Privacy Policy · Habit Duck

1. Who is responsible

The data controller is Habit Duck, the project that develops and publishes the Habit Duck mobile app and the habitduck.com website, based in Ecuador. Processing is governed by Ecuador's Organic Law on Personal Data Protection and, where it applies to you by virtue of your residence, by the data protection law of your own country. You can reach us any time at support@habitduck.com.

2. What data we process

Habit Duck is built local-first: almost everything you create stays in your own phone's storage and is never sent to any server.

Data	What for	Where it lives
Email address and password	Creating your account and signing in	Firebase Authentication (Google). The password is stored hashed; we cannot read it
Google account (if you sign in with Google)	Signing in without a password	Firebase Authentication receives your email, your Google profile name and the address of your profile photo. The app neither shows nor uses the name or the photo; if you sign in with email and password, neither is stored
User id, creation date and last sign-in	Keeping your session and being able to honour a deletion request	Firebase Authentication
Your habits, life areas, streaks and daily history	Making the app work: daily logging and your duck's state	Your phone and a copy kept with your account (Cloud Firestore, Google)
Duck state: level, experience, health per area, weight, death and revival, equipped cosmetics	The pet mechanic	Your phone and a copy kept with your account
Your calendar events and study schedule	Showing your schedule	Your phone and a copy kept with your account
The image you add to the schedule's Image view	Keeping your schedule handy as a photo	Your phone only. You pick it from your gallery and it is never uploaded, not even to your account's copy
Preferences: accent color, night mode, time format, reminder times, Pomodoro settings	Remembering how you left the app	Your phone and a copy kept with your account
Anonymous subscription identifier, device model and version, app version, language, country and time zone	Knowing whether you have an active subscription	RevenueCat. The identifier is generated by the system itself and is not linked to your email
What you enter in the first-run form (duck name, gender, motivation)	Personalising the app	Your phone only

The copy of your progress exists for one purpose: giving your habits and your duck back when you reinstall the app or set up a new phone. It is tied to your account in a document of its own, travels encrypted, and only your account can read or write it. We don't share it with anyone, we don't use it for advertising, and we never sell your data.

What isn't in that copy lives only on your phone: if you uninstall the app or clear its data, your schedule image is gone and we cannot recover it.

3. What we don't collect

To be explicit, this version of the app includes no:

Usage analytics (no Google Analytics, no Firebase Analytics, nothing equivalent).
Automatic crash reporting (no Crashlytics or similar).
Real advertising or advertising identifiers (see section 8).
Location, contacts, microphone, camera or sensors.
Selling or sharing data with third parties for commercial purposes. We never sell your data.

To choose the calendar image the app uses the system photo picker, which needs no storage permission: it only receives the photo you pick. These are all the permissions the app declares and what each one is for. The only one Android asks you about with a prompt is notifications; you may have to turn on exact alarms yourself in the system settings, and the system grants the rest without asking.

Notifications — your habit reminders and the Pomodoro end-of-block alert.
Exact alarms and reminders — so those alerts arrive on time rather than late. On Android 14 or later you may need to enable it in the system settings.
Run at startup and keep the device awake briefly — to reschedule reminders after a restart and fire them on time.
Vibration — for the alerts.
Foreground audio playback and audio settings — so the Pomodoro alarm can sound. The app only plays sound; it does not record.
Internet and network state — signing in and checking your subscription status.
Google Play billing — declared by the Google Play and RevenueCat purchase components to manage subscriptions.
Google Play install referrer — declared by an internal component of the app, but not used: the app neither reads nor sends how you installed it.
Icon badge — the pending-alert count on the app icon in launchers that support it (Samsung, Huawei, Oppo, Sony, HTC and others).
Receive Google messages — declared by the notifications library, but the app does not use push notifications and never registers for them: every alert is scheduled on your own phone (see section 6).

This list reflects the launch version of the app. If an update adds or removes permissions, we will update it here.

4. What we use it for

Giving you access to your account (legal basis: performance of the contract — providing the service you asked for).
Running the app: habit logging, duck state, calendar, Pomodoro (performance of the contract).
Keeping a copy of your progress tied to your account, to give it back when you reinstall the app or switch phones (performance of the contract).
Sending the reminders you configure (consent: you switch them on and off in Settings).
Handling your requests for support or data rights (legal obligation and legitimate interest).

We do no profiling and make no automated decisions with legal effects on you. Your duck's “health” is a game mechanic computed on your own device, not an assessment of you as a person.

5. Who we share it with

Only the providers we need for the service to exist:

Google (Firebase Authentication) — handles sign-up and sign-in, including “Continue with Google”. It processes your email and account metadata as our processor. Firebase privacy.
Google (Cloud Firestore) — stores the copy of your progress. Each account has its own document, and the database's security rules stop anyone else from reading or changing it. The servers are in the southamerica-east1 region (São Paulo, Brazil).
Google (Firebase Hosting) — serves this website and records requests (including the IP address) in its technical logs.
RevenueCat — handles subscription status. Its component starts when you open the app, whether or not you buy anything, and sends it an anonymous identifier that it generates itself, technical details about the device and the app (model, Android version, app version, language, country and time zone) and the state of your purchases. We do not send it your email or your account identifier, so that anonymous identifier is not linked to you. RevenueCat privacy.
Google Play — if you subscribe in the future, the payment is processed by Google Play. See section 8.

These providers may process data outside your country, including transfers to the United States, under the contractual safeguards Google publishes in its own terms.

6. Notifications

Habit reminders and Pomodoro alerts are scheduled on your own phone using the Android/iOS local notification system. They never go through a server of ours, we use no push notifications, and we don't know whether you opened them. You can turn them off in Settings or revoke the permission from the system.

7. The website

habitduck.com is a static site with a Pomodoro timer that runs in your browser. About it:

It uses no cookies, first- or third-party, and has no analytics.
It uses your browser's localStorage to remember the light/dark theme, your Pomodoro settings and tasks, and the background image you upload. All of that stays in your browser; the image is never uploaded. You can clear it by clearing the site's data.
It loads the Fredoka and Nunito fonts from fonts.googleapis.com, so opening the page sends your IP address to Google as part of that request.
The hosting provider (Firebase Hosting) keeps access logs with IP and user agent.

8. Ads and purchases

This version has no real ads and no payments. The app ships the mechanic (watching three ads unlocks an extra habit, and a subscription state exists), but no advertising SDK is installed and nothing can be paid for.

What is active is the subscription infrastructure (RevenueCat), which connects from the first launch to check whether you have anything active — today the answer is always no. Section 5 sets out the detail.

Before we turn ads or subscriptions on, we will:

Update this policy with the specific provider (most likely Google AdMob) and what it processes — typically the device's advertising identifier and technical data.
Ask for consent where the law requires it (UMP in the European Economic Area and the UK, App Tracking Transparency on iOS).
Charge subscriptions through Google Play: Google processes the payment and we never see your card or billing details.

9. How long we keep it

Your account data, for as long as the account exists. Delete it and it is removed from Firebase Authentication immediately.
The data on your phone, for as long as the app is installed. It goes when you uninstall, clear the app's data, use “Reset all data” or delete your account.
The copy of your progress, for as long as the account exists. It is deleted the moment you delete the account.
Emails you send us, as long as needed to help you and to show that we did.
Purchase records, once any exist, are kept by Google Play and RevenueCat for the periods their tax and accounting obligations require, regardless of whether you delete your account. There are none today, because nothing can be purchased yet.

10. Your rights

You may exercise, free of charge, your rights of access, rectification, erasure, portability, objection and restriction of processing, and withdraw consent where processing is based on it.

Most of them you can exercise yourself inside the app: habits and calendar events are edited and deleted from their own screens, and the account is deleted from Settings → Account. For anything else, write to support@habitduck.com from your account's email address and we will reply within 30 days at most.

If you believe we handled your request poorly, you can complain to Ecuador's Superintendence of Personal Data Protection or to the data protection authority of your own country of residence.

11. How to delete your data

Step-by-step instructions are on Delete my account. In short: Settings → Account → Delete my account inside the app.

Deleting your account deletes the copy of your progress and all local data on that phone: habits, duck, level, cosmetics, calendar and history. This is deliberate and cannot be undone — because on-device data isn't scoped per account, leaving it there would hand it to whoever signs in on that phone next.

12. Minimum age

Habit Duck is for people aged 13 or older. In European Economic Area countries where the digital age of consent is higher, that age applies instead (up to 16). The app is not directed at children and we do not knowingly collect data from anyone below that age.

If you are a parent or guardian and believe a minor created an account, write to support@habitduck.com and we will delete it.

13. Security

Sign-in and passwords are handled by Firebase Authentication with encryption in transit and at rest; we neither store nor can read your password. The copy of your progress travels encrypted, and the database's security rules let only your own account read or write it. Data living on your phone is protected by the operating system itself and by whatever screen lock you use. No system is infallible: if we detect a breach affecting you, we will tell you and notify the relevant authority where the law requires it.

14. Changes

If we change this policy we will update the date in the header. When the change is significant — for example when enabling ads or payments — we will tell you inside the app before it takes effect.

15. Contact

Privacy questions, data requests or anything else: support@habitduck.com.