Privacy Notice

Habit Beads is operated by Andrew Aguilar, a sole trader trading as Habit Beads. We are the data controller for the personal data described here, which means we decide what is collected and why. Privacy questions and data requests can be sent to capellam42@gmail.com.

Account data — your email address, an optional display name, and your preferences (default reminder time and light/dark appearance). Used to create and run your account. Legal basis: performance of our contract with you.

Habit content — the habit name, optional description, whether it is a “do” or “avoid” habit, the start date, the length in days, an optional reminder time, and for each bead a date, a status (green, orange, red or grey) and any note you write. Used only to show you your string and your record over time. Legal basis: performance of our contract with you.

Subscription status — whether your account is entitled to Plus, the plan and its renewal or expiry dates, and the reference ids our payment provider gives us. Legal basis: performance of our contract with you. We never receive or store your card details.

Anonymous product events — an event name from a fixed list, the time it happened, and your account id, so we can tell whether the app is useful (for example, that someone viewed the Plus page). Never includes habit names, descriptions, notes or statuses. Legal basis: our legitimate interest in improving the product.

Support messages — anything you send us by email, kept so we can answer you. Legal basis: our legitimate interest in providing support.

Technical data — our hosting provider processes IP addresses and basic request logs for security and abuse prevention. Legal basis: our legitimate interest in keeping the service secure.

Habit strings, beads and notes are visible only to the account that created them. The database enforces this at the row level, so one account cannot read or change another account's records. Habit Beads does not sell your data, has no social or public profile features, and does not share your habit content with advertisers or other users.

Paddle.com — our Merchant of Record. Paddle handles the sale of Habit Beads Plus, subscription management, payments, tax compliance, invoicing and refunds, and receives the billing details you enter at checkout.

Service providers — our hosting, database, authentication and transactional email providers, who process data on our instructions in order to run the service.

Google — only if you choose to sign in with Google, in which case we receive your email address and basic profile information to identify your account. We never receive your Google password.

Professional advisers and authorities — legal or accounting advisers where necessary, and public authorities where the law requires it.

Some of these providers process data outside the UK and EEA. Where that happens, the transfer is covered by an adequacy decision or by standard contractual clauses with appropriate safeguards.

You can sign in with an email address and password, or with Google. When you use a password, only a secure one-way hash is stored, never the password itself. Your signed-in session is kept in your browser's local storage so you are not asked to sign in every time; signing out clears it. Habit Beads uses only essential cookies and storage needed to keep you signed in and to run checkout — there are no advertising or third-party tracking cookies.

Account and habit data is kept for as long as your account exists. Records of purchases and tax records are kept for as long as the law requires, typically six years. Anything no longer needed is deleted or anonymised.

You can delete your account at any time from Settings. Deletion is permanent and removes your profile, every habit string, every bead and note, and your analytics events, then deletes the sign-in account itself and cancels any active subscription. Backups held by the hosting provider may retain copies for a short period before they expire in the normal course of backup rotation.

You have the right to access your data, correct it, have it erased, restrict or object to how we use it, receive a portable copy, and withdraw consent where we rely on it. Email capellam42@gmail.com and we will respond within one month. If you are in the UK you can also complain to the Information Commissioner's Office; elsewhere in the EEA, to your local supervisory authority.

We use appropriate technical and organisational measures to protect your data, including encryption in transit, row-level access control in the database, and restricted administrative access.

As Habit Beads develops, this notice will be updated. Material changes will be noted in the app.