Habits & HydrasPrivacy Policy

Last updated 1 September 2026Account-based · guest sign-in available

Habits & Hydras is a personal habit and activity tracker that awards experience points for logged activities. We collect only what the app needs to work. There is no advertising SDK and no tracking across other apps or websites.

The short version

You can use the app without an email address by choosing guest sign-in. What you log becomes XP; some of it is health and fitness information, which we treat as sensitive. Two server-side switches control everything other users can see about you.

Who we are

Habits & Hydras is operated by Divyansh Karan, trading as Stelr Studio (Remote · India), the data controller for the purposes of the UK GDPR and GDPR. Contact: karandivyansh01@gmail.com.

Account information

Data	Why	Required
Email address	To create and sign in to your account	Yes, unless you use guest sign-in
Password	Stored only as a salted hash by our authentication provider; we never see it	Yes, for email accounts
Username, display name, avatar	Shown on your profile, on leaderboards, and to friends	Yes

You can use the app without an email address by choosing guest sign-in, which creates an anonymous account.

Activity data

The app records the activities you choose to log. Depending on which trackers you use, this can include:

Some of this is health and fitness information. We treat it as sensitive. It is used only to calculate your XP, streaks, levels, quests and statistics. We do not sell it, and we do not use it for advertising.

Fitness activities — type, duration, distance
Study and reading sessions — duration, pages, book titles you enter
Nutrition entries — meals and water intake you log
Sleep duration
Mindfulness and creative sessions
Custom activities you define

Technical data

Your notification permission state and reminder preferences, and your app settings including appearance and privacy choices.

We do not collect your precise location, contacts, photos, camera, microphone, call logs, SMS, or a device advertising identifier.

How your data is stored and protected

Your data is stored on Supabase (PostgreSQL), our hosting and authentication provider, and processed under their terms.

No system is perfectly secure, and we cannot guarantee absolute security.

All traffic between the app and our servers uses HTTPS/TLS.
Every database table enforces row-level security, so one account's queries cannot read or modify another account's rows.
Activity data is also cached on your device so the app works offline, and is removed when you delete your account or uninstall the app.

Who your data is shared with

We do not sell your data, and we do not share it with advertisers or data brokers. Data is shared only:

With other users you choose to interact with — friends see your activity feed, guild members see your contribution, and the global leaderboard shows your username, avatar, level and weekly XP.
With our hosting provider (Supabase), strictly to operate the service — supabase.com/privacy
With Expo / EAS for app builds and updates. No personal data.
Where legally required, in response to a valid legal request.

Your visibility controls

In Settings → Privacy you can turn off:

These take effect on our servers, not just in the interface.

Global leaderboard — removes you from the public leaderboard entirely.
Activity feed — stops friends from seeing your logged activities.

How long we keep it

While your account exists — as long as you keep it.
When you delete your account — permanently deleted, including the on-device cache.
Database backups may retain deleted data until they rotate out on the hosting plan's retention schedule.

Your rights

Wherever you live, you can exercise all of the following. If you are in the UK or EEA these are your rights under the UK GDPR and GDPR; in California, under the CCPA/CPRA.

To exercise any right, email karandivyansh01@gmail.com. We respond within 30 days.

Access — everything we hold is visible inside the app.
Correct — edit any entry or profile field directly.
Export — request a machine-readable copy of your data.
Delete — Settings → Data → Delete Account, described below.
Withdraw consent for anything optional, by removing the data or revoking the permission in your device settings.
Object or restrict processing, and lodge a complaint with your data protection authority (in the UK, the ICO at ico.org.uk).

Deleting your account

Settings → Data → Delete Account permanently deletes your account, your activity history, your guild memberships and your leaderboard entries. Settings → Data → Export My Data produces a file containing your activity history first, if you want a copy.

If you cannot access the app, email karandivyansh01@gmail.com from your registered address and we will delete the account within 30 days.