Privacy Policy

Last updated: July 22, 2026

Habidu ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains what we collect, how it's used and processed, and the rights you have over your data when you use the Habidu app and website.

1. Information We Collect

We collect the information you provide while using Habidu:

• Account data - your email address and authentication details, managed by Firebase Authentication.
• Tasks & schedule - your tasks, routines, timers, streaks, and settings.
• Coach conversations - messages, voice notes, and images you send to the AI coach, plus a short-term memory of facts the coach learns to personalize its help.
• Journal entries - your morning intentions and evening reflections.
• Support messages - anything you send via "Chat with the founder" and the feature-request board.
• Device data - a push-notification token and your timezone (so reminders arrive at your local time).
• Usage analytics - product events such as "app opened" or "task completed" (see Section 4).

2. How We Use Your Information

• Provide and improve the Habidu coaching service
• Personalize your schedule, nudges, and coaching interactions
• Send you task reminders and coach nudges (you control these in Settings)
• Track your streaks and progress over time
• Respond when you contact support
• Understand aggregate usage so we can improve the product

3. AI Processing

Habidu's coach is powered by third-party AI services. When you chat with the coach (text, voice, or images), your messages and relevant context (such as your tasks for the day) are processed by Google's Gemini models via Google Cloud to generate responses. If you enable read-aloud / voice replies, the coach's text replies are converted to speech by ElevenLabs. These providers process your content to provide the service; we do not allow them to use it to advertise to you. Your conversations are stored in your account so the coach can remember context between sessions.

Your consent. The AI coach is central to Habidu. On iOS, before any of your content is sent to Google's Gemini AI, Habidu shows a disclosure describing what is shared and who processes it; by continuing past that screen you consent to this processing. On all platforms your ongoing control is the AI coach toggle in Settings - turning it off stops all sending to the AI at any time. AI features require this processing to work; with the AI coach off, the rest of Habidu (timeline, focus timer, habits, inbox) remains fully usable.

Third-party protection. Under Google's paid Gemini API, your content is not used to train Google's models, and Google processes it only to return the coach's response. Google and ElevenLabs are bound by their own confidentiality and data-protection terms, which provide protections equivalent to those described in this policy. See Google's Gemini API terms and ElevenLabs' privacy policy.

Google Calendar & Limited Use

If you choose to connect Google Calendar, Habidu requests read-only access to your calendar events (the calendar.events.readonly scope) solely to display your events alongside your schedule on the Timeline and Flow screens and to help you plan around them. We request the narrowest scope needed for this feature and nothing more.

Limited Use. Habidu's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use, transfer, or sell your Google Workspace (Google Calendar) data - raw, aggregated, or derived - to develop, improve, or train any generalized or foundational artificial-intelligence or machine-learning models, and we do not use it for advertising. Your calendar events are read on your device to build your schedule and are not sent to our AI provider. You can disconnect Google Calendar at any time in Settings, which immediately stops all access.

4. Analytics

We use PostHog and Google Firebase Analytics to collect product-usage events (e.g. app opened, task completed, feature used) tied to your account ID, along with basic technical details such as your app version, platform, browser, and approximate location (country/region derived from your IP address, not precise GPS). We use this to understand which features help people, see where our users are, and improve Habidu. We do not send the content of your tasks, journals, or coach conversations to analytics.

We also use PostHog session replay in the web and mobile apps, which records how the app's screens are used during a session (taps, navigation, and what is rendered) tied to your account ID, so we can diagnose problems you report and fix confusing flows. In the mobile apps, text you type and images are masked (redacted) in recordings - the content of your tasks, journal entries, and coach conversations is not readable in a replay. Replays are stored by PostHog under their data-protection terms, retained for a limited period, and are viewed only for support and product improvement.

5. Where Your Data Lives

Your data is stored in Google Firebase (Firestore and Firebase Authentication), protected by per-user security rules so only your signed-in account can access your data. The web app is served via Cloudflare. All data is encrypted in transit, and journal entries, coach conversations, and support messages are never visible to other users.

Protection of sensitive data. Sensitive data - including any Google Calendar information you connect - is encrypted in transit (TLS) and at rest, access-controlled by per-user security rules so only your signed-in account can read it, retained only as long as needed to provide the feature, and never used to train artificial-intelligence or machine-learning models. You can revoke access or delete your data at any time from Settings.

6. Data Sharing

We do not sell, trade, or rent your personal information. We share data only:

• with the service providers above (Google, ElevenLabs, PostHog, Cloudflare) as needed to operate Habidu, under their confidentiality and data-protection terms;
• with your explicit consent;
• to comply with applicable law or valid legal process;
• to protect the rights, property, or safety of Habidu or our users.

7. Your Rights (GDPR / CCPA)

Wherever you live, you can:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Export your data in a portable format
• Withdraw consent at any time

To exercise any of these rights, use Settings → Support → Chat with the founder in the app, or email privacy@habidu.com. If you are in the EU/EEA or California, you also have the right to complain to your local data-protection authority.

8. Data Retention & Deletion

We keep your data while your account is active. When you delete your account, we delete your data (tasks, journals, coach conversations, settings, support threads) within 30 days, except where the law requires longer retention.

9. Children's Privacy

Habidu is not intended for individuals under the age of 13, and we do not knowingly collect personal information from children under 13.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or by email. Continued use of Habidu after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

Questions about this policy: privacy@habidu.com, or message us in the app via Settings → Support.