Diggt Habit - Privacy Policy

1. Information We Collect

Diggt Habit keeps most of what you track on your device. This section lists everything that leaves it, and when.

Stays on your device

• Habit titles, descriptions, notes, colours and icons
• Tasks, subtasks and reminders
• Daily completion records, streaks and goals
• Slips, urges and the trigger tags you choose
• Health and step data you allow the app to read
• Your screen-by-screen history inside the app

Your account (sent to our servers)

• Email address and name
• Phone number, if you add one
• Whether your email is verified
• Subscription type, trial dates and any promo code you used
• Platform, time zone and last active time
• Your weekly email and marketing email choices, and when you made them
• The privacy policy version you accepted, and when

Your account record is stored in AWS S3 and in the customer system described in section 4.

Encrypted backup

• The app uploads a backup of your habits, tasks, completions, slips, urges and experiments so you can restore them on a new device
• It is encrypted on your device, with a key derived from your PIN, before it is uploaded
• We do not hold the key and cannot read the backup, and if you forget your PIN we cannot recover it
• The strength of the encryption depends on your PIN

Usage counts we always collect

These are filed under a random ID created on your device. It is not your account ID, it is not linked to your email or name, and it is discarded when you delete your account.

• Account created, login and email verified events
• App opens and closes, and how long a session lasted
• Which features are used
• Habits and tasks created, edited, deleted or completed, whether a habit is a quit habit, and a rough time of day
• How many times an occurrence of a quit habit was logged, never which habit and never a note
• Subscription upgrades, cancellations and trial starts
• Platform (iOS or Android), app version and country, taken from your device region setting

Personalised Insights (optional, off by default)

If you turn this on in Privacy Settings, we link usage to your account and collect more:

• Which screens you visit
• Whether you start a habit experiment, and whether you keep or undo it
• Which habit templates you use
• A summary of your progress: current streak, completion rates, totals, task counts and achievements, without habit names
• Your name and email alongside those events

Slips and urges are never linked to your account, even with Personalised Insights on. They are counted only by kind (slip or resisted urge), a rough time of day, and whether a trigger was tagged.

Marketing email (optional, off by default)

• We send product news and offers only if you turn on Product News and Offers in Privacy Settings
• We keep your answer, yes or no, and when you gave it
• Verification codes and security messages are not marketing and are sent regardless
• The weekly performance email is separate: it is sent to verified addresses unless you turn it off, and every one has an unsubscribe link

Device information

• Platform (iOS or Android)
• App version
• Country, from your device region setting

Payment information

• Subscription purchase confirmations are processed by Apple or Google
• We do not store credit card information

Website usage data

• Visited website pages, referral source and campaign parameters
• Anonymous visitor and session identifiers for marketing attribution
• Download and call-to-action clicks on the Diggt Habit website

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain and improve the app
• Process subscriptions and restore your purchases
• Count how the app is used, so we can see what to fix and build next
• Verify your email address and keep accounts secure
• Send verification codes, security messages and support replies
• Send the weekly performance email, unless you turn it off
• Send product news and offers, only if you have turned that on
• Respond to your questions and provide customer service

Diggt Habit marketing consent is tracked separately from other Diggt products such as Shyftly and SureLease.

3. Information Sharing

We do not sell your personal information. The app contains no third-party advertising or analytics services. We share information only with:

• Amazon Web Services, which hosts our servers, stores account and usage data, and sends our email
• Cloudflare, which routes and protects traffic between the app and our servers
• Apple and Google, which process purchases and tell us whether a subscription is active
• Authorities, where the law requires it, or to protect our rights and safety
• A buyer, if Diggt is part of a merger or acquisition

The customer system described in section 4 is run by Diggt on our own infrastructure. It is not a third party.

4. Data Storage and Security

On your device

• Habits, tasks, notes, slips, urges and health data are stored in a local SQLite database
• Your device encrypts that storage at rest
• You can export or delete it at any time

On our servers (AWS S3)

• Your account record, as listed in section 1
• Usage events, filed under the random ID described in section 1
• Your encrypted backup
• Everything is encrypted in transit (HTTPS) and at rest, and access is limited to our backend services

Diggt customer system

• We keep a record of each account in a customer system run by Diggt, so we can support you and, only if you opted in, send product news
• It holds your name, email, subscription status and trial dates, your marketing choice, and, if Personalised Insights is on, your progress summary

Email (AWS SES)

• Verification codes and weekly emails are sent through AWS Simple Email Service
• Verification codes expire after 10 minutes
• Weekly emails contain your own progress figures and no habit names

Security measures

• Requests from the app are signed with HMAC authentication
• The ID on usage events is random and is not derived from your account
• Slips and urges are never attached to your account

5. Health Data

If you choose to sync with Apple Health (iOS) or Health Connect (Android):

Health Connect (Android)

• The only permission requested is READ_STEPS, used to update your Daily Steps habit from your step count
• Step counts are processed on your device and are not sent to us in readable form
• You can revoke the permission at any time in your device settings or in Health Connect

Apple Health (iOS)

• We read only the data you explicitly authorise
• It is processed on your device and not sent to us in readable form
• You can revoke access at any time in your device settings

Values derived from health data, such as a step total recorded against a habit, may be inside your encrypted backup. We cannot read that backup. We do not share health data with third parties.

6. Subscription and Payment Data

Subscriptions are handled by Apple (iOS) or Google (Android):

• We do not store credit card information
• We receive confirmation of a successful purchase and whether the subscription is active
• You manage and cancel your subscription in your App Store or Google Play account

7. Data Retention

• Usage events: up to 1 year
• Account record, customer system record and encrypted backup: while your account is in use, until you delete your account in the app or ask us to delete them
• Data on your device: until you delete it or your account
• Anything the law requires us to keep

Usage events are filed under a random ID that is discarded when you delete your account, so they cannot be traced back to you afterwards. They expire on their own.

8. Your Rights and Choices

You have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your account and data
• Export your data
• Object to or limit how we use your information
• Withdraw consent you have given

In Privacy Settings you can turn Personalised Insights, Product News and Offers, and the weekly email on or off at any time. Deleting your account in the app removes the data on your device and, once you confirm with a code we email to you, your account record, encrypted backup and customer system record on our servers. If you cannot do that, email [email protected] and we will act on it within 30 days.

9. Children's Privacy

Our service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it.

10. International Users

If you use our services from outside the United States, your information may be transferred to, stored and processed in the United States, where our servers are located.

11. Changes to This Policy

We may update this policy. When a change affects what we collect or how we use it, the app will ask you to review and accept the new version before you continue. The date at the top shows when it last changed.

12. Contact Us

If you have questions about this policy, contact us at [email protected] or visit https://habit.diggt.cloud.