App Privacy Policy

DCZT built HabitKeep for the App Store. DCZT is the trade name under which I, an individual developer in the Czech Republic, publish my apps. HabitKeep is free to download and may offer optional paid upgrades.

This page is used to inform visitors regarding my policies with the collection, use, and disclosure of Personal Information if anyone decides to use my Service.

The Personal Information that I collect is used for providing and improving the Service, as described below. I will not use or share your information with anyone except as described in this Privacy Policy.

The terms used in this Privacy Policy have the same meanings as in the Terms of Use, unless otherwise defined in this Privacy Policy.

Who is responsible for your data

The controller of your personal data under the EU General Data Protection Regulation (GDPR) is DCZT, an individual developer in the Czech Republic, support@dczt.dev. I am not required to appoint a data protection officer; for anything about your data, write to me at that address.

Information Collection and Use

HabitKeep does not ask you to create an account. Apart from the usage statistics described under "Analytics", I do not store personal data about you on servers. What you create in the app stays on your device or in your own iCloud account (see "Data stored on your device" below).

The app uses the third-party services listed below, among other things to show advertising. Each one receives only what it needs for the purpose shown next to it, and each has its own privacy policy, linked here, which describes exactly what it collects and how you can exercise your rights with it:

• Apple App Store - App platform
• Apple iCloud (CloudKit) - Sync through your private iCloud database
• Google AdMob - Advertising
• Google User Messaging Platform - Consent for ads and analytics
• Firebase Analytics (Google) - Analytics in versions before 1.1

Advertising

The free version of HabitKeep is paid for by ads. Ads are provided by third-party advertising partners. The advertising partners that may serve ads in the app are Google AdMob.

To show and measure ads, these partners receive information about your device: the advertising identifier of your device (Google Advertising ID on Android, IDFA on iOS - where you have allowed it), your IP address (from which they derive an approximate location such as your country or city), device model, operating system and language, and information about the ads shown and how you interacted with them. They may use this to show you ads that are more relevant to you and to measure the performance of their campaigns, including across other apps and websites. They decide themselves how they use this data, as independent controllers under their own privacy policies.

Your choices. In the European Economic Area, the United Kingdom and Switzerland the app asks for your consent before personalized ads are shown, and you can change that choice at any time from the app's settings ("Change Ads Consent"). If you decline, you still see ads, but they are not personalized. On iOS the app asks for permission to track through Apple's App Tracking Transparency prompt; if you decline, your advertising identifier is not shared. On any device you can reset or delete your advertising identifier, or opt out of personalized ads, in the system settings (Android: Settings > Google > Ads; iOS: Settings > Privacy & Security > Tracking, and Apple Advertising). Buying the ad-free upgrade removes the ads entirely, apart from rewarded videos you choose to watch.

Analytics

HabitKeep sends usage statistics to AnalyticsInsights, an analytics service I run myself on servers I rent from Hetzner Online GmbH in Germany and Finland (EU). Hetzner hosts the server and its backups for me and does not use the data for anything else; no other company receives it. The statistics are: a random identifier created when the app is first opened (it is not your advertising identifier and is not linked to your name, email address or any account); your device model, operating system version, app version, language and time zone; your country, looked up from your IP address, which is then discarded and never stored; when you open and close the app and for how long; which features you use and how they turn out (for example creating, completing, skipping, pausing or archiving habits, with their kind, schedule and streak length; tasks, timers, rewards, statistics, widgets and Shortcuts; and the mood rating, as a number, when you log your mood), which kind of Apple Health data you connect a habit to, how you move through the welcome and subscription screens and the answers you choose there, the settings you change, and your answers to the notification, tracking and ad-consent prompts; in-app purchases (the product, its price and currency, whether it started a free trial, and the store's transaction number - never payment details); ads shown and their estimated revenue; and error reports, including the crash reports described below. Everything is encrypted in transit. I use this only to understand how the app is used, to fix errors and to improve it; I do not use it to show you ads, and I do not sell it.

If the app crashes, stops responding (an "ANR" on Android) or freezes (a "hang" on iOS), or Android closes it because your device ran low on memory, the app sends a report about it to AnalyticsInsights, usually the next time you open it. A report says what kind of problem it was and when it happened, and contains the error message and the technical stack trace (the parts of the app's code that were running; for an ANR, those of all the app's threads), together with the device and app details listed above. Email addresses, user names in file paths and app folder identifiers are removed from error messages and reports when they arrive.

In the European Economic Area, the United Kingdom and Switzerland, the identifier is kept on your device only if you agree in the consent form the app shows. If you do not, the app still sends statistics and crash reports but stores no identifier, so each time you use it is counted on its own and cannot be linked to the next. The legal basis is your consent for the identifier, and my legitimate interest in keeping the app working and improving it for statistics without an identifier and for error and crash reports. The identifier is removed from stored statistics after 36 months; the statistics themselves are kept without it.

To help me read these statistics I may use an AI assistant (Claude, by Anthropic), which acts as my service provider. It works with the statistics described above, mostly as totals.

Analytics never receives anything you type - not the names or notes of your habits, tasks, lists, categories or rewards, or your name - and never any Apple Health values. The Apple Watch app sends its statistics without an identifier. Versions of HabitKeep before 1.1 send their usage statistics to Firebase Analytics (Google) instead of AnalyticsInsights (see the list above): a device identifier, your device model, operating system and language, your approximate country, how you use the app and purchases. It is set up not to collect your device's advertising identifier (IDFA). Updating the app ends this.

Purchases

In-app purchases and subscriptions are processed by Apple through the App Store. I never see or store your payment details; the app only keeps a record on your device of which purchases are active, so that it can unlock what you paid for.

Data stored on your device

Everything you create in the app - your habits and their history, tasks, notes, rewards, mood entries and settings - is stored on your device, and in your own iCloud as described below, and is not uploaded to me. If you choose to share something from the app, it is handed to the app you pick through your device's share function and leaves your device only then. Deleting the app deletes the copy on your device, and I cannot restore it.

If iCloud sync is on (it is by default, and you can turn it off in the app's settings), your habits and their history are also kept in your private iCloud database so that they reach your other devices, including Apple Watch. That database belongs to your Apple Account: Apple stores it, and I cannot see or access it.

Apple Health (HealthKit)

If you connect a habit to Apple Health, the app asks for permission to read the Health data types you choose - for example steps, exercise or mindful minutes, sleep, water or nutrition. It only reads; it never writes to Apple Health.

Health data is used only to fill in your progress on the habits you connected to it. The amounts it reads are saved with your habit history on your device and, if iCloud sync is on, in your private iCloud database. Health data is never sent to me, to AdMob or to any other third party, and it is never used for advertising, marketing or data mining. The only related thing analytics records is that you connected a type of Health data (for example "steps"), never any of its values.

You can stop the app reading Health data at any time in Settings > Health > Data Access & Devices.

Calendar

If you allow calendar access, the app adds your habit reminders to a separate "HabitKeep" calendar it creates, and reads the events in your other calendars (their title, time, all-day setting and colour) only to show them next to your tasks in the app. Calendar data is processed on your device and is never sent to me or to any third party. You can revoke access at any time in Settings > Privacy & Security > Calendars.

Widgets, Live Activities and Siri

Widgets on your Home Screen, Lock Screen and Apple Watch, habit timers shown as Live Activities, Spotlight search results and Siri and Shortcuts actions are all produced by your device from the data on it. Nothing is sent to me to do this.

Notifications

With your permission, the app schedules local notifications on your device to remind you of your habits and tasks, to check in on your day and to tell you about habits you missed. They are created and delivered by your device itself, no data is sent to me to do this, and you can turn them off at any time in your device's notification settings.

Log Data

When something goes wrong in the app, it sends the error and crash reports described under "Analytics" to AnalyticsInsights, my own analytics server. They contain the device and app details listed there, but never your IP address. If you have allowed your device to share analytics with app developers, Apple may also share anonymous crash reports and usage statistics with me; you can change this in your device's privacy settings.

Cookies

Cookies are files with a small amount of data that are commonly used as anonymous unique identifiers. The app itself does not use cookies. Some of the third-party services listed above, such as the advertising partners, may use cookies or similar technologies (for example identifiers stored on your device) to provide and measure their services, as described in their privacy policies and subject to the choices described in this policy.

Service Providers

Some companies process personal data on my behalf, as my service providers (processors), and may use it only to provide their service to me: Hetzner Online GmbH, which hosts my own servers in the EU; Anthropic, whose AI assistant I may use to read the statistics; and Vercel, which hosts this website. Others - such as Apple and Google as the operators of the stores, and the advertising partners listed above - decide themselves how they use the data they receive, as independent controllers under their own privacy policies.

Legal bases

Under the GDPR, I rely on these legal bases:

• Performance of a contract (Article 6(1)(b) GDPR): to provide the features you use, to unlock and restore your purchases, and to answer you when you contact me.
• Consent (Article 6(1)(a) GDPR): for personalised ads and, on iOS, tracking through App Tracking Transparency, and for keeping an analytics identifier on your device in the European Economic Area, the United Kingdom and Switzerland. You can withdraw your consent at any time as described above, without affecting what was done before you withdrew it.
• Legitimate interests (Article 6(1)(f) GDPR): to keep the app and my servers secure and working, to prevent abuse, to fix errors, to understand how the app is used, to show non-personalised ads that pay for the free version, and to run this website. You can object to this processing at any time (see "Your Rights").
• Legal obligations (Article 6(1)(c) GDPR): where I must keep or disclose information by law, for example for accounting or in response to a lawful request from an authority.

Permissions you give on your device, such as access to the camera, photos, microphone or notifications, are your choice. The features that need them work only while you allow them, and you can withdraw them at any time in your device's settings.

How long data is kept

• Data in the app stays on your device until you delete it or delete the app; data in your own iCloud stays there until you delete it.
• Usage statistics and error reports: the random identifier is removed after 36 months, and the statistics without it are kept for as long as they help me improve the apps.
• Data held by the third-party services listed above is kept according to their own privacy policies.
• Emails you send me are kept for as long as I need them to deal with your request and any follow-up, and are then deleted. Bug reports and feature requests sent with the form on dczt.dev are deleted after 24 months, and newsletter addresses are kept until you unsubscribe.

International transfers

My own servers are in the EU, at Hetzner in Germany and Finland. Some of the services described in this policy are based outside the European Economic Area, mainly in the United States - for example the advertising partners, which may also process data in other countries; and Vercel, which hosts this website. Where personal data is transferred outside the European Economic Area, the transfer relies on an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework, for companies certified under it) or on the European Commission's standard contractual clauses, as described in each company's own privacy policy. You can ask me for more information about these safeguards.

Security

I value your trust in providing me your Personal Information, thus I am striving to use commercially acceptable means of protecting it. All data the app sends to the services above is encrypted in transit. But remember that no method of transmission over the internet, or method of electronic storage is 100% secure and reliable, and I cannot guarantee its absolute security.

Responsible Disclosure Policy

We take the security of our systems and data seriously. If you believe you have discovered a vulnerability, please follow these guidelines:

1. Do not exploit the vulnerability beyond what is necessary to confirm its existence.
2. Do not access, modify, or delete data that does not belong to you.
3. Report the issue to the website owner with details so we can reproduce the finding.
4. We will acknowledge receipt and work to address the issue as quickly as possible.
5. Testing is only authorized within the scope of this policy. Any testing outside of scope may be considered unauthorized and could be subject to legal action.
6. To the extent permitted by law, we are not responsible for any damage, loss, or impact to your devices, systems, or data at any time, whether or not it is related to security testing.

Links to Other Sites

This Service may contain links to other sites. If you click on a third-party link, you will be directed to that site. Note that these external sites are not operated by me. Therefore, I strongly advise you to review the Privacy Policy of these websites. I have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

This website

The website this policy is published on is hosted by Vercel, which processes standard server logs (such as your IP address, browser and the page requested) to deliver and protect the site. I count visits with AnalyticsInsights, an analytics tool I run myself on my own server at Hetzner in Germany. It does not use cookies or store anything in your browser, follow you across other websites or store your IP address. Your IP address is used only for a moment: to look up your country, and, together with your browser's identification and a random value that is replaced every day, to count you as one visitor for that day, so visits on different days cannot be linked and your IP address cannot be recovered. It records the page visited, the referring site, your browser, operating system, device type and country, clicks on links and buttons (such as the store buttons, links to other pages and the FAQ), how long a page stays open, how far down it is scrolled and how quickly it loads. To help me read these statistics I may use an AI assistant (Claude, by Anthropic), which acts as my service provider.

If you send a bug report or feature request with the form on dczt.dev, your message, the app, platform and reason you choose, and your email address if you give one are sent to AnalyticsInsights on the same server, with the page you sent it from and your browser, operating system, device type, language and country (looked up from your IP address, which is not stored). I use them only to look into what you wrote and, if you left your email address, to reply. They are deleted after 24 months, or sooner if you ask me.

If you sign up for the newsletter, the only thing I ask for is your email address. It is sent to and stored by Brevo, the service I use to send the newsletter, and is used for nothing else. Every email has an unsubscribe link, and you can unsubscribe at any time.

Children's Privacy

These Services do not address anyone under the age of 13. I do not knowingly collect personal information from children under 13, and the apps never ask for an email address or other contact details. In the European Economic Area, a user below the age at which their country allows them to give consent online themselves (between 13 and 16, for example 15 in Czechia and 16 in Germany) needs a parent or guardian to give or approve the consents described in this policy, such as for personalised ads and the analytics identifier. If you are a parent or guardian and believe that your child has provided personal information, or that one of the services listed above has collected it, please contact me at support@dczt.dev so that I can have it deleted.

Your Rights and Data Deletion

Under the GDPR, and depending on where you live, you have the right to access the personal data held about you and get a copy of it, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, to object to processing based on legitimate interests, and to withdraw your consent at any time without affecting what was done before. I do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you. I answer requests within one month.

HabitKeep has no accounts. The only data about you on my server is the usage statistics described under "Analytics", stored under a random identifier that only the app knows, so I cannot find them from your name or email address. Deleting the app deletes that identifier from your device, and a new installation starts a new one. The data the app keeps on your device is deleted when you delete the app. Anything kept in your own iCloud account stays there until you delete it, which you can do in your device's iCloud settings. Resetting your advertising identifier in your device settings breaks the link between your device and any advertising profile.

For data held by the third-party services listed above, you can make a request to each of them directly through the privacy policy linked next to its name. You can also email me at support@dczt.dev with your request: I will pass it on to the services concerned and confirm when it is done.

To have your email address removed from the newsletter, use the unsubscribe link in any email or write to me. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work or where you think your rights were infringed. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz).

Changes to This Privacy Policy

I may update this Privacy Policy from time to time, for example when an app gains a feature or starts using a new service, so please review this page periodically. The date below shows the current version. If a change significantly affects how your data is used, I will tell you in the app or on this page before it applies and, where the law requires it, ask for your consent again.

This policy is effective as of 2026-11-13

Contact Us

If you have any questions or suggestions about my Privacy Policy, do not hesitate to contact me at support@dczt.dev.