HabitStackThe key points
- We never sell your data
- No advertising or tracking cookies
- You can export your data at any time
- You can delete your account and data
- Integrations like Strava are opt-in
- Passwords are hashed, never stored as text
1What this app is
HabitStack is a personal habit, fitness and nutrition tracking application. By creating an account, you agree to these terms and to the privacy practices described below.
2Your account
- You must provide accurate information when registering (email, a display name and a username).
- You're responsible for keeping your password confidential and for all activity under your account.
- You must be at least 16 years old to create an account.
- We may suspend or terminate accounts that abuse the service, attempt to access other users' data or break these terms.
3What data we collect and why
We collect the following categories of personal data, only as needed to provide the features you actively use:
| Category | Examples | Purpose |
|---|---|---|
| Account details | Email, password (hashed, never stored in plain text), display name, username | Creating and securing your account, sending account emails (verification and password resets) and letting friends find you |
| Health & fitness data | Habits and completions, workouts, weight logs, food and nutrition logs, mood check-ins, strength sessions, weekly to-do tasks | The core of the app: tracking your own progress |
| Photos | Photos you choose to add to your recipes or saved foods | Showing them in your recipe and food lists |
| Household & social data | Household memberships, friend connections, shared recipes and meals | Optional features that let you share plans and progress with people you choose |
| Billing data | Stripe customer and subscription IDs. Card details are never seen or stored by us: Stripe handles payment directly | Managing a paid subscription, if you take one out |
| Third-party integration data | Strava activity data and access tokens (only if you connect Strava) | Syncing your own fitness activity, entirely opt-in |
| Technical data | Session cookie, IP address in rate-limiting and error logs | Keeping you signed in and keeping the service secure and reliable |
4Legal basis for processing (UK/EU GDPR)
- Contract: most processing is necessary to provide the service you signed up for (storing your habits, food logs and so on so you can use the app).
- Consent: optional integrations (Strava) and this Terms & Conditions agreement itself.
- Legitimate interest: security logging (rate limiting, error logs) to keep the service running reliably and prevent abuse.
5AI-assisted features
If you use AI-assisted meal planning, the information needed to generate a plan (your macro targets and meals you have already planned, never your full food or habit history) is sent to Anthropic's Claude API to generate a suggestion. We keep a record of these requests for cost tracking and troubleshooting. See Anthropic's privacy policy for how they handle data sent to their API.
6Who else sees your data
We don't sell your data. It's shared only with the service providers needed to run the app:
- Resend: delivers account emails (email verification and password resets) to your email address.
- Stripe: payment processing, only if you take out a paid subscription.
- Anthropic: only the minimal data described above, only if you use AI meal planning.
- Strava: only if you choose to connect your account.
- Open Food Facts and Giphy: public lookups (a barcode, an exercise search term) with no account information attached.
- Other users you connect with (household members, friends): only what you choose to share with them.
7Your rights
Under UK/EU GDPR, you have the right to:
- Access the personal data we hold about you.
- Export your data. The app includes built-in export tools for your food log and other data.
- Correct inaccurate data via your account settings.
- Erase your account and associated data, from the app or by contacting us.
- Withdraw consent for optional features (for example, disconnecting Strava) at any time.
To exercise any of these rights, contact us using the details in section 10.
8Data retention
We keep your data for as long as your account is active. If you delete your account, your personal data is permanently removed from our database, except where we're required to keep billing records for tax or legal purposes (handled by Stripe).
9Cookies
We use a single essential session cookie to keep you signed in. It's required for the app to work and isn't used for advertising or cross-site tracking.
10Contact
For any questions about these terms or your data, or to request access, export or deletion, please contact us using the details provided in the app.
11Changes to these terms
We may update these terms as the app evolves. Material changes will be reflected in the "Last updated" date above; continuing to use the app after a change means you accept the updated terms.