Habitly is a personal habit tracking application created and operated by Matej Kuhelj, an individual developer based in Ljubljana, Slovenia, European Union. This app is a personal project, not a registered company product.
If you have any questions about this policy, contact: habitly.eu@gmail.com
Our Terms of Use are at habitly.eu/terms (served from api.habitly.eu/terms).
When you create an account and use the app, we collect:
Account information
Habit data
Journal data
Profile data
Device and preferences
Onboarding answers
Usage data
Things you send us
We do not collect your real name, phone number, location, or any payment information.
We use your data only to:
The weekly summary and poke emails are only sent to a confirmed address. You can turn them off at any time in Settings → Notifications, or with the Unsubscribe link at the bottom of each of those emails. Password reset and welcome emails are sent only when you trigger them.
We do not use your data for advertising, analytics platforms, session recording, A/B testing, or any form of profiling.
We use the following third-party services to operate the app:
Railway (railway.app) — hosts our backend server and database. Your account data, habit logs, highlights, and mood scores are stored on Railway's infrastructure. Railway is based in the United States. Railway's privacy policy
Cloudinary (cloudinary.com) — stores photos you upload (daily photos and profile photos). Cloudinary is based in the United States. Cloudinary's privacy policy
Resend (resend.com) — delivers the emails described above. Resend receives your email address and the content of each message. Resend is based in the United States. Resend's privacy policy
Netlify (netlify.com) — serves the app's web pages. Netlify sees your IP address when you load the app, as any web host does. Netlify's privacy policy
Railway and Netlify keep short-lived technical logs (IP address, requested page, time) to run and secure the service. We do not use those logs to profile anyone.
Fonts and scripts are served from our own domain, not from Google or other third-party CDNs, so loading the app does not send your IP address to any provider beyond those listed here.
These providers are used solely to operate the app. We have not sold, rented, or shared your data with any other third party and have no intention of doing so.
If you add someone as a friend and they accept:
They cannot see:
You can remove a friend at any time. From that moment they no longer see your data in the app. A photo link they already opened may keep working in their browser until you delete that photo.
Blocking. You can block a user (friend profile → Block, or Settings → Blocked users). A block removes the friendship and hides you from each other everywhere in the app — search, feed, leaderboards, challenges and notifications. The blocked person is not told. If you joined the same public challenge, their row is hidden from your board and yours from theirs; ranks are not renumbered.
We keep your data for as long as your account exists. If you delete your account, all of your data is permanently deleted within 24 hours — including your habits, logs, photos (from Cloudinary), highlights, mood scores, friend connections, blocks and feedback messages. Reports you filed are kept without your text, as an anonymised moderation record.
Backups. Railway keeps automatic database snapshots on its infrastructure. We occasionally make a manual backup copy, which is stored encrypted and deleted after at most 30 days. Deleted accounts can still exist in a backup for that period and are never restored from one.
Habitly sets one cookie, `hbt_token`, which keeps you signed in. It is strictly necessary, marked HttpOnly and Secure, and expires after 30 days or when you log out. There are no advertising, analytics or tracking cookies, so there is no cookie banner.
The app also uses your browser's local storage for your username and display name (so the app can greet you before it loads), the choices you make in the app (for example whether you have seen a tip, your last "share with friends" choice), and, in the iOS app only, your sign-in token. This data stays on your device and is removed when you log out or clear site data.
As a user in the European Union, you have the following rights:
Right of access — you can request a copy of all data we hold about you.
Right to erasure — you can delete your account at any time from Settings → Delete account. This permanently removes all your data.
Right to rectification — you can update your display name, email and profile photo at any time in Settings. A changed email address must be confirmed again before summaries and poke emails resume.
Right to data portability — you can export your data at any time from Settings → Export (memory book, photo archive or raw data).
Right to object — you can contact us at any time to object to how we process your data.
To exercise any of these rights, contact: habitly.eu@gmail.com. You also have the right to lodge a complaint with the Slovenian Information Commissioner (ip-rs.si).
We take reasonable steps to protect your data:
No system is 100% secure. If you discover a security issue, please report it to habitly.eu@gmail.com and we will address it promptly.
Under Slovenian law (ZVOP-2) you must be at least 15 years old to consent to an online service on your own. You confirm this when you create an account. We do not knowingly collect data from anyone younger. If you believe someone under 15 has created an account, please contact us and we will delete it.
If we make significant changes to this policy, we will notify users via a banner in the app. Continued use of the app after changes constitutes acceptance of the updated policy.
For any privacy-related questions or requests:
Habitly · Ljubljana, Slovenia habitly.eu@gmail.com