Privacy policy
Last updated: 29 September 2026
Habitly is a daily coaching app for teams. This policy explains what personal data we collect, why we use it, who helps us process it, and the rights you have. We wrote it to be read, not skimmed past.
Who is responsible
Habitly is the data controller for the Habitly website and app. Questions, requests and complaints go to business@habitly.pro. See also the Impressum.
If your employer gave you access, your employer decides which goals and courses the team works on. Habitly still controls how your personal coaching data is handled, and the boundaries below apply to your employer too.
What we collect
- Account data: name, email address, a hashed password (we never see the password itself), and whether your email is verified.
- Profile and onboarding: your role, goals, challenges, work rhythm, study preferences, language, time zone, optional bio and profile picture, and anything you choose to write or say during onboarding.
- Coaching and learning activity: your conversations with Tess, daily actions and your reflections on them, mood check-ins, optional photo evidence, course progress, quiz and practice results, skills Tess has observed, streaks and your Growth Score.
- Tess's memory: short notes Tess keeps about your preferences and goals so she does not have to ask again. You can see and correct them in your profile.
- Team data: which organisation you belong to, your role in it, and assignments from your manager.
- Support: tickets and messages you send us.
- Technical data: the sign-in token that keeps you logged in and the cookie choice you make. We do not use analytics, advertising or tracking tools.
Why we use it, and our legal basis
- To provide the coaching service (personal plans, daily actions, courses, Tess's replies, progress): necessary to perform our contract with you or your employer (GDPR Art. 6(1)(b)).
- To keep accounts secure and prevent abuse: our legitimate interest in running a safe service (Art. 6(1)(f)).
- To send service emails such as verification, password reset and your trimester growth journal: contract.
- Optional features such as the leaderboard, study buddies and remembering your theme or language on your device: your consent, which you can withdraw at any time (Art. 6(1)(a)).
- Legal obligations such as bookkeeping for paying customers (Art. 6(1)(c)).
Mood check-ins and reflections can reveal how you feel. We only use them to coach you, never share them with your employer, and you decide whether to give them at all.
How AI is used
Tess is an AI coach. To write replies, plans and courses, the relevant parts of your profile, recent conversations and learning activity are sent to our AI providers (listed below). They process this data on our behalf and under contract may not use it to train their models. Tess makes suggestions only: she does not make decisions that have legal or similarly significant effects on you, and you can always edit your goals, tasks and paths yourself.
What your employer can see
Managers see agreed development indicators only: goal and course progress, streaks, Growth Score and assignment status. They never see your journals, reflections, photos, mood check-ins or conversations with Tess. You can hide your row from your team at any time in your profile.
Who processes your data
We use a small number of service providers, each bound by a data processing agreement:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database hosting | EU |
| Hetzner | Application hosting (VPS) | EU (Germany) |
| Anthropic | AI coaching (Tess), course and task generation | USA |
| OpenAI | Text embeddings so Tess can find relevant past notes | USA |
| Resend | Sending verification and service emails | USA |
| Google (YouTube) | Finding course videos, and playing them if you allow external media | USA |
Transfers outside the EU/EEA are protected by the EU-US Data Privacy Framework where the provider is certified, and otherwise by the European Commission's Standard Contractual Clauses. We never sell your data.
How long we keep it
- Account, profile and coaching data: for as long as your account exists.
- When you ask us to delete your account, we delete your personal data within one month, unless the law requires us to keep something (for example invoices).
- Sign-in tokens expire after 7 days. Your cookie choice is kept for 12 months.
Your rights
Under the GDPR you can:
- see the personal data we hold about you and get a copy of it;
- correct data that is wrong;
- have your data deleted;
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent at any time, without affecting processing that happened before.
You can already export your growth journal and review what Tess remembers from your profile. For anything else, email business@habitly.pro and we will reply within one month. You also have the right to complain to your local data protection authority.
Cookies
We only use cookies and browser storage that keep Habitly working, plus optional ones you choose. See the cookie policy for the full list and to change your choice.
Security
Data is encrypted in transit, passwords are hashed, and access to production data is limited to the people who need it to run the service.
Children
Habitly is built for working adults and is not intended for anyone under 16.
Changes
If we change this policy in a meaningful way, we will tell you in the app or by email before the change takes effect. The date at the top shows the latest version.