Who we are
ClassHabits (classhabits.com) is a habit tracker and time tracker with a 3D forest. It is run by an independent developer, who is the controller of your personal data for the purposes of UK data protection law.
You can reach us about anything in this policy at [email protected].
What we collect
- Account details: your username, email address and password. Passwords are stored only as a salted hash, never in plain text.
- If you sign in with Google: your Google account ID, first name and email address.
- If you join the Android beta waiting list: the email address you give us and when you signed up. We use it only to send you the test invite, and you can ask us to remove it at any time.
- What you put into the app: habits, check-ins, notes, checklists, timers, Timelines tracks, events and goals, your forest and tree shop items, your settings (including any vacation dates), an optional profile photo and, for Premium members, an optional profile banner image.
- If you turn on reminders: a push subscription for each device you turn them on for (an address your browser's push service gives us to deliver notifications, or in the Android app a Firebase Cloud Messaging token for that install), plus your reminder preferences (times, days and any per-habit reminder times) and time zone.
- If you use the Android app: your sign-in session is kept on your phone in the app's private storage so you stay signed in, and the app's notifications and "Mark done" button use it to reach your account. Signing out removes it.
- If you use invites, partners or challenges: your invite code and who invited you (or whom you invited), your accountability partners, the challenges you're in and which habit counts for each, and the cheers you send and the forests you water.
- Subscription and purchase records: your Stripe customer and subscription IDs, plan, status and any free-trial dates, and for the lifetime supporter deal your supporter number, purchase date and Stripe payment ID. Card details are entered on Stripe's checkout and never reach our servers.
- If you buy in the Android app: Google Play handles the payment; we receive and store the purchase details Google gives us (product, order number, purchase token, renewal and expiry dates), never your card.
- Usage analytics: page views and a small set of product events (for example, signing up or starting a checkout). Analytics aren't linked to your account and store nothing on your device: visitors are counted with an anonymous code made from your IP address and browser type plus a random value that changes every day, so it can't be traced back to you or followed across days. Automatic click tracking is turned off, and one-time secrets in links (like password reset tokens) are removed before anything is sent.
- Error reports: when something breaks, a report of the error with the page or server route it happened on, your browser and device type, and the pages you visited and buttons you pressed just before. Reports never include your habits, notes, account details, password, cookies or anything you typed, and aren't linked to your account. They're stored in the EU.
- Technical data: your IP address is processed by our hosting and security layers to deliver the site and protect it from abuse (for example, rate limiting).
How we use it
- To run the service: save and sync your data, work out streaks, perfect days and ClassCoins, and show your forest and statistics.
- To handle Premium and coin purchases through Stripe, and through Google Play in the Android app.
- To send account emails you ask for, such as password reset links, and the daily reminders you turn on, and emails about your purchases (for example, a reminder before a free trial ends, or a note when we refund a payment).
- To keep ClassHabits secure and stop abuse.
- To understand which features are used so we can improve them.
Under UK GDPR, we rely on: performing our contract with you (running your account and purchases), our legitimate interests (security and understanding how the product is used), and legal obligations (keeping payment records).
To do this, we use trusted service providers for hosting, payments, sign-in, email, notifications, analytics and error monitoring. They only process data on our behalf. We don't sell your personal data or share it with advertisers, and we only disclose it to others if the law requires it.
Cookies and storage on your device
- A sign-in cookie and local storage that keep you logged in on this device (the cookie lasts 30 days).
- A short-lived session cookie used while signing in with Google (lasts up to 7 days).
- Local storage for your preferences, such as light or dark mode, your theme and whether page sounds are on.
- Check-ins and timer sessions you make without a connection, kept in local storage until they've been sent to us (cleared when you sign out).
- In the Android app, if you add home-screen widgets: a copy of today's habits, your streaks and heatmaps, and the tree pictures they show, kept in the app's private storage so the widgets can draw them. It's removed when you sign out or uninstall the app.
These are needed for the site to work or to remember choices you make. Analytics store nothing on your device, and we don't use advertising or cross-site tracking cookies.
How long we keep data
We keep your data for as long as you have an account. Deleting your account from your profile permanently removes your habits, check-ins, notes, Timelines tracks, events and goals, your forest, your reminder subscriptions, your partnerships and challenge memberships, and your account from our database. Turning reminders off stops them straight away.
Error reports are deleted automatically after 30 days.
Stripe and Google keep payment records for as long as financial and tax law requires.
Your rights
You can ask to access, correct, export or delete your personal data, or object to how we use it. Anyone can download their habit history and notes as a CSV file from Settings, Premium members can also export Timelines as CSV or PDF, and anyone can delete their account from their profile. For anything else, email us and we'll respond within one month.
If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk).
Children
ClassHabits isn't intended for children under 13, and we don't knowingly collect their data. If you believe a child under 13 has an account, contact us and we'll delete it.
Changes to this policy
If we make significant changes, we'll update the date at the top and, where appropriate, let you know in the app or by email.