HabitAI — Privacy Policy

This Privacy Policy describes how HabitAI ("we", "us", "our") collects, uses,

and protects your information when you use our mobile application.

OUR CORE COMMITMENTS

• Your habit and check-in data are stored only on your device. We do not

and cannot access them.

• We do not sell your personal data. Ever.
• No account system. No cloud sync. No server.
• Ads keep HabitAI free — you can opt out of personalized ads at any time.

1. DATA CONTROLLER IDENTITY

• Developer / Controller: YU CHEN
• Contact email: 1007958770qq@gmail.com
• Country of establishment: China
• App: HabitAI — AI Habit Tracker

We are the data controller responsible for the lawful processing of your

personal data under applicable privacy laws (including the GDPR, CCPA/CPRA,

and LGPD).

2. WHAT DATA WE COLLECT

2.1 Data you provide (stored only on your device)

• Habit data: habit names, categories, frequency, reminder times, and

check-in records that you create. This data is stored entirely on your

device (local database). We cannot access it.

2.2 Data collected automatically

• Advertising identifier (Google Advertising ID): used by Google AdMob to

display ads and measure ad performance.

• Install source: when you install the App through a friend's share link,

Google Play provides an install referrer parameter, used only for

attribution statistics. It contains no personally identifiable

information.

2.3 Data we do NOT collect

• Name, email address, phone number
• Contacts or call logs
• Precise location (GPS)
• Photos, videos, or files
• Health or biometric data
• Financial or payment information (there are no in-app purchases)

3. DATA USE PURPOSES AND LEGAL BASIS

• Providing the core habit-tracking service — habit data (local) —

Contract performance (GDPR Art. 6(1)(b)).

• Displaying ads to support the free service — advertising identifier —

Consent (Art. 6(1)(a)) / Legitimate interest (Art. 6(1)(f)).

• Attribution (friend-invite installs) — install referrer parameter —

Legitimate interest (Art. 6(1)(f)).

• Complying with legal obligations — as applicable — Legal obligation

(Art. 6(1)(c)).

4. THIRD-PARTY SERVICES AND DATA SHARING

4.1 Google AdMob (advertising)

• Purpose: display ads in the App to support the free service.
• Data: Google Advertising ID, device information, IP address, ad

interaction data.

• Privacy policy: https://policies.google.com/privacy
• Opt out of personalized ads: device Settings → Google → Ads → opt out

of ad personalization, or visit https://adssettings.google.com

4.2 Google UMP (User Messaging Platform — consent management)

• Purpose: collect your consent choices for personalized ads in the

EEA/UK and other required regions.

• Data: your consent status.
• Privacy policy: https://policies.google.com/privacy

4.3 Google Play Install Referrer (install attribution)

• Purpose: identify the install source when you install via a friend's

share link.

• Data: install referrer parameters (utm_source, inviter, etc.). No

personally identifiable information.

• Privacy policy: https://policies.google.com/privacy

Important: We do NOT sell your personal data to any third party. We do not

share your habit content, check-in records, or personally identifiable

information with advertisers or analytics providers.

5. DATA STORAGE AND SECURITY

• Local storage: your habit names, categories, frequency, reminder times,

and all check-in records are stored only on your device (Android Room

database). We do not and cannot upload them to any remote server.

• Remote transmission: only the following is sent to Google servers via

Google services — the advertising identifier (not including habit

content) and the install referrer parameter (not including personally

identifiable information).

• Security: we use industry-standard measures including transport

encryption (HTTPS/TLS) and Android system-level data isolation.

• Data loss: uninstalling the App permanently deletes all locally stored

data. We recommend using the in-App export feature (CSV) for backup.

6. CCPA / CPRA NOTICE (CALIFORNIA RESIDENTS)

We declare that:

• We do not sell personal data (now or in the past 12 months).
• We do not share personal data for cross-context behavioral advertising.
• We do not use sensitive data to infer characteristics.
• We do not perform automated decision-making with legal or significant

effects.

California residents' rights:

• Right to know — request disclosure of collected data categories.
• Right to delete — request deletion of your personal data.
• Right to correct — request correction of inaccurate data.
• Right to opt out — opt out of the sale or sharing of data.
• Right to limit — limit use of sensitive personal data.
• Right to non-discrimination — exercising these rights will not result

in discriminatory treatment.

Note: While we do not sell personal data, third-party ad partners (e.g.,

Google AdMob) may use your advertising ID for personalized advertising,

which may be considered a "sale" or "sharing" under California law. You

can opt out of personalized ads at any time via your device's ad settings

(Settings → Google → Ads).

To exercise your CCPA/CPRA rights, contact us via Section 14. We respond

within 45 days.

7. GDPR RIGHTS (EEA & UK USERS)

If you are in the European Economic Area or the UK, you have the right to:

• Access (Art. 15) — obtain a copy of your personal data.
• Rectification (Art. 16) — correct inaccurate data.
• Erasure (Art. 17) — request deletion of your data.
• Restriction of processing (Art. 18).
• Data portability (Art. 20).
• Object to processing based on legitimate interests (Art. 21).
• Withdraw consent at any time (Art. 7(3)).

We respond within 30 days of receipt; for complex requests, this period

may be extended by up to 15 additional days, with notice of the extension

and the reason for the delay.

You may also lodge a complaint with your local data protection authority

(https://edpb.europa.eu).

Most advertising data is processed directly by Google AdMob. Upon request,

we will assist you in contacting Google to exercise your deletion rights.

8. LGPD RIGHTS (BRAZIL USERS)

Brazilian users have the right to: confirmation of processing, access,

correction, anonymization/blocking/deletion, data portability, deletion of

consent-based data, information about data sharing, and withdrawal of

consent. Contact us via Section 14.

9. OTHER REGIONAL PRIVACY LAWS

We comply with applicable privacy laws worldwide, including China's PIPL,

Singapore's PDPA, Canada's PIPEDA, Australia's Privacy Act, Japan's APPI,

and South Korea's PIPA. We continuously monitor regulatory developments

and update this policy accordingly.

10. CHILDREN'S PRIVACY

This App is not directed to children under 13. We do not knowingly collect

personal information from children under 13. If we discover such data, we

will delete it immediately. Where the digital consent age is higher than

13 in your region (e.g., 16 under some EU laws), we comply with it.

11. DATA RETENTION PERIOD

• Local habit data: retained on your device as long as the App is

installed. Uninstalling permanently deletes it.

• Advertising identifier: processed by Google AdMob under its data

retention policies. You can reset your advertising ID anytime in device

settings.

• Install referrer parameter: not linked to any user profile; used only

for aggregate attribution statistics.

We follow the data minimization principle.

12. INTERNATIONAL DATA TRANSFERS

The advertising identifier and install referrer parameter may be

transferred to Google servers located outside your country/region. For

EEA/UK users, Google provides adequate safeguards via Standard Contractual

Clauses (SCC). We do not transfer your locally stored habit data to any

overseas server.

13. PRIVACY POLICY CHANGES

We may update this policy to reflect legal requirements or business

changes. For material changes (new data types, new purposes, new sharing

parties), we will re-seek your consent where required by law. Non-material

changes will be notified to you through the App.

14. CONTACT US

Email: 1007958770qq@gmail.com

Developer: YU CHEN

App: HabitAI — AI Habit Tracker

We will respond within a reasonable time (30 days under GDPR, 45 days

under CCPA).

© 2026 YU CHEN (HabitAI). All rights reserved.

This policy is published in English. In case of any discrepancy between

the English version and any translation, the English version prevails.