Privacy Notice

What we collect and why

• Account details (name, email address, login credentials, or a temporary guest identifier) — to create and secure your account. Legal basis: performance of our contract with you.
• Your habit data (daily habit entries, reflection notes, saved quotes, personal habits, challenge dates) — to provide the tracker, dashboard, calendar and exports. Legal basis: performance of our contract.
• Circle data (who you follow, who follows you, cheers you send) — only if you choose to use the Circle. Your reflection notes are never shared. Legal basis: performance of our contract.
• Connected app data (sleep and activity metrics from services you link, such as Garmin) — only after you connect them, to tick habits for you. Legal basis: your consent, which you can withdraw by disconnecting the app.
• Subscription records (plan, status, renewal date, payment outcomes) — to give you the right level of access and show your billing history. Legal basis: performance of our contract and our legal obligations.
• Technical data (IP address, device and browser information, error logs) — to keep the Service secure, prevent fraud and fix problems. Legal basis: our legitimate interest in a safe, working service.
• Support messages — to answer you. Legal basis: legitimate interest.

We do not sell your data, and we do not use your reflection notes for advertising.

Who we share it with

• Service providers who host and run the app on our behalf (cloud hosting, database, authentication and error monitoring).
• Paddle.com, our Merchant of Record, for the sale of Premium, subscription management, payments, invoicing and tax compliance. Paddle handles your payment details directly; we never see your card number.
• Services you connect yourself, such as Garmin, to the extent needed to read the metrics you asked us to read.
• Professional advisers (legal, accounting) and authorities where the law requires it.

International transfers

Some of our providers process data outside the European Economic Area. Where that happens we rely on an adequacy decision or on Standard Contractual Clauses approved by the European Commission, together with appropriate technical safeguards.

How long we keep it

We keep your account and habit data for as long as your account exists. If you delete your account, we delete or anonymise your data within 30 days, except records we must keep for legal or accounting reasons (invoices, typically 7 years). Guest test-run accounts and their data are removed automatically after a short period of inactivity.

Your rights

You have the right to access your data, correct it, delete it, restrict or object to its use, receive a portable copy, and withdraw consent at any time. You can export your entries yourself from the Export page. To exercise any other right, email support@thefirststephabittracker.com — we respond within one month. You can also complain to your national data protection authority; in Belgium that is the Data Protection Authority (gegevensbeschermingsautoriteit.be).

Security

We use appropriate technical and organisational measures: encryption in transit and at rest, row-level access rules so members can only reach their own data, hashed credentials, and restricted administrative access.

Cookies

We use only essential cookies and local storage: keeping you signed in and remembering your preferences. We do not use advertising or third-party tracking cookies. Our checkout provider sets its own essential cookies during payment. You can clear these at any time in your browser settings, though you will then be signed out.