Türkçe · English
Privacy Policy
Last updated: 4 October 2026 · Habit Club (the "App")
This policy explains what data the Habit Club mobile app collects, who it is shared with, how long it is kept, and what rights you have. Data controller: Mehmet Taha Uyar — mehmettahauyarr@gmail.com.
In short: we do not sell your data, we do not use it for advertising, and we do not track you across apps or websites. The AI features send neither your name nor any of your personal data to AI services until you explicitly opt in. You can delete your account and all of your data from inside the app in one step.
1. Data We Collect
- Account information: email address, name, username, profile photo, short bio, optional social links (Instagram, X, TikTok, website).
- Sign-in provider information: if you sign in with Google or Apple, the basic identity details those providers return (name, email).
- Usage data: the tasks and rooms you create, task completion records, points/streak/level/badge data, room messages and interactions (reactions, nudges, tree watering), content you report and users you block, your friend requests and friend list, and chat messages you delete (removed permanently the moment you delete them).
- City (optional): for the City League, the province you choose yourself (province level only — no district or address). Device location (GPS) is never used. You can change or remove it anytime from Profile or Community.
- Images you upload: profile photos and room cover images. These are served over a hard-to-guess but publicly accessible link — anyone who has the link can view them.
- Push token: your device's push notification token, so we can deliver notifications (only if you grant permission).
- Product analytics: operating system and version, app version and build number, in-app events (e.g. task completed, room joined) and session duration. Device name is not collected. When you use the app without an account (as a guest), these events are recorded under a random device identifier generated at install, which is not linked to your identity; if you sign in, this device’s earlier usage is associated with your account. Signing out generates a new random identifier.
- AI-generated content: the daily, weekly and monthly room reports written by the room mascot (stored together with the room statistics for that period) and the voice report files created when a report is played (see section 5).
- Crash reports: stack traces and device/OS information used to fix app errors.
We do not collect device location, contacts, microphone or camera data; the app never requests those permissions. Your photo library is accessed only when you pick a profile or room image, and only for the single image you select. The app contains no advertising and does not use an advertising identifier (IDFA/GAID).
2. Why We Process Data, and on What Legal Basis
- Creating your account and managing your session — performance of a contract.
- Running habit tracking, rooms, leaderboards and gamification — performance of a contract.
- Sending the notifications you chose (reminders, room activity, streak alerts) — your consent (notification permission).
- Protecting the community: profanity/hate-speech filtering, reporting, blocking and spam limits — legitimate interest and legal obligation.
- AI coach and room mascot — your personal data only with your explicit consent (AI opt-in for the AI Coach; a separate “Name me in reports” permission to be named in room reports); without it you are counted only in non-identifying room totals (see section 5).
- Product analytics and crash detection — legitimate interest (improving and securing the service).
Your data is never used for advertising and is never sold to third parties.
How we collect it: all data is collected electronically and by automated means through the mobile app — either from information you enter directly or from records generated as you use the app. The legal basis for each purpose is stated individually above (Article 6 GDPR, Article 5 of Turkey's KVKK).
3. Special Category Data (Health and Belief)
The app's task categories include Health, Fitness and Faith. If you choose these categories, or write such information into your task titles, data concerning your health or religious beliefs is processed. Under Article 9 GDPR and Article 6 KVKK this is special category personal data.
Using these categories is entirely optional. By creating a task in one of them, you give explicit consent to that data being processed and shown in the rooms you belong to.
If you do not want to give that consent, simply do not use those categories — the other nine work with every feature of the app. You can delete any such task at any time, which withdraws your consent. This data is sent to the AI service only if you have separately opted in to the AI feature.
4. Service Providers
The following providers process your data on our behalf, solely to operate the service:
| Provider | Purpose | What it can access | Region |
|---|---|---|---|
| Supabase | Database, authentication, file storage | All account and usage data | EU |
| Expo | Push notification delivery | Push token, notification text | USA |
| Google LLC (Gemini API) | AI coach and room mascot — primary provider | Name, streak, level, points, task titles and completion counts, room statistics (personal data only if you opt in; see section 5) | USA |
| Groq Inc. | AI — fallback, only when Gemini is unavailable | The same data sent to Gemini | USA |
| ElevenLabs | Narrating weekly/monthly room reports | Only the narration script written for the report | USA |
| PostHog | Product analytics | User ID, device/OS/app version, events, session duration | EU |
| Sentry | Crash reporting | Stack traces, device/OS information | EU/USA |
| DiceBear | Ready-made avatar images | Image requests only (no personal data sent) | EU |
International transfers: all of the providers above are located outside Türkiye; your data is processed on servers in the European Union and the United States. These transfers are made only to the extent necessary to provide the service and are limited to the data listed in the table, under Chapter V of the GDPR and Article 9 of Turkey's KVKK. Transfers of your personal data to the AI services (Google LLC, Groq Inc. as a fallback, and ElevenLabs for voice reports — all in the USA) additionally rely on your explicit consent (AI opt-in for the AI Coach; the “Name me in reports” permission for room reports); if you decline, your name and personal details are not transferred to them, and only non-identifying room totals are processed for room reports. You can withdraw your consent at any time in the app.
5. AI Features (AI Coach and Room Mascot)
The app's AI features — the AI Coach (daily, weekly and monthly coach notes, task suggestions, room plans), the room mascot's reports and "Ask the mascot" — are generated by language models. The primary provider is Google LLC (Gemini API, USA); if Gemini is unavailable, the request falls back to Groq Inc. (USA) infrastructure. The audio version of weekly and monthly reports is narrated by ElevenLabs (USA). Only our server connects to these services, and the keys are held server-side.
Sent to the AI Coach: your first name only (never your surname), your day streak, level and total points; your task titles and their categories from the last 7 days (last 30 days for the monthly summary), how many days you did each task, and your completion, point and active-day counts. If you generate a room plan or ask the mascot a question, the goal or question you type is sent too (we do not store question text).
Sent for room mascot reports: the room name, the room's open goals and room totals (member count, active members, completions, points, juz read, counter contributions, waterings). Only for members who have agreed to be named in reports, were active in the last 7 days and are picked for that report (about 5 at most): their first name and, for that period, their completions, points, active days, streak, juz, counter contributions and waterings received.
Not sent: your email address, password, user ID, room messages, photos, or the names or personal details of members who have not opted in.
You are in control: none of your personal data is sent to the AI services until you accept the in-app disclosure screen. Your choice is stored on your device and on our server (because room reports are generated server-side), and you can withdraw it at any time with the Profile → Settings → Privacy → AI Coach switch. Being named in room reports is a separate permission: the app asks you once, “Should [the mascot] mention you by name in reports?”, and your name is not used until you answer. You can change this at any time from the room's mascot card via “My name in reports: On/Off · change”. If you decline, the rest of the app works normally.
Room mascot reports: generated automatically on our server every night at 23:55 (Türkiye time) — a daily note every day, a weekly report on Sundays and a monthly report on the last day of the month. Only members who have explicitly agreed to be named are mentioned by first name; the names and personal details of members who declined or haven't answered yet are never sent, and they are counted only in the room totals. Even if you agreed, you are not named if you haven't been active in the app for the last 7 days. Reports are visible only to that room's members, who are notified of weekly and monthly reports.
Voice reports: weekly and monthly reports are narrated by ElevenLabs when the report is written. Only the narration script written for the report is sent to ElevenLabs; it may include the first names of members who agreed to be named in reports. The resulting mp3 file is stored in a private bucket in our Supabase Storage and is served only to that room's members through a signed link that expires after one hour.
Model training: data sent to these services is not used to train AI models. Google states that content submitted through the paid Gemini API is not used to improve its products or train its models, and may be retained for a limited period solely to detect abuse (see the Gemini API Additional Terms of Service and Google Privacy Policy). Groq states that content submitted through its API is not used to train models (see the Groq privacy policy). For ElevenLabs, see the ElevenLabs privacy policy.
AI output is generated automatically, may be inaccurate, and is for motivation only — it is not medical, psychological, religious or professional advice.
6. Information Shared With Other Users
Your name, username, profile photo, bio, any social links you add, your level, and your activity in rooms you have joined (task completions, streak, tree status) are visible to your room mates. Messages you post in a room chat are visible to every member of that room; you can delete your own messages, and room owners and admins can delete any message in their room.
Friends: people you are friends with can see whether you completed a task today, your room task completions from the last 14 days (with task and room name), badges you earn, public rooms you join, and your province if you set one. Your personal task names are never shown to friends — only their category. You can end a friendship at any time; blocking a user also ends the friendship automatically.
Community and City League: the City League shows only per-province point totals and active member counts. Province rankings and the Community "active today / new members" lists include only users who have not hidden themselves from leaderboards.
In Profile settings you can hide yourself from leaderboards and make your streak private. When you block a user, neither side can message, nudge, invite, or water the other's tree.
7. Retention
- Account and usage data: kept for as long as your account is active.
- When you delete your account: all of your records (profile, tasks, completions, messages, memberships, uploaded images) and the rooms you created are deleted immediately and irreversibly.
- Technical backups: deleted data disappears from routine disaster-recovery backups within 30 days at the latest.
- Reports filed about you: retained for 12 months to prevent repeat abuse, under an identifier that no longer resolves to an account.
- Product analytics: automatically deleted from PostHog after 12 months.
- Crash reports: 90 days.
8. Deleting Your Account
You can permanently delete your account in the app under Profile → Settings → Permanently Delete Account. If you have removed the app or cannot sign in, follow the steps on the account deletion page, which also lists exactly what is deleted and what happens to rooms you created.
9. Your Rights and How to Exercise Them
Under the GDPR and Article 11 of Turkey's KVKK you have the right to:
- learn whether your personal data is being processed and, if so, request information about it,
- learn the purpose of processing and whether the data is used in line with that purpose,
- know the third parties, in Türkiye or abroad, to whom your data has been transferred,
- have incomplete or inaccurate data corrected,
- request erasure or destruction of your data,
- request that corrections and erasures be notified to the third parties your data was transferred to,
- object to a decision produced solely by automated analysis that has an adverse effect on you,
- claim compensation for damage caused by unlawful processing,
- restrict or object to processing, and receive your data in a structured, portable format (GDPR).
A copy of your data (data portability): in the app, Profile → Settings → Privacy → Download my data instantly gives you a copy of everything we store about you as a structured, machine-readable JSON file (your right of access under Article 11 KVKK and to data portability under Article 20 GDPR). The file does not include other users' private data (such as the content of private messages sent to you or reports filed about you) or security secrets (push tokens, room invite codes).
How to apply: send your request from the email address registered to your account to mehmettahauyarr@gmail.com, stating your name, the nature of your request, and any supporting information. We respond within 30 days at the latest and, as a rule, free of charge.
If your request is refused, our reply is inadequate, or we do not respond in time, you may complain to your local data protection authority. In Türkiye you may complain to the Personal Data Protection Board within 30 days of learning of our reply and in any case within 60 days of your original application.
10. Security
All data is transmitted over TLS and stored encrypted at rest. Database access is restricted by row-level security rules: a user can only read records belonging to them or to rooms they are a member of. Keys for the AI and notification services are held server-side only.
11. Children's Privacy
The app is not directed at children under 13 and we do not knowingly collect data from anyone under 13. If we learn that we have collected data from a child under 13, we will delete the account and its data.
12. Changes
Material changes to this policy will be announced in the app or on this page; the "last updated" date at the top is refreshed with every change.
13. Contact
Questions and data requests: mehmettahauyarr@gmail.com