Privacy Policy — HabitPal | Habit Tracker & Pod Sync

Section 1

Introduction & Our Privacy Principles

Welcome to HabitPal ("the App"), an accountability and habit-building mobile application created and operated by Cyborgate ("we," "us," or "our"). HabitPal helps individuals and accountability pairs track habits, celebrate daily streaks, maintain shared pod health, and gain actionable habit insights.

We believe that your personal routines, daily habits, wellness entries, and progress logs belong exclusively to you. We operate under three non-negotiable principles:

On-Device Architecture First: Your personal logs, completion checkmarks, and daily tallies are stored locally on your physical device by default.
Absolute Commercial Transparency: We never sell, rent, monetize, or broker your personal information or habit data to third-party data brokers or advertising networks.
Strict Data Minimization: We collect only the absolute minimum data required to deliver real-time partner pod synchronization and intelligent AI coaching.

This Privacy Policy explains how data is handled across our on-device storage, secure Firebase sync infrastructure, and Google Gemini AI features, in full compliance with the Apple App Store Review Guidelines (Section 5.1 — Privacy), UK Data Protection Act 2018 / UK GDPR, EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA/CPRA).

Section 2

Google Gemini AI Integration & Data Transparency Declaration

HabitPal includes an optional AI Habit Assistant and dynamic partner banter ("Taunts") powered by Google's generative AI technology (Google Gemini models via our authenticated, high-availability proxy gateway). We maintain strict transparency regarding how AI interacts with your data:

Core Gemini AI Declaration:
• No Foundation Model Training: Your prompts, queries, and habit statistics are never used to train, retrain, or improve Google's base foundation models.
• Stateless Processing: AI requests are processed ephemerally in transit without persistent server-side caching of conversation history.
• Strict Context Sanitization: Only minimal habit metrics (e.g. "30 min workout logged") and your chosen nickname are provided as context. No real names, emails, financial records, or device IDs are ever sent to Gemini.

2.1 How Gemini AI is Used in HabitPal

Conversational Habit Coaching: When you open the AI Assistant Chat to ask for advice (e.g., "How do I build a consistent morning hydration habit?"), your inquiry and recent habit completion tallies are processed to generate contextual guidance.
Partner Accountability Banter ("Taunts"): In shared pods where both partners have enabled the feature, the system analyzes completion disparities (e.g., Partner A logged a workout while Partner B has not yet) to draft lighthearted, motivating nudges.
Motivational Habit Summaries: Generates personalized weekly progress reflections and celebration milestones.

2.2 User Control Over AI Features

You maintain complete autonomy over AI interactions. Inside the HabitPal App Settings, you can:

Toggle AI Coaching and Taunts off completely at any time.
Clear your local AI conversation history with a single tap.
Operate in Solo Mode, which disables all partner disparity analysis.

Section 3

Data Collection & Transparency Table

The table below outlines every category of data HabitPal may collect, how it is collected, the legal basis, and where it is stored:

Data Category	Specific Data Elements	Storage Location	Purpose & Retention
Habit Logs & Progress	Habit IDs (water, steps, reading, custom habits), completion timestamps, numerical quantities, streak counts.	On-device (AsyncStorage); synced to Firebase RTDB if in a shared pod.	Essential core service functionality; retained on device until deleted or app uninstalled.
Account & Auth	Apple Sign-In user identifier (relay email/sub), Google Sign-In UID, email address (if provided).	Firebase Authentication (encrypted).	Secure authentication and restoring pod membership across device re-installs.
Pod Identity	Chosen display nickname, avatar initials, signature progress ring color.	Local storage & Firebase RTDB.	Displaying pod partner status and personalizing progress rings.
In-App Purchases	Subscription status (Pro / Family Yearly), original transaction ID, expiration timestamp.	Apple StoreKit (managed by Apple); validated via local receipt/store token.	Unlocking premium features; Cyborgate never receives or stores your credit card numbers.
AI Prompts	User-submitted chat questions and sanitized habit context.	Processed ephemerally via Google Gemini; stored locally on device.	Interactive habit coaching and milestone reflections. User can clear at any time.
Widget Data	Latest daily checkmark states and active streak numbers.	Apple App Group Shared Container (local to your iOS device).	Displaying real-time progress on your iOS Home Screen and Lock Screen widgets.

Zero Tracking Guarantee: HabitPal does not use the Apple Advertising Identifier (IDFA). We do not embed third-party analytics trackers, behavioral advertising SDKs, or data harvesting libraries.

Section 4

Third-Party Services & Sub-Processors

HabitPal partners with industry-leading infrastructure providers to deliver secure cloud synchronization and subscription verification:

Apple Inc. (Apple StoreKit & Sign in with Apple): Manages App Store distribution, subscription billing, and privacy-preserving Apple authentication. Apple's privacy policy applies to transactions: apple.com/legal/privacy.
Google Firebase (Google Cloud Platform): Provides encrypted Realtime Database (RTDB) infrastructure for pod pairing and real-time streak syncing. Data is encrypted in transit (TLS 1.3) and at rest (AES-256).
Google Gemini API: Ephemeral generative AI processing for habit coaching without model training on your inputs.

Section 5

Your Rights: Access, Export & Instant Deletion

Under GDPR, UK DPA 2018, CCPA/CPRA, and Apple Guidelines, you hold comprehensive rights over your personal data:

Right to Access & Portability: You can view all your logged habits, history, and weekly recaps directly in the App at any time.
Right to Rectification: You can edit or undo any habit log immediately from the Habit Details screen.
Right to Immediate Erasure ("Delete Account & Data"): We provide a direct, automated in-app deletion button in Settings → Delete Account & Data. Tapping this button permanently purges your user profile, cloud pod associations, Firebase records, and local storage immediately.
Right to Leave Pod: You can unlink from a partner pod at any time, instantly severing data sharing.

Section 6

Children's Privacy (COPPA & GDPR)

HabitPal is intended for general audiences aged 13 and older (or 16 and older in jurisdictions subject to GDPR). We do not knowingly solicit or collect personal data from children under 13. If we discover that personal data of a child under 13 has been collected without verifiable parental consent, we will take immediate steps to permanently delete the data. If you believe a child has provided data to us, please contact us at support@cyborgate.com.

Section 7

Data Security Safeguards

We implement administrative, technical, and physical safeguards engineered to protect your information:

All network transmissions use Transport Layer Security (TLS 1.3 / HTTPS).
Firebase security rules enforce that only verified authenticated pod members can read or write their shared pod documents.
Local application storage is protected by iOS sandbox security and hardware-level encryption (Data Protection API).

Section 8

Changes & Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect evolving app features or regulatory changes. Any updates will be posted on this page with an updated "Last Updated" date. Material changes will be communicated via in-app notification before they take effect.

Section 9

Contact Us & Data Protection Inquiries

If you have questions, feedback, or privacy-related requests regarding this Privacy Policy, please contact our privacy compliance team:

Cyborgate — Privacy & Data Governance
Email: support@cyborgate.com
UK Office: contact@cyborgate.uk
Web: https://www.cyborgate.com · https://cyborgate.uk