Data Processing Information for "ActionHabit"

Last updated: 2026-04-15

1. Controller and Contact

This page provides a technical overview of data processing around the ActionHabit app and the public website. It complements, but does not replace, the Privacy Policy.

Current contact path

  • Privacy: privacy@actionhabit.app
  • General support: support@actionhabit.app

2. Nature of processing

ActionHabit is described as a login-based, local-first product environment. Local persistence remains the basis; cloud and sharing paths extend that basis for sync, collaboration, and account assignment.

In this phase, the public website itself does not process productive account logic. It acts as an information, support, and legal surface.

3. Categories of processed data

Depending on usage, the product may process actions, habits, goals, notes, categories, completion states, shared contexts, as well as account and session information.

For NFC habits, relevant tag data is currently described as being used only in cryptographically derived form.

Local analytics and status data remain product-facing and are not intended as advertising tracking.

4. Recipients and infrastructure

Apple processes in-app purchases and platform-near account and iCloud infrastructure within its own systems.

CloudKit covers Apple-native sync and sharing paths.

Supabase is used for authentication, private sync paths, as well as Shared and People contexts.

In this phase, the website support search runs locally on curated text sources and does not send requests to an external support LLM.

5. Retention and deletion

Local data remains on the device until the user deletes it or removes it through an app reset.

When an account is deleted, associated Supabase data is removed through the dedicated delete-account path.

CloudKit or iCloud-related data remains governed by Apple and the settings of the relevant iCloud account.

6. Rights and questions

Questions about privacy, access, deletion, or correction can be directed to the currently published privacy contact.

As long as formal provider details for the website are still missing, email remains the public first contact path for privacy requests.