Privacy Policy

Wheel of Habits (“we”, “us”, the “Service”) is a habit-tracking web app at wheelofhabits.com. This policy explains what personal data we collect, why we collect it, how we use it, and your rights over it.

1. What we collect

Account data

• Email address — used to sign in, send password-reset links, and (rarely) service-critical notices.
• Display name — shown inside the app.
• Password — stored as a salted bcrypt hash. We never store or see your plaintext password.

Habit data you create

• Habit names, colors, order, and the dates you mark as completed.
• Optional notes attached to daily completions.
• Rewards you configure for yourself.

Usage & device data

• Basic access logs (IP address, timestamp, URL, user-agent) retained for security and abuse prevention up to 30 days.
• Analytics events via Google Tag Manager (page views, clicks, signups) to understand aggregate usage.
• Advertising cookies from Google Ads for measuring campaign performance (if you arrive via an ad).

Payment data (Pro users only)

Payments are processed by LemonSqueezy. We receive your email, order ID, and subscription status — we never see your card number.

2. How we use your data

• To operate the Service (let you log in, save habits, send reset links).
• To prevent abuse, debug issues, and secure accounts.
• To improve the product (in aggregate, via Google Analytics — we do not profile individuals).
• To measure the effectiveness of ads that brought you here.

We do not sell your data. We do not run ads inside the app. We do not use your habit data to train AI models.

3. Third parties we share data with

We do not share your habit entries with any third party.

4. Cookies

We use a minimal set of cookies:

• Authentication — stored in localStorage, keeps you logged in.
• Analytics — set by Google (Google Analytics / GTM / Ads) when you visit. These are optional in regions where consent is required.

5. Data retention

• Account + habit data: kept until you delete your account.
• Access logs: up to 30 days.
• Password-reset tokens: valid for 1 hour, purged after use.
• Billing records: retained as required by tax and accounting law (typically 5 years).

6. Your rights

Under GDPR (EU/UK), CCPA (California), and similar laws, you have the right to:

• Access a copy of the data we hold about you.
• Correct inaccurate personal data.
• Delete your account and associated habit data.
• Export your habits and completions as CSV from inside the app.
• Object to analytics / advertising processing.

To exercise any of these, email us at the address below and we'll respond within 30 days.

7. Security

Traffic is encrypted end-to-end via TLS. Passwords are bcrypt-hashed with a cost factor of 12. The database is access-controlled and hosted on a secured VPS. No system is perfectly secure — if we detect a data breach affecting you, we will notify you within 72 hours.

8. Children

The Service is not directed at children under 13 and we do not knowingly collect data from anyone under 13. If you believe a minor has created an account, email us so we can delete it.

9. International transfers

The Service is hosted in the United States. By using it, you consent to the transfer of your data to the US. Our third-party processors use standard contractual clauses where required.

10. Changes to this policy

When we make material changes, we will update the “Last updated” date above and notify active users by email where appropriate.

11. Contact

Questions, deletion requests, or data export requests? Email [email protected]. For general support, use [email protected].