Privacy policy

Controller

The controller for data processing at HabitHelm (habithelm.me, app.habithelm.me and the HabitHelm apps for Android and iPhone) is:

• beyond Agentur UG (haftungsbeschränkt)
• Managing director: Kersten Burkhardt
• Corveyer Ring 16, 31535 Neustadt am Rübenberge, Germany
• Email: info@habithelm.me

More details are in the imprint.

In short

• HabitHelm is a diary for food, drinks, exercise and body measurements. To do that we also process health data, and only so the app works for you.
• We do not sell data, show ads, or use tracking or analytics tools.
• The database, files and background functions run on Google Cloud in Frankfurt (region europe-west3).
• AI features use OpenAI. Only what a feature needs is sent to OpenAI.
• You can export your data and delete your account yourself at any time.

What data we process and why

Account and sign-in

You sign in with Google, Apple, or email and password. We process your user ID, email address, display name and, if available, the profile photo from the sign-in provider. After sign-in we set a session cookie (see below).

When you sign up with email and password or ask for a new password, we send you an email with a confirmation or reset link. We send these emails through Brevo, which receives your email address and the content of the message. Firebase stores your password only as a hash; we never see it.

Legal basis: Art. 6(1)(b) GDPR (providing the service you signed up for).

Diary, profile and health data

What you enter in HabitHelm is stored in your account, for example:

• meals, foods, drinks, water and alcohol
• date of birth, height, sex and goals, to calculate energy needs (BMR/TDEE) and targets
• body measurements such as weight, body fat, waist, blood pressure, heart rate and sleep
• journal entries, notes, your own foods and recipes including photos
• settings and in-app notifications
• favorite ingredients we count from your entries of the last 90 days, your corrections to them and recipes you no longer want suggested

Much of this is health data under Art. 9 GDPR. We process it only so HabitHelm can show, calculate and analyse your values.

Legal basis: your explicit consent under Art. 9(2)(a) and Art. 6(1)(a) GDPR. You can withdraw it at any time in the settings under Privacy. Processing before the withdrawal remains lawful. Without this data the diary features cannot be used.

Food search and barcodes

To search for foods and recipes, our servers use our own search index in our database (Google Cloud, Frankfurt) and query Open Food Facts. Only the search term or barcode is sent to Open Food Facts, no account data. The barcode scanner uses the camera on your device only; camera images are not uploaded.

Legal basis: Art. 6(1)(b) GDPR.

Connections to Garmin, Strava and Withings

When you connect a service, we fetch data from it, for example activities, steps, workout duration, calories burned, heart rate, weight and other measurements. For Strava this includes the start coordinates of an activity. The provider's access keys are stored securely in your account.

If you turn on "Send weight to Strava" in the settings, we write your latest weight to your Strava profile and nothing else. This only happens while the switch is on. Strava (Strava, Inc.) is based in the USA.

To estimate how much you should drink, we look up the weather for the start coordinates of an activity with the Google Maps Platform (Weather API). Only the coordinates and the time are sent.

Legal basis: your consent under Art. 9(2)(a) and Art. 6(1)(a) GDPR, given when you connect. You can disconnect at any time in the settings. Data stored at Garmin, Strava or Withings itself is covered by their privacy policies.

Apple Health (iPhone app)

When you connect Apple Health in the iPhone app, you decide separately what the app may read and write. We only read the types you turn on and allow in iOS: steps as daily totals, weight, sleep with sleep stages, and workouts with active calories. We store these values in your account so they appear in your diary, energy balance and reports. If you turn it on, the app writes the nutrients of your diary entries (energy, protein, carbohydrates, fat, saturated fat, fiber, sugar, sodium) to Apple Health on your iPhone.

We use data from Apple Health only for these features. We do not use it for advertising, do not sell it and do not share it with third parties. We only pass it to AI features if you explicitly allow this in the Apple Health settings. The app does not store health data in iCloud.

Legal basis: your consent under Art. 9(2)(a) and Art. 6(1)(a) GDPR, given in the app before the first import. You can disconnect at any time, revoke the permissions in iOS under Settings › Health, delete the imported data in HabitHelm, and delete the values HabitHelm saved to Apple Health. Data stored in Apple Health itself is covered by Apple's privacy policy.

Allergies and intolerances

If you store allergies (the 14 main allergens under EU law) or a lactose intolerance in Settings, we save this choice in your account. We only use it to mark products and recipes that contain these substances according to Open Food Facts and to leave such recipes out of your recipe suggestions. We do not pass it to AI features or to third parties.

Legal basis: your explicit consent under Art. 9(2)(a) and Art. 6(1)(a) GDPR, which you give separately when you first save. If you withdraw it in Settings under Privacy, we delete the stored information.

AI features (OpenAI)

Some features use OpenAI language models: daily insights and tips, the AI journal, tips about alcohol consumption, help with writing recipes, and texts when you first start the app. For this we send OpenAI the details a feature needs, for example daily values, goals or the recipe text. We do not send your email address or user ID; only the first-start texts use your display name. According to OpenAI, data from its API is not used to train its models.

AI texts are suggestions. They do not make decisions with legal or similarly significant effects for you (Art. 22 GDPR).

Legal basis: for health data your explicit consent (Art. 9(2)(a) GDPR); the AI journal asks you separately before first use. For recipe help your consent (Art. 6(1)(a) GDPR), which the recipe editor asks for before the first AI action. You can withdraw it under Settings → Privacy.

Friends, profile and public recipes

When you add friends, they see your display name, your profile photo and the content you share with them. Recipes you publish publicly are visible to everyone, also without signing in at habithelm.me/recipes, and can be found through search engines. For each recipe you decide whether it is private, friends only or public.

Legal basis: Art. 6(1)(b) GDPR.

Reporting and blocking

You can report other users' recipes and profiles and block people. For a report we store the reported content, the reason, your description, your user ID and the time. The report, including your email address, is emailed (Brevo) to info@habithelm.me so we can review it and reply to you if needed. The reported person does not learn who reported them. We keep the people you blocked in your account until you unblock them or delete your account.

Legal basis: Art. 6(1)(b) and (f) GDPR (protecting users from illegal and abusive content).

Security and server logs

When you use HabitHelm, our servers process technically necessary data such as IP address, time, requested URL, browser identifier and, when you are signed in, your user ID. We use it to provide the service, find errors and prevent abuse. To protect against automated attacks, Firebase App Check with Google reCAPTCHA Enterprise may check that requests come from the genuine app. Google processes device and browser data for this.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure and stable service.

Cookies and local storage

We only set cookies that are necessary to run the service (§ 25(2) no. 2 TDDDG). No consent is required for them.

• Session cookie ("__session"): keeps you signed in, up to 14 days
• Protection cookies against forged requests (CSRF) and for connecting Garmin, Strava and Withings: only for the duration of the process
• Language and individual display settings (for example "hh_locale")
• Android app notice ("hh_play_banner"): remembers for up to 90 days that you hid the notice, or for up to one year that you use the Android app, so it does not appear there

We keep individual display settings in your browser's local storage. So that your diary loads faster, your browser also keeps a copy of the data from your account you opened recently, for example diary days and settings (Firebase's cache in your browser's IndexedDB). It stays on your device and is deleted when you sign out or delete your account. The iPhone app keeps such a cache on the device as well. We do not set tracking, advertising or analytics cookies.

Android and iPhone app

The Android app opens app.habithelm.me in your browser (Chrome or another compatible browser) and does not store any user data itself; this policy applies. Installing through Google Play or the App Store is also subject to Google's or Apple's privacy terms. From them we only receive aggregated statistics, for example install numbers and crash reports not linked to your account.

The iPhone app reports crashes to Firebase Crashlytics (Google) so we can fix bugs. A crash report contains the device model, OS version, app version, the technical course of the crash and a random installation ID, but neither your user ID nor any diary content. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a stable app.

Service providers and recipients

We only pass data to service providers that process it on our behalf (Art. 28 GDPR), or to services you connect yourself:

• Google Cloud and Firebase (Google Ireland Limited, Ireland): hosting, database, files, sign-in, background functions, App Check, Weather API, iPhone app crash reports (Crashlytics). The database, files and background functions are located in Frankfurt.
• OpenAI (OpenAI Ireland Ltd., Ireland): AI features
• Brevo (Sendinblue SAS, France): sending sign-in and password emails and reports to us
• Open Food Facts (France): food database, without account data
• Garmin, Strava and Withings: only if you connect them
• Google and Apple: only if you sign in with them

Transfers to third countries

Google and OpenAI may also process data in the USA or other countries outside the EU. This is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, where the provider is certified, and on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Retention and deletion

We keep your data as long as you have an account. You can delete your account and all its data yourself at any time in the app, see Delete account. Publicly published recipes stay available without your name unless you choose to delete them too.

• Server logs are deleted after 30 days at the latest.
• A technical deletion marker with your user ID is removed 30 days after the account is deleted.
• To protect against data loss, we back up the database daily. Each backup is deleted automatically after 7 days, so deleted data also disappears from the backups no later than 7 days after deletion.
• Data we must keep for legal reasons is deleted when the retention period ends.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)).

You can export your data and manage your consents in the app under Settings → Privacy. For anything else, write to info@habithelm.me.

You also have the right to lodge a complaint with a data protection supervisory authority. Our competent authority is the Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany, lfd.niedersachsen.de.

Minimum age

HabitHelm is intended for adults. You must be at least 18 years old to create an account.

Medical disclaimer

HabitHelm provides information and guidance, not medical advice. For medical or nutrition questions, consult a qualified professional.

Changes

We update this policy when HabitHelm or the law changes. The date at the top shows the current version.