Privacy Policy

1. Who we are

HabitFund is operated by Shibu Yohannan trading as Vital River (hello@vitalriver.net, vitalriver.net). We are the data controller for personal data collected through the HabitFund app.

2. What data we collect

• Identity data: display name, email address, Google account ID (if Google Sign-In used), Firebase UID.
• Financial data: savings pot balance, transaction history (amounts and dates), financial value assigned to each habit, Pro subscription status.
• Behaviour data: habits created (name, frequency, streak), daily check-in records, XP and points, challenges and endeavours.
• Preference data: Daily Reflection settings, Today's Intention entries, name display format, app preferences.

Calorie tracking (optional)

Calorie tracking is optional and is off unless you turn it on. It is available only to people aged 18 and over.

What we collect if you turn it on

• Your weight, stored in kilograms
• Your birth month and year (not your full date of birth)
• The calorie settings on your habits and challenges: the activity you choose, minutes, reps or intensity, or a calorie figure you enter yourself
• The estimated calories recorded on each check-in
• An optional weekly calorie goal
• The date you turned the feature on and agreed to it

We do not collect your height, sex, heart rate, health conditions, location, or any data from other health apps or devices for this feature.

Why we use it

We use your weight, and the activity you record, only to estimate calories burned and to show them on your Home screen, in Stats and in check-in messages. We use your birth month and year only to confirm that you are 18 or over. Calorie tracking does not affect your XP or money saved.

Our basis for using it

We use this information only with your consent, which you give by ticking the box when you set up calorie tracking. Because weight and activity can be health-related, we treat this information as sensitive. You can withdraw your consent at any time by deleting your calorie data, as described below.

How accurate it is

Calories shown are estimates based on your weight, the type of activity and how long you do it. Real calorie burn varies and can differ noticeably from these figures. They are a motivational guide, not medical or dietary advice.

Where it is stored and who can see it

This information is stored in your account profile and check-in records in our Google Firebase (Firestore) database, which is located in the EU (Belgium). Only you can see it in the app. We do not sell it, use it for advertising, or share it with anyone other than Google, which hosts it for us.

Keeping and deleting it

We keep this information until you delete it. You can:

• Correct your weight, birth month or year, or weekly goal in Settings > Calories > Body details
• Remove your weight at any time
• Delete all of your calorie data in Settings > Calories > Delete calorie data
• Delete all of your app data in Settings > Reset all data

Deleting calorie data removes the calorie figures from your past check-ins. It does not affect your habits, check-ins, XP or money saved.

Your rights

Depending on where you live, you may have the right to access, correct, delete and export your data, to withdraw your consent, and to complain to your data protection authority. In the UK this is the Information Commissioner's Office. Settings > Export My Data includes your profile, and the check-ins export includes a calories column. To exercise any of these rights, contact hello@vitalriver.net.

Under-18s

Calorie tracking is not available to people under 18. If a birth month and year show that someone is under 18, we do not save them and the feature stays off.

3. How we use your data

We use your data solely to provide the HabitFund service: to create and maintain your account, display your habits and savings, calculate streaks and XP, and restore your data when you return. We do not sell your data. We do not share it with advertisers. We do not use it for any purpose beyond running the app.

4. Third-party data processors

• Google Firebase (Google LLC): user authentication and data storage. Servers in Europe. Privacy policy at firebase.google.com/support/privacy.
• Google Sign-In (Google LLC): optional authentication. Accesses email, display name, and Google account ID. Privacy policy at policies.google.com/privacy.

All processors operate under GDPR-compliant agreements.

5. Legal basis for processing

• Contract: to deliver the service you signed up for.
• Legitimate interests: to maintain security and prevent fraud.
• Consent: for optional features such as Daily Reflections.

6. Data retention

We retain your data for as long as your account is active. If you delete your account, all data is permanently deleted within 24 hours. We do not retain backups of deleted accounts beyond 30 days.

7. Your rights under UK GDPR

You have the right to: access your data, correct inaccurate data, erase your data, restrict processing, receive your data in a portable format, and object to processing.

To exercise any right, email hello@vitalriver.net with subject "Data request — [your right]". We respond within 30 days.

You may also complain to the Information Commissioner's Office at ico.org.uk.

8. Account and data deletion

• In-app: Settings → Delete my account → Confirm.
• By email: hello@vitalriver.net with subject "Delete my data".

All data permanently deleted within 24 hours.

9. Data security

All data transmitted over HTTPS. Firebase applies encryption at rest and in transit. API keys restricted to authorised domains. Payment card details are never stored — payments processed by Google Play Billing.

10. Children

HabitFund is not directed at children under 13. If you believe a child has shared data with us, email hello@vitalriver.net and we will delete it promptly.

11. Changes

We update the Last Updated date when this policy changes. Continued use of HabitFund constitutes acceptance.

12. Contact

Shibu Yohannan / Vital River
hello@vitalriver.net
vitalriver.net