Protecting your privacy is an important part of HabitHeat.
HabitHeat is a habit tracking web app designed to help you track habits, journal your progress, and understand your long-term patterns. We process personal data only where necessary to provide, secure, maintain, and improve the app.
HabitHeat does not use advertising or marketing trackers. We do not sell personal data and do not use your data for advertising or cross-site tracking.
1. Data Controller
The controller responsible for data processing in HabitHeat is:
Philip Knüppelholtz
Klaus-Groth-Straße 28
23769 Fehmarn
Germany
Email: support@habitheat.com
2. Account and Authentication Data
To use HabitHeat, you can create an account using an email address and password or sign in with your Google account.
Depending on the authentication method and information you provide, we process:
- email address
- authentication identifiers
- optional display name
- account creation date
- account and supporter status
This information is required to create and manage your account, authenticate you, and provide access to HabitHeat.
Legal basis: Article 6(1)(b) GDPR (performance of a contract).
3. Google Sign-In
If you choose to sign in with Google, Google processes information necessary to authenticate your Google account and provides HabitHeat with the information required for authentication, such as your email address and authentication identifier.
Using Google Sign-In is optional. You can alternatively create a HabitHeat account using an email address and password.
Google’s own processing of your information is subject to Google’s privacy terms.
Legal basis: Article 6(1)(b) GDPR, as the processing is initiated by you in order to authenticate your HabitHeat account using the selected sign-in method.
4. Habit and Journal Data
When you use HabitHeat, we store the information you create in order to provide the habit tracking functionality of the app.
This may include:
- habit names and descriptions
- habit types and configuration
- habit entries and timestamps
- numeric or option-based tracking values
- journal entries and notes
- habit settings and preferences
- other information you voluntarily enter into your habits or journal
This data is associated with your HabitHeat account so that it can be stored, synchronized, displayed, and analyzed for you across sessions and devices.
Legal basis: Article 6(1)(b) GDPR (performance of a contract).
4.1 Information You Enter Yourself
Habit names, descriptions, journal entries, and other free-text fields are controlled by you. Please be aware that you may choose to enter information that is sensitive or personal in nature.
HabitHeat does not require you to provide health information, religious information, political opinions, or other special categories of personal data in order to use the service.
If you voluntarily enter such information into free-text fields or habit data, it is processed only in order to store and provide the content and functionality you requested.
5. Habit Analytics
HabitHeat provides analytics about your own habit data, such as activity over time, completion patterns, active periods, streaks, and other statistics derived from your habit entries.
These analytics are part of the core HabitHeat functionality and are calculated from data associated with your account. They are not advertising or cross-site analytics.
Legal basis: Article 6(1)(b) GDPR (performance of a contract).
6. Product Usage Events
HabitHeat records a limited number of internal product events in order to understand how core features are used and to improve the app.
These events may include interactions such as:
- creating a habit
- using a habit template
- interacting with selected app features
- account or supporter-related actions
Depending on the purpose of the event, this information may be stored in pseudonymous or aggregated form, or may be associated with an account where this is necessary to understand or provide the relevant functionality.
These events are not used for advertising, cross-site tracking, or the creation of advertising profiles and are not shared with external analytics providers.
Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is understanding the use of HabitHeat, identifying problems, and improving the product and its functionality.
7. Feedback
HabitHeat provides functionality that allows users to submit feedback from within the app.
Feedback submitted directly through the app is stored in our application database. Depending on the feedback functionality, the submission may be associated with technical or account information required to process and understand the feedback.
HabitHeat may also provide links to feedback or contact forms hosted on the HabitHeat website. If you use those forms, the privacy policy of the HabitHeat website applies to that submission.
Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is receiving feedback, identifying problems, and improving HabitHeat.
8. Firebase and Google Cloud
HabitHeat uses Firebase and Google Cloud services provided by Google for parts of its application infrastructure.
These services are used for:
- user authentication through Firebase Authentication
- application data storage through Cloud Firestore
- server-side application logic through Cloud Functions for Firebase
- temporary storage of requested data exports through Firebase Storage
Where configurable for the services used, HabitHeat uses European infrastructure regions.
Google may process certain technical or account-related information as part of providing these services. Depending on the specific service and processing operation, data processing or transfers outside the European Economic Area, including to the United States, cannot be completely excluded.
Where applicable, Google acts as a processor under the relevant Google Cloud and Firebase data processing terms and appropriate safeguards for international data transfers apply.
More information:
Legal basis: Article 6(1)(b) GDPR where the services are necessary to provide HabitHeat and Article 6(1)(f) GDPR where processing is necessary for the secure and reliable operation of the service.
9. Data Export
You can request an export of your core HabitHeat data.
Supporter accounts can generate an export directly from the account page. Users without this functionality can request an export by contacting support@habitheat.com.
The export may include:
- account information
- habits
- habit entries
- other exportable HabitHeat account data where applicable
Generated export files are temporarily stored using Firebase Storage. Export files are retained for up to 24 hours and are then automatically deleted.
Legal basis: Article 6(1)(b) GDPR and, where applicable, Article 20 GDPR (right to data portability).
10. Supporter Subscriptions and Stripe
HabitHeat offers an optional supporter subscription. Payments and subscription management are provided using Stripe.
If you become a supporter, HabitHeat may store information necessary to associate and manage the subscription with your account, including:
- Stripe customer ID
- Stripe subscription ID
- subscription status
- subscription start and end dates
- cancellation status
- other limited billing-related metadata required to manage supporter access
HabitHeat does not store your full payment card or bank account details.
Checkout, payment processing, coupon handling, and the customer billing portal are provided by Stripe.
Stripe may process information such as:
- email address
- payment information
- billing information
- transaction and subscription information
- information required for fraud prevention and regulatory compliance
Stripe may act as an independent controller for certain processing activities, particularly where processing is required for payment processing, fraud prevention, compliance, and financial recordkeeping.
More information:
Legal basis: Article 6(1)(b) GDPR for processing necessary to provide and manage the supporter subscription and, where applicable, Article 6(1)(f) GDPR for secure and reliable payment processing and fraud prevention.
11. Email Communication
HabitHeat does not send marketing emails or newsletters.
Account-related emails, such as email verification and password reset messages, may be sent as part of Firebase Authentication.
If you contact us directly by email, the information contained in your message is processed in order to respond to your request.
Legal basis: Depending on the nature of the communication, Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.
12. Hosting
The HabitHeat web application frontend and backend are hosted on servers provided by:
Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany
The servers used by HabitHeat are located in Germany.
When accessing HabitHeat, technical information is necessarily transmitted to the server. Depending on the server configuration, this may include:
- IP address
- date and time of access
- requested URL or resource
- HTTP status information
- browser and user agent information
- operating system information
This information may be processed where necessary to deliver the application, maintain technical stability, detect errors, and protect HabitHeat against misuse and attacks.
Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is the secure, reliable, and efficient operation of HabitHeat.
13. Local Browser Storage and Cookies
HabitHeat does not use cookies or similar technologies for advertising or marketing tracking.
The application may use technically necessary browser storage mechanisms, such as local storage, IndexedDB, cookies, or similar technologies, where required by the application or its authentication functionality.
These mechanisms may be used for purposes such as:
- maintaining authentication state
- keeping you signed in
- storing application state or preferences
- providing technical app and PWA functionality
They are not used by HabitHeat for advertising or cross-site tracking.
14. Progressive Web App
HabitHeat can be installed as a Progressive Web App (PWA) on supported devices.
The installable web app does not use push notifications and does not request notification permission.
15. External Content and Tracking
HabitHeat does not use third-party advertising networks or external analytics services within the web app.
Fonts, icons, and other interface assets are served through HabitHeat’s own application infrastructure rather than being loaded from external content providers.
Connections to external service providers such as Google or Stripe occur only where required for functionality you use, such as authentication or supporter subscriptions.
16. Data Retention
Account and habit data is generally stored for as long as your HabitHeat account exists and the data is required to provide the service.
Temporary data export files are automatically deleted within 24 hours.
Other information is retained only for as long as necessary for the respective purpose or where legal retention obligations require longer storage.
17. Account Deletion
You can delete your HabitHeat account at any time using the account functionality provided in the app.
When your account is deleted, the account data controlled by HabitHeat and associated with the account, including habits, habit entries, journal data, settings, and related application data, is deleted from our active application systems, unless retention is required by law.
Authentication data associated with the HabitHeat account is also deleted as part of the account deletion process.
If you have or previously had a supporter subscription, certain payment or transaction information may continue to be retained by Stripe where Stripe is legally required or otherwise permitted to retain that information for purposes such as financial recordkeeping, fraud prevention, or regulatory compliance.
18. Data Processors
Where service providers process personal data on our behalf, appropriate data processing agreements are concluded where required under Article 28 GDPR.
This particularly concerns infrastructure providers used for hosting, authentication, database storage, and related application services.
19. Your Rights
Under the GDPR, you may have the following rights regarding your personal data:
- right of access (Article 15 GDPR)
- right to rectification (Article 16 GDPR)
- right to erasure (Article 17 GDPR)
- right to restriction of processing (Article 18 GDPR)
- right to data portability (Article 20 GDPR)
- right to object to processing (Article 21 GDPR)
To exercise your rights, contact us at support@habitheat.com.
20. Right to Object
Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to that processing on grounds relating to your particular situation in accordance with Article 21 GDPR.
21. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.
The supervisory authority responsible for Schleswig-Holstein is:
Independent State Centre for Data Protection Schleswig-Holstein (ULD)
Holstenstraße 98
24103 Kiel
Germany
22. Changes to This Privacy Policy
We may update this privacy policy when HabitHeat’s functionality, infrastructure, service providers, or applicable legal requirements change.
The current version published in HabitHeat applies.
Last updated: August 2026