Privacy Policy

Who we are

VerifyHabit is operated by Peter Buchlak (sole proprietor), who is the data controller for the processing described here. Contact: support@verifyhabit.com.

The short version

VerifyHabit verifies your habits using data that stays on your iPhone. We read health and Screen Time signals on-device, only with your permission, and only to decide whether a habit was completed. Your account is a Sign in with Apple identity; what our server sees is limited to verification outcomes and billing state. We do not sell your data. We do not share it with advertisers or data brokers. The app contains no analytics or tracking; this website uses Plausible, a cookieless analytics service that records only aggregate visit counts — nothing tied to you.

What the app reads, and where it stays

Depending on which habits you set up, VerifyHabit asks for permission to read:

• Health data (Apple HealthKit): workouts and heart rate, step counts, and sleep — used to confirm habits like "Workout 30 min" or "Sleep 7 h".
• Screen Time data (Apple's Device Activity and Family Controls frameworks): whether you stayed within an app limit or kept a phone-free window — used to confirm discipline habits. Apple's Screen Time system reports only threshold events to the app; VerifyHabit never sees a list of the apps you use or your browsing activity.
• Motion at alarm time: enough movement signal to confirm you are up when the morning alarm fires.

All of this raw data is read and evaluated on your device. Raw health samples, workouts, sleep records and Screen Time activity are never uploaded to our servers.

What leaves your device

When you sign in (Sign in with Apple) and sync is on, the app sends our server:

• Your account identity — the identifier and email address provided by Sign in with Apple. Apple lets you hide your real address and share a private relay address instead.
• Your habit definitions — for example "Workout 30 min · hard" and its target.
• Daily verification outcomes — verified, missed or pending per habit per day. Outcomes only: the measured values (heart rate, steps, hours slept) and evidence details stay on the device.
• Weekly consistency scores and the price tier you earned — the billing arithmetic.
• Your subscription record — App Store transaction identifier, product, current tier and renewal date, so your earned discount is applied to the right subscription.
• A push notification token, if you allow notifications — used only to tell you when your earned rate changes.

This is verification bookkeeping, not health data: no heart rates, no sleep records, no app usage ever leaves your device.

What we store

Exactly the list above — account identity, habit definitions, daily outcomes, weekly scores, subscription record and push token — and nothing else. We keep it only as long as you have an account. Payments are processed entirely by Apple through the App Store; we never see or store your card or bank details.

Who we work with

• Apple — Sign in with Apple, App Store payments and push notification delivery, under Apple's own privacy terms.
• Plausible — cookieless, EU-hosted website analytics. It counts page views in aggregate and cannot identify you.
• Supabase — hosts our database and authentication in the European Union. Your synced data lives in Supabase's EU infrastructure and is protected by row-level security scoped to your account; it is not transferred outside the EU by us.

That is the whole list. No analytics providers, no ad networks, no data brokers.

What we never do

• Sell your data — to anyone, ever.
• Share your data with advertisers, brokers or "partners".
• Run ad SDKs, tracking pixels or cross-site analytics. (The website uses cookieless, aggregate-only Plausible analytics — no personal data, no profiles.)
• Use your health data for anything other than verifying the habits you chose.

Your controls

• Revoke Health access at any time in Settings → Privacy & Security → Health.
• Revoke Screen Time access at any time in Settings → Screen Time.
• Delete your account directly in the app (Profile → Delete account). This removes your habits, scores, subscription record and account data from our servers.
• Access or export your data — email us and we will send you a copy of everything our server holds about your account.

If you are in the EU/EEA or UK, these are also your GDPR rights (access, rectification, erasure, portability, objection), and you can lodge a complaint with your local data protection authority.

If you revoke a permission, the affected habits honestly show as unverifiable — the app never fakes a result, and it never punishes you with dark patterns for saying no. It simply can't count what it can't prove.

Children

VerifyHabit is not directed at children under 13 (or the equivalent minimum age in your country) and we do not knowingly collect data from them.

Changes to this policy

If this policy changes in a way that matters, we will say so in the app before the change takes effect — plainly, not buried in a changelog.

Contact

Questions? Email support@verifyhabit.com.