The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you.
Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find the operator's
contact details in the Legal Notice section of this website.
How do we collect your data?
Your data is collected when you provide it to us, for example by entering information into our
waitlist form, early access application, or blog subscription (name and email address).
This website is hosted by an external service provider (IONOS). Personal data collected on this website is stored on the host's servers. This may include IP addresses, browser requests, meta and communication data, and website access data.
The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the applicable data protection regulations (GDPR) and this privacy policy.
When you use this website, various personal data may be collected. This privacy policy explains what data we collect and what we use it for.
This website uses local storage technology (localStorage) to store your cookie consent preference. This data is stored locally in your browser only and is not transmitted to external servers. Stored data includes:
With your consent, we collect anonymized analytics data to understand how our website is used. This includes:
We do not use third-party analytics services. All analytics data is processed on our own servers. IP addresses are hashed and rotated daily, making it impossible to identify individual users. Analytics data is only collected after you accept cookies via the consent banner. The legal basis for this processing is Art. 6(1)(a) GDPR (consent).
Our hosting provider automatically collects and stores information in server log files, which your browser transmits automatically. This includes:
This data is not merged with other data sources. Collection is based on Art. 6(1)(f) GDPR (legitimate interest in the secure operation of the website).
When you submit information through our waitlist, early access application, or blog subscription forms, the data you provide (name, email address, and any additional fields) will be stored for the purpose of processing your request and for follow-up communication.
Processing is based on Art. 6(1)(a) GDPR (your consent). You may revoke your consent at any time by emailing elvarehabits@gmail.com. The lawfulness of data processing carried out before revocation remains unaffected.
You can unsubscribe from our waitlist or blog notifications at any time and have your data deleted. Use our unsubscribe page. Your data will be removed from our database immediately and completely.
This website uses external libraries and fonts from Content Delivery Networks (CDNs):
When you visit this website, connections to these services are automatically established to load the necessary resources. Your IP address may be transmitted to these providers in the process.
The following describes the personal data we process when you use the Elvare Habits mobile application on Android or iOS. This section applies exclusively to the app; website data collection is described above.
Sign-in with Google (Android) or Apple (iOS) is required to create an account. We receive the following data from the respective identity provider:
Purpose: Account creation, authentication, personalisation.
Legal basis: Art. 6(1)(b) GDPR (performance of contract).
Retention: Until account deletion. You can delete your account at any time in the
app under Settings → Account → Delete account. All data is then irreversibly removed within 30 days.
We store the following data on our own servers (hosted at IONOS in Germany) to synchronise your progress across devices and provide the social ranking:
Purpose: Provision of core app functionality.
Legal basis: Art. 6(1)(b) GDPR (performance of contract).
Retention: Until account deletion.
We use Firebase Cloud Messaging (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) to deliver push notifications (reminders, streak alerts, friendship requests). To do so, a unique push token is registered on our server.
Data: FCM push token, device platform, device model, app version.
Purpose: Delivery of push notifications.
Legal basis: Art. 6(1)(a) GDPR (consent — system permission for notifications) and
Art. 6(1)(b) GDPR (performance of contract, for feature-related notifications).
Retention: Tokens rotate; invalid tokens are deleted automatically. Full deletion on
account deletion or when notifications are disabled.
Google may transfer data to the USA. Data protection is safeguarded through EU Standard Contractual
Clauses. Google's privacy policy: policies.google.com/privacy.
We use our own analytics service running on our own infrastructure (no third parties involved). Analytics are only enabled if you actively consent to them at the first app start. You can revoke consent at any time in Settings → Privacy → Analytics.
Collected data: Anonymous session ID, screen views, feature usage events,
device model, OS version, app version, premium status. No IP address is stored, no cross-device
tracking, no advertising IDs.
Purpose: Improvement of the app, prioritisation of features.
Legal basis: Art. 6(1)(a) GDPR (consent).
Retention: 24 months, then automatic deletion.
With your consent, we collect crash reports to identify and fix errors. This includes technical
information about the crash (stack trace, device model, OS version, app version) — no personal
content data.
Legal basis: Art. 6(1)(a) GDPR (consent).
Retention: 12 months.
Our API server logs technical access information (IP address, timestamp, endpoint, HTTP status,
user agent) for security and abuse prevention. IP addresses are shortened / anonymised after 7 days
and fully deleted after 30 days.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security).
Retention: 30 days.
Subscriptions are processed exclusively via Google Play Billing (Android) or Apple App Store (iOS). We do not receive payment data (credit card, PayPal etc.). Google/Apple confirm the purchase to us via a subscription token. We store:
Purpose: Provision of premium features.
Legal basis: Art. 6(1)(b) GDPR (performance of contract).
Retention: Until account deletion + 10 years (statutory retention obligation for
invoicing data).
The following recipients receive data as part of app operation:
We do not share your data with advertising networks, data brokers or other third parties.
You can delete your account at any time in the app under Settings → Account → Delete account. Alternatively you can request deletion by email to info@elvare-habits.com. All personal data will be irreversibly deleted within 30 days; statutory retention obligations remain unaffected.
Under the GDPR, you have the following rights:
For questions about the collection, processing, or use of your personal data, or for requests regarding access, correction, or deletion of data, please contact: elvarehabits@gmail.com