Privacy Policy
Last updated 1 October 2026
Habitrec is operated by Bizomatic Solutions Pvt. Ltd., India. This policy explains what we collect, why, how long we keep it, and what you can require us to do.
Habitrec holds unusually personal material — what you intend to do, what you spend, what you are avoiding, what you reflect on. We treat it as closer to a private journal than a task list, and this policy is written to that standard.
1. What we collect
| Category | Examples | Why |
|---|---|---|
| Account | Name, email address, time zone | To create and secure your account |
| Content you create | Captured items, goals, plans, notes, habits, money records | This is the service |
| Google account data | Basic profile; calendar data if you connect a calendar | Sign-in and calendar scheduling — see section 2 |
| Technical | IP address, browser type, timestamps, error diagnostics | Security, abuse prevention, fixing faults |
| Billing | Subscription status and an opaque payment reference | To operate a paid subscription |
| Usage | Which features you use and when — for example that you planned a day, committed a week, or were shown a particular insight card. Never what you wrote in them | To see which parts of Habitrec actually help, and remove the parts that do not |
We never receive or store your card details. Payments are handled entirely by our payment processor; we hold only a reference and your subscription status.
2. Google account data and Limited Use
If you sign in with Google, we receive your basic profile — name, email address and profile picture — to identify your account.
If you choose to connect a calendar, we request these Google Calendar permissions, and only these:
https://www.googleapis.com/auth/calendar.events— see and edit events on your calendars;https://www.googleapis.com/auth/calendar.calendarlist.readonly— see the list of your calendars, so you can choose which ones Habitrec uses;https://www.googleapis.com/auth/calendar.app.created— create a separate calendar for Habitrec's events, if you choose to have one, and manage only calendars Habitrec created.
We ask for them at the moment you connect a calendar, never at signup. If you never connect one, they are never granted. We do not request full access to your calendars: we cannot share them, and cannot delete any calendar Habitrec did not create. We use these permissions only to:
- read events from the calendars you choose and keep a copy of each — its title, description and times — so it shows in your Brain Dump and on Today, and so we can find genuinely free time and avoid double-booking you. If an event changes both in Google and in Habitrec, we also keep its location with the two versions, so you can compare them. Copies of events deleted in Google, or from a calendar you stop reading, are removed unless you have edited them in Habitrec;
- create and update the events you ask Habitrec to schedule — a repeating item as a single repeating event — in the calendar you choose when you connect: your main calendar, or a separate Habitrec calendar you can hide or delete at any time;
- change an event copied from your calendar when you edit it in Habitrec — only the title, description or times you changed, and only if the event has not changed in Google since Habitrec last read it. Events Google does not let other apps change, such as bookings Gmail adds, are never changed;
- delete an event when you delete its item in Habitrec — unless the event has changed in Google since Habitrec last read it, or sits on a calendar you can only view, in which case it is left where it is and Habitrec tells you so;
- detect when an event has changed in both places, and show you both versions so you can decide — we never resolve such a conflict automatically.
Limited Use disclosure. Habitrec's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, we do not use Google user data for advertising, we do not sell it, we do not transfer it to others except as necessary to provide or improve the service, to comply with applicable law, or as part of a merger or acquisition, and we do not use it to develop, improve or train generalised artificial intelligence or machine learning models.
Access tokens are encrypted at rest, are never written to logs, and are never returned by any part of the service. You can disconnect a calendar at any time from within Habitrec, or revoke access from your Google account permissions page. Disconnecting stops the sync and deletes the stored tokens.
3. How we use your data
- To operate the service you have asked for.
- To keep your account secure and to detect abuse.
- To diagnose faults, using logs that carry identifiers and metadata only.
- To contact you about the service — billing, security, material changes. Marketing email is separate and optional.
- To send the emails you choose in Settings → Emails: a weekly review on Sunday evenings and a note when a calendar change has waited a day (both on unless you switch them off), and a morning email with your plan for the day, which contains the titles you marked most important (only if you switch it on). Every one can be stopped with one click from the email itself.
4. What we never do
- We never sell your data, and never share it for anyone else's advertising.
- We never use your content to train machine learning models — ours or anyone's.
- We never log the contents of what you write: item bodies, notes, reflections, money amounts, passwords and tokens are excluded from logs by an enforced redaction rule.
- We do not share anything with a coach or any other person unless you explicitly turn that on, per person, and you can withdraw it.
5. Who else processes your data
We use a small number of service providers, each under a data processing agreement, and only for the purpose named:
| Provider | Purpose |
|---|---|
| Sign-in and, if you connect one, calendar synchronisation | |
| Cloud hosting provider (European Union) | Server hosting: the application, the database and the backups |
| Razorpay (India) | Subscription billing, if you subscribe |
| Sentry (European Union) | Diagnosing faults; content is redacted before it is sent |
| Amazon SES (United States) | Account, billing and security email, and the emails you choose in Settings |
6. Where your data is stored
Your data is stored in the European Union — the application, the database and the backups all sit on a server in France.
Habitrec is operated from India. India’s Digital Personal Data Protection Act 2023 permits personal data to be transferred abroad except to countries the government restricts, and none of those apply here. If you are in the EU or UK, your data is held inside the EEA, which is where the GDPR expects it to be.
Two things happen outside the EU, and we would rather name them than leave “providers operate globally” to cover it: email is delivered through Amazon SES in the United States, so the contents of an email we send you — a sign-in link, or the daily plan you asked for — passes through there; and Google holds your calendar, in whichever region Google keeps it. Both are covered by the providers’ contractual safeguards.
7. How long we keep it
| Data | Retention |
|---|---|
| Your content, while your account is open | Until you delete it or close the account |
| Items you delete | Recoverable for 30 days, then permanently removed |
| Closed accounts | 30-day grace period, then permanently purged |
| Backups | Rolling 30 days; deleted data disappears as backups rotate |
| Security and audit logs | 2 years |
| Google OAuth tokens | Deleted immediately when you disconnect or revoke |
8. Your rights
Under India's Digital Personal Data Protection Act 2023 — and, if you are in the EU or UK, the GDPR — you may:
- Access your data, and export all of it in a machine-readable format.
- Correct anything inaccurate; all of your content is editable in-app.
- Delete your account and everything in it.
- Withdraw consent — including disconnecting your calendar — at any time.
- Complain to your data protection authority.
Both are in the app, under Settings → Your account: download everything as one file or as spreadsheets, or delete your account. Deleting closes it at once; for 30 days the link we email you brings it back, and after that it is permanently erased. You can also write to privacy@habitrec.com and we will do either within 30 days. Individual items can be deleted in the app at any time. We will never hold your data hostage — export stays available even if your subscription has lapsed.
9. Security
- Encrypted in transit (TLS 1.3) and at rest.
- OAuth tokens encrypted with a separately managed key.
- Passwords hashed with Argon2id and never recoverable.
- Content excluded from logs by an enforced redaction rule.
- Access to production data restricted and audited.
No system is perfectly secure. If a breach affects you, we will notify you and the relevant authority within 72 hours of becoming aware of it.
10. Children
Habitrec is for adults. It is not intended for anyone under 18, and we do not knowingly collect their data.
11. Changes to this policy
If we make a material change we will tell you by email and in the app before it takes effect. The date at the top always reflects the current version.
12. Contact
Bizomatic Solutions Pvt. Ltd.
308-A, Raj Square, Near Tejpur Gadbadi Puliya
Indore, Madhya Pradesh 452012, India
Phone: +91 75208 12345
Privacy: privacy@habitrec.com
General: hello@habitrec.com