Privacy, with care.

1. Who we are

This policy explains how Duehabit at duehabit.com handles personal data in its website, mobile app, and connected services. The Duehabit team operates from Indonesia. Contact karimazizc@whisttle.com about this policy or your personal data.

We aim to collect information relevant to the features you choose and explain its purpose. Applicable privacy laws, including Indonesia’s Law No. 27 of 2022 on Personal Data Protection, may give you rights in addition to the choices described here.

2. Information we handle

• Account information. Firebase Authentication processes your email or provider identity and authentication credentials. Depending on what Apple or Google shares, we may receive a name, email, photo, and a unique account identifier. Our application server verifies Firebase tokens; it does not store your plaintext password.
• Onboarding answers. The app asks how you discovered Duehabit, your habit goals, and your age. Discovery and goals allow multiple choices. You may decline to provide your age. We do not ask for a birth date in onboarding.
• Content and settings. Habits, check-ins, profile details, reminders, and photos you choose to add. Some app data is stored locally on your device. When you use a connected feature, the necessary content may also be processed by the application server.
• Android beta list. If you sign up, we store your email address, Android platform, sign-up time, and consent version in our application database. We use this to manage beta access and contact you about testing. This list is private, and joining does not create an app account. Ask us to remove your entry or withdraw consent by emailing karimazizc@whisttle.com.
• Support and technical information. Information you send when contacting us, and necessary hosting or service logs such as request times, errors, and IP addresses.

3. Why we use it

We use account information to authenticate you and operate your account. We process content and preferences to provide the features you request, address support enquiries, maintain security, and meet applicable legal obligations.

We use onboarding answers to understand our community and improve our marketing, including which discovery channels bring people to Duehabit and which goals interest them. Providing these answers does not sign you up to a marketing email list. Your age is not displayed on your public-facing profile.

We rely on the appropriate lawful basis for each activity, such as fulfilling your requested service, consent where required, or legal obligations. You may contact us to ask about a particular use, object where applicable, or withdraw consent for processing that depends on consent.

4. Local storage and server storage

Unfinished onboarding answers are saved on your device so you can return to them. After sign-in, completed answers are sent to our FastAPI server and associated with your verified account identifier. If the save fails, a local pending copy remains available for a retry; that copy is cleared after a successful save.

The server keeps the original completed attribution record when a submission is retried. Existing members who skip the questions do not submit invented answers. Habit data in the current app is stored on the device under a separate key for each account. A local copy is not automatically a server backup.

We retain server information for as long as reasonably needed for its stated purpose, account operation, security, or legal obligations. You can request deletion. We may retain limited records where the law permits or requires it, and backup copies may remain until the relevant backup cycle expires.

5. Who receives information

We use service providers to operate the Service, including Google Firebase for authentication, sign-in providers you select, and infrastructure providers for hosting. They receive the information needed for their role. Choosing Apple or Google also involves that provider’s own privacy terms.

When you choose a connected sharing feature, the intended recipients may receive the content you share. We may disclose information where necessary to comply with the law, protect legitimate legal rights, investigate misuse, or carry out a business transfer with appropriate protections. We do not sell your onboarding answers.

Service providers may process data outside Indonesia. When cross-border transfer rules apply, we will use the safeguards required by applicable law.

6. Permissions, cookies, and the website

Camera, photo-library, contact, and notification permissions are requested for relevant app features. You can manage permissions in your device settings. Refusing a permission may prevent its corresponding feature from working.

This website does not add advertising trackers or analytics scripts. The habit preview and article filters run in the browser and do not submit your input to our server. Hosting or access-control services may use technically necessary storage or cookies. If optional tracking is introduced, we will update the policy and request consent where required.

7. Your choices and requests

Subject to applicable law and verification, you may request access to or a copy of your personal data, correction, deletion, restrictions on processing, or withdrawal of consent. You may also have rights to object or complain to the relevant authority. Contact karimazizc@whisttle.com and describe the request.

You can sign out, change device permissions, and remove local app data through your device. Removing the app does not by itself delete your Firebase account or server records. We may need to verify ownership before acting on an account request.

8. Security, children, and policy changes

We use access controls and authenticated API requests to protect account information. No storage or transmission system is completely secure. Please keep your device and sign-in credentials secure and contact us if you suspect misuse.

Where processing a child’s information requires parental or guardian consent, that consent must be provided before use. If you believe a child has provided data without required permission, contact us so we can investigate and take appropriate action.

We may update this policy when the Service or legal requirements change. The date above reflects the latest revision. We will provide additional notice or seek consent when required.