Privacy policy
Draft: to be checked before launch. Fill in the placeholders in [BRACKETS].
Last updated: [DATE]
In short
Everything you enter in Tabiat (habits, tasks, entries, notes) is stored on your phone. It only leaves your phone if you choose to sign in to Sync & Backup, or if you export a backup file yourself. There is no advertising, no tracking and no analytics.
Who is responsible
Chin Yee Karwehl Teo, Von-Campe-Ring 50, 38550 Isenbüttel, Germany. Email: support@cykt.de.
Data on your phone
Your habits, tasks, entries and settings are stored only in the app on your device. We have no access to them. Reminders, widgets and the watch apps work on your devices and do not send this data to us. Deleting the app deletes the data, apart from any backup file you exported.
Sync & Backup (Premium, optional)
If you sign in to sync, we process your email address and a copy of the data you enter in the app, so that it can be kept the same on all your devices. This can include information about your health, for example a habit you are quitting. We process it only to provide sync and backup, on the basis of your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR) and our contract with you (Art. 6(1)(b) GDPR).
- Supabase (Supabase Inc., USA) stores the synced data on servers in Frankfurt, Germany.
- Resend (Resend Inc., USA) sends the sign-in code to your email address, from servers in Ireland (EU).
The data is kept until you delete your account. You can do that in the app under Settings → Sync & Backup → Delete account, or by writing to us; see Delete your account. Signing out keeps your data on the phone and stops syncing.
Purchases
Subscriptions are bought and paid through the App Store (Apple) or Google Play (Google). We never see your payment details. To know whether you have Premium, the app uses RevenueCat (RevenueCat Inc., USA), which receives a random ID created by the app and the purchase information from the store. If you use Sync & Backup, that ID is linked to your sync account so Premium follows you to your other devices. Legal basis: our contract with you (Art. 6(1)(b) GDPR).
Crash reports and bug reports
When the app crashes or something goes wrong, it sends a technical report to Sentry (Functional Software Inc., USA), stored in the EU. The report contains the app version, device model, operating system and the screens and buttons used shortly before the error. It does not contain your IP address, your name or anything you wrote in the app. If you send a bug report from Settings, it also contains your message and, only if you enter it, your email address. Legal basis: our legitimate interest in a working app (Art. 6(1)(f) GDPR).
App updates
When the app starts, it asks the servers of Expo (650 Industries Inc., USA) whether a small update is available. This request contains your IP address, the app version, the operating system and a random ID used to tell whether an update has been downloaded, but no data you entered. Expo is certified under the EU–US Data Privacy Framework. Legal basis: our legitimate interest in delivering fixes quickly (Art. 6(1)(f) GDPR).
If you write to us, we use your email address and message only to answer you, and delete them when they are no longer needed.
This website
The website is served by Cloudflare (Cloudflare Inc., USA). To deliver it, Cloudflare processes your IP address and technical details of your browser in server logs. The website sets no cookies, uses no analytics and loads its fonts from our own server. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
Transfers outside the EU
Some of the companies above are based in the USA. Where data is transferred there, the transfer is based on the EU–US Data Privacy Framework or on the EU standard contractual clauses. [CHECK: each provider's certification and data processing agreement.]
Your rights
You have the right to access, correct and delete your data, to restrict or object to its processing, and to receive it in a portable format. You can withdraw your consent at any time, for example by deleting your sync account; this does not affect processing that happened before. You also have the right to lodge a complaint with a data protection supervisory authority.