is private by default. A habit is visible to others only after you make it shareable and share it to a specific group or household.

Group members see your display name and, for each shared habit, only its name, icon, whether it's due and done today, its streak, how many days this week it was done, and how many cheers it got today. They never see your values, notes, workouts, foods, weight or sleep times.
A household in HabitStats Home sees its name, icon, whether it's due and done today and its streak on the family's kitchen wall.
Cheers are chosen from a fixed list of phrases; there's no free-text messaging.
Making a habit private removes every share at once.

Reports and blocking

Reporting. You can report a group or a member. We store the report (your account id, the reason, your note, and a copy of what you reported as it was then: the group's name, and for a member their display name, the names of habits they share to that group and the cheers they sent you) and email it to our moderator, without your identity. The person you report is never told who reported. We may rename or remove a group, or remove someone from groups, under the terms.
Blocking. When you block someone, we store who you blocked and the name they had then, so Settings can list them. They are never told. You stop seeing their habits, name and cheers, and their cheers stop reaching you.

Where it lives and who processes it

Amazon Web Services (United States, us-west-2 in Oregon) hosts all data, encrypted at rest, and sends sign-in code emails and report notices to our moderator.
Anthropic reads label photos you choose to scan (under Anthropic's commercial API terms, Anthropic deletes API inputs and outputs within 30 days and doesn't use them to train its models).
Google only if you connect Google Calendar or Google Photos in the Home tab (read-only access you grant on Google's consent screen). HabitStats doesn't offer Google sign-in.
Apple delivers notifications you turn on. What passes through Apple's (and Amazon's) push service is generic text such as "Someone cheered you on" or "A chore is waiting for approval", plus random ids: no names, phrases, habit or chore names, or email addresses. Your phone fills in the real words (for example "Sam cheered you on" or "Alex finished Tidy desk") from what it already stores, without contacting anyone.
HabitStats Home (our family wall app) receives the habit cards you share to a household, and, if you use the Home tab, what you enter or connect there (above).

How long we keep it

As long as you use HabitStats, for the data above.
Short-lived records expire on their own: cheers after 30 days; reports after 180 days; unused group invites after 7 days; deleted habits stay restorable for 30 days and are then removed; records of deleted items (which hold only an id) after 35 days; records that let the app safely retry a request after 30 days; data exports one day after you create them (the download link works for an hour).
Sign-ups never finished: if you ask for a sign-in code but never enter it, the email address you typed is deleted after 7 days.
Sign-in attempt counters: to stop abuse of sign-in, we count sign-in requests and wrong codes per email address and per network (IP) address. We store only a keyed, one-way hash of each, never the address itself, and each count expires after at most a day and is then deleted automatically.
Operational logs are kept for 7 to 14 days. They contain ids and error codes, not your entries, and no IP addresses.
Security audit logs: our cloud provider (AWS) records sign-in requests to our account system in an audit log: your account id, the IP address and device type of the request, and the time, never your code or your entries. We use it only to investigate security incidents, and it is deleted after 90 days.
Encrypted backups expire within 35 days.

Deleting your data

Settings → Delete account in the app (or Delete account at habitstats.com/account) removes, immediately: your habits, entries and everything else you logged; your group memberships (a group you own passes to another member, or is deleted if you're the only one); invites you created; cheers you sent; the people you blocked; your notification tokens; your HabitStats Home data (if you're a family's last parent, the app asks before deleting the family too); and your sign-in. Reports you made are kept as moderation records until they expire (180 days), with your identity removed. You can instead leave HabitStats only (deleting your HabitStats data but keeping the sign-in and your HabitStats Home family, which you manage in the Home tab). Encrypted backups age out within 35 days.

Website

habitstats.com hosts this policy, the support pages and an account page. There you can sign in with the same emailed code as in the app to change your display name and cheer notifications, download your data, or delete your account. You can't log habits on the website.

One cookie, only to keep you signed in. After you sign in, the site sets one strictly necessary cookie that holds your sign-in session. Page scripts can't read it, and your browser sends it only to the site's sign-in service. The browser deletes it when it closes, or after 30 days if you tick "Keep me signed in on this computer". Signing out deletes it and cancels the session. While you're signing in, a similar cookie holds the unfinished sign-in for up to 15 minutes.
Session storage: the tab you signed in with keeps a marker, which holds no identifier, so a new tab doesn't sign you in unless you asked to be kept signed in. The browser deletes it when the tab closes.
No banner needed: there are no other cookies, and no analytics, advertising, tracking or third-party content, fonts or scripts.
What the site logs: the website keeps no access logs. The sign-in service logs only event types and error codes (never your email, code or tokens) for 7 days. The account actions use the same service as the app, so the operational and security logs above apply. Our host (Amazon CloudFront) sees your IP address to deliver the pages, but we don't store it (signing in only adds to the hashed sign-in attempt counter above).

Children

HabitStats is not directed to children under 13, and we don't knowingly collect their information. Children never get accounts: in the Home tab a parent may type a child's first name or nickname for the family's wall, which HabitStats Home stores on the family's behalf.

Your choices and rights

Edit or delete any entry or habit, make habits private, leave groups, report or block people in groups (Settings → Blocked people to unblock), turn cheer notifications or habit reminders on or off, export your data (Settings → Export my data, or Download my data at habitstats.com/account; a Home parent can also export the family's HabitStats Home data from the Home tab → Family → Export household data), or delete your account in the app or on the website. For anything else, email info@certifiedcloudconsulting.com. We answer within 30 days.

Changes

We'll post changes here and update the effective date. Material changes will be announced in the app.

Contact

Certified Cloud Consulting LLC, info@certifiedcloudconsulting.com