Privacy

Halo Habit is operated by Halo Growth Hub, based in South Africa. For the purposes of POPIA we are the responsible party; for UK and EU GDPR we are the data controller. Questions, requests and complaints go to privacy@halogrowthhub.com.

Only what you put in, plus what is needed to run an account.

• Your account — email address, an optional display name, your time zone, and your theme.
• Recovery information — what you are counting days without, when a count started or restarted, and urges you logged.
• Health and mood information — your check-ins, including how safe you said you felt, the emotions you picked, what you said you needed, and anything you wrote alongside them.
• Your writing — notes, journal entries, prayers, Scriptures, goals, dreams and the links between them.
• Habits — what you track, when you kept it, and the days you marked as rest or sick days.
• Support details — the people you listed to contact, and your crisis plan.
• Calendar — if you connect one, the events it returns, so they can be shown next to your day.

There is no advertising in Halo Habit, no third-party analytics or tracking pixels, and nothing here is sold or shared for marketing. Ever.

Information about addiction, recovery and mental health is special personal information under POPIA and special category data under GDPR. It gets stricter treatment, and we only hold it on the basis of your explicit consent, given by choosing to enter it.

That consent can be withdrawn at any time by deleting the entries or your whole account. Withdrawing does not affect anything already done lawfully before you withdrew.

You, and nobody else, unless you deliberately share it. Every table is protected by row-level security, so one account cannot read another’s rows even if the application had a bug.

If you invite a supporter — a sponsor, a mentor, a family member — they see only what you tick, and you can revoke it instantly. They never see anything you did not choose.

We use these processors to run the service: Supabase (database and sign-in, hosted in Ireland), Vercel (running the application, served from Dublin), and Google (only if you connect a calendar, and only to read it).

AI features are off unless you turn them on. With them off, nothing you write ever leaves the database for a model.

With them on, the specific text needed for the feature you asked for is sent to the provider you configured — by default Anthropic, or another if you supplied your own key. Your notes are not used to train anyone’s model. You can turn AI off again at any time in settings, and any key you saved is encrypted before it is stored.

If you supply your own key for a third-party provider, that provider becomes a processor of your data on your instruction, and their terms apply to what you send them.

Until you delete it. Removing something in the app usually archives it rather than erasing it, so nothing you wrote about it is lost — an archived item is still yours and still deletable. Deleting your account removes everything permanently, including the archive.

Under POPIA and GDPR you can ask us to show you what we hold, correct it, delete it, hand it to you in a portable format, or stop processing it. Settings has an export that gives you everything in an open format immediately, and an account deletion that is permanent.

If you think we have handled your information badly, tell us first — but you can also complain to the Information Regulator of South Africa, or to your own data protection authority.

Halo Habit is not for under-18s, and accounts are not knowingly created for them. If you believe a child has an account, contact us and it will be removed.

Halo Habit is a tool for keeping track of your own life. It is not a medical device, it does not provide treatment or clinical advice, and it is not a crisis service. If you are in danger, contact your local emergency services or a crisis line — the app will always show you those alongside anything else it says.

If this policy changes in a way that affects what is collected or who sees it, you will be told inside the app before the change takes effect, not by a quietly updated date at the top of a page.