Features Blog Socials Early Access Join Waitlist

Privacy Policy

Last updated: June 15, 2026

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you use this website or the Elvare Habits mobile application ("the App"). Personal data is any data that can be used to personally identify you.

Data Controller

Clemens Börner
Email: elvarehabits@gmail.com
See our Legal Notice for full contact details.

2. Website Data Collection

Hosting

This website is hosted by IONOS SE (Germany). Personal data collected on this website is stored on the host's servers within the European Union. This may include IP addresses, browser requests, meta and communication data, and website access data.

Cookies and Local Storage

This website uses local storage technology (localStorage) to store your cookie consent preference. This data is stored locally in your browser only and is not transmitted to external servers.

Website Analytics

With your consent, we collect anonymized analytics data to understand how our website is used. This includes page URLs visited, referrer URLs, a daily-rotating hash of your IP address (not the actual IP), and browser user agent. We do not use third-party analytics services. All analytics data is processed on our own servers. Analytics data is only collected after you accept cookies via the consent banner. Legal basis: Art. 6(1)(a) GDPR (consent).

Waitlist, Early Access & Blog Subscription Forms

When you submit information through our forms, the data you provide (name, email address) will be stored for processing your request and for follow-up communication. Legal basis: Art. 6(1)(a) GDPR (consent). You may revoke your consent at any time by emailing elvarehabits@gmail.com.

3. App Data Collection

The Elvare Habits mobile application collects the following data to provide its core functionality.

3.1 Account & Authentication

You can sign in using Google Sign-In or Apple Sign-In. When you sign in, we receive the following data from the authentication provider:

  • Email address
  • Display name
  • Profile photo URL (Google only)

This data is used to create and manage your account. Authentication tokens are stored locally on your device and on our server for session management. Legal basis: Art. 6(1)(b) GDPR (contract performance).

3.2 User Profile & Habits

When you use the App, the following data is stored on our server:

  • User profile (username, display name, avatar image)
  • Habit statistics (streaks, completion counts, XP, level)
  • Friend connections and friend codes
  • Challenge participation data
  • Shared routines

Your actual habit names and details are stored locally on your device only (via SharedPreferences) and are not transmitted to our server. Only aggregated statistics (e.g. total habits completed, streak length) are synced for leaderboard and social features. Legal basis: Art. 6(1)(b) GDPR (contract performance).

3.3 Push Notifications

If you grant notification permission, we use Firebase Cloud Messaging (FCM) by Google to send push notifications. Your FCM device token is registered on our server. Google may process your IP address when delivering notifications. You can disable notifications at any time in your device settings or in the App settings. Legal basis: Art. 6(1)(a) GDPR (consent).

3.4 App Analytics

The App collects usage analytics to improve the user experience. This includes:

  • Screen views and feature usage
  • Habit creation and completion events
  • App lifecycle events (open, close, background)
  • Device information (platform, app version, OS version, device model)

Analytics data is sent to our own server (not to third parties). No advertising identifiers are collected. Analytics can be disabled in the App settings. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the App).

3.5 Firebase Remote Config

We use Firebase Remote Config by Google to manage app configuration remotely, such as feature flags and in-app messages. This service may process your IP address and device identifiers. No personal user data is sent to Firebase Remote Config. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in app management).

3.6 AI Coach

The App includes an AI chat feature. When you use the AI Coach, your chat messages are sent to our server for processing. Chat history is stored locally on your device. Legal basis: Art. 6(1)(b) GDPR (contract performance).

3.7 Avatar Upload

You can upload a profile picture from your camera or photo gallery. The image is transmitted to and stored on our server. You can remove your profile picture at any time in the Account Settings. Legal basis: Art. 6(1)(a) GDPR (consent).

3.8 In-App Purchases

Premium subscriptions are processed through Google Play (Android) or Apple App Store (iOS). We do not collect or store payment information. The respective platform handles all payment processing. We only receive confirmation of your subscription status. Legal basis: Art. 6(1)(b) GDPR (contract performance).

4. Local Data Storage

The App stores the following data locally on your device using SharedPreferences:

  • Authentication tokens (access token, refresh token)
  • Your habits, groups, and display preferences
  • App settings (language, notifications, theme)
  • AI Coach chat history
  • Achievement progress
  • Analytics event queue (before server sync)

This data is protected by your device's operating system sandbox and is not accessible to other applications. It is deleted when you uninstall the App.

5. Third-Party Services

The App and website use the following third-party services:

Service Provider Purpose
Firebase Cloud Messaging Google LLC Push notifications
Firebase Remote Config Google LLC App configuration & in-app messages
Google Sign-In Google LLC Authentication
Apple Sign-In Apple Inc. Authentication
Google Fonts Google LLC Typography
IONOS Hosting IONOS SE (Germany) Server hosting & database

Google LLC is based in the USA. Data transfers to the USA are covered by the EU-U.S. Data Privacy Framework. Apple Inc. is based in the USA and participates in the same framework. IONOS SE is based in Germany; all server data remains within the EU.

6. Data Security

We implement the following security measures:

  • All data transmission uses HTTPS/TLS encryption
  • API requests are signed with HMAC-SHA256 to prevent tampering
  • Authentication tokens expire after 1 hour (access) / 30 days (refresh)
  • Passwords are never stored; we use OAuth token-based authentication only
  • Database access is restricted and credentials are stored in environment variables

7. Account Deletion

You can delete your account at any time from within the App: Account Settings → Delete Account.

When you delete your account, all of the following data is permanently removed from our server:

  • Your user profile and avatar
  • Authentication tokens and sessions
  • Friend connections and requests
  • Challenge participation
  • Shared routines
  • Statistics and leaderboard entries
  • Analytics events
  • Push notification tokens

Local data on your device (habits, settings) is removed when you uninstall the App. Account deletion is irreversible.

8. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

  • Right of access — request a copy of your stored data
  • Right to rectification — correct inaccurate data
  • Right to erasure — delete your data (see Account Deletion above)
  • Right to restriction — restrict processing of your data
  • Right to data portability — receive your data in a portable format
  • Right to object — object to processing based on legitimate interest
  • Right to withdraw consent — withdraw consent at any time (e.g. analytics, notifications)
  • Right to lodge a complaint — file a complaint with your local data protection authority

To exercise any of these rights, contact us at: elvarehabits@gmail.com

9. Data Retention

We retain your account data for as long as your account is active. After account deletion, all personal data is permanently removed from our servers. Server log files are retained for up to 30 days for security purposes. Analytics data is retained in aggregated, non-identifiable form.

10. Children's Privacy

The App is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child, please contact us at elvarehabits@gmail.com and we will promptly delete it.

11. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date. For significant changes, we will notify users through the App.

Back to Home