Privacy & Support · Habits First

Habits First blocks apps and websites on your own devices and gives them back when you hit goals you set for yourself. This policy explains what the app reads, what stays on your device, what syncs between your devices when you sign in, and what reaches our server. It covers the iPhone, iPad, Android, Mac and Linux apps.

The short version: your Screen Time data, what you do in the app, and your health data never leave your device. We cannot see them. If you sign in, your blocks, habits and unlocks are copied to our server so your devices agree, and that is all.

What Stays On Your Device

The following is read or stored only on your device, and is never transmitted to us:

Which apps you block, and how long you use them. On iPhone and iPad this comes from Apple's Screen Time system (Family Controls and Device Activity), which keeps the list of apps and your usage inside a sandbox on the device; it is not technically possible for us to export it. On Android, Mac and Linux the app reads which apps are installed and running on that device for the same purpose. In every case the list of apps and the usage figures are used only to shield the apps you picked and to show your own usage back to you.
Health data. If you create a goal based on steps, workout minutes or mindful minutes, the app reads those values from Apple Health or Health Connect. They are used to decide whether you have met your goal, and cached on your device so the lock screen can show progress. The raw records are never uploaded, never sold, never used for advertising or marketing, and never shared with anyone; if you sign in, only the day's total for a goal syncs (see Syncing below).
Credentials for services you connect. If you connect Audiobookshelf, Jellyfin, an Anki sync server, AnkiWeb, KOReader or a WebDAV folder, your logins for them are held in your device's keychain and are never sent to us; the app talks to those services directly from your device. Which service is connected, and the address or username it points at, syncs with your account so your other devices can use it (see Syncing below).
Location and Bluetooth. If a block activates at a place or near a device, the matching happens entirely on your device. We never receive your location, and we never receive the identity of your Bluetooth devices.
Website blocking (Android). To block a website, Habits First needs to know which site your browser is showing. On Android that takes the Accessibility permission: the app reads the web address in your browser's address bar, and nothing else on the screen. It only looks at browsers, it keeps no history of the sites you visit, and the address never leaves your phone. The permission is off until you turn it on in Android's settings, and the app explains this before it sends you there. Turn it off at any time under Settings > Accessibility.

Syncing Between Your Devices

Signing in is optional, and the whole app works without an account. By signing in, you are choosing to have the data below stored on our server, because syncing cannot work without it. At any point, you can "Delete sync data", or deleting your account. If you sign in on more than one device, Habits First keeps them in step by storing the following on our server, tied to your account:

Your blocks and habits. Their settings: names, goals, schedules, and whether a block is enabled or locked. This lets us sync your habit trackers and unlock conditions across all your devices. On iPhone and iPad Apple does not let us see or export your blocked apps, so you will have to reselect blocked apps on iOS devices.
Your progress. Daily totals only: which habits you completed each day, and the day's count for whatever your goals track. This is to keep the habit trackers in sync.
Unlocks. What is unlocked and until when, how many unlocks you earn and spend each day.
Connected services. Which integrations you have connected and the account or server they point at. Logins and passwords stay in your device's keychain and never sync. A paired KOReader e-reader reports its daily page count under a random pairing code. This works even without an account, and the code is not tied to you.
Settings. Your app settings are stored and synced. Your block password is stored only as a cryptographic hash that nobody can reverse, including us.
Your devices. Each device's basic identification information, when it last synced, and its push token, so changes on one device can wake the others.
Sign-in details. Your email address and a random account ID, plus the name Google or Apple passes if you sign in with them. You can change that name in the app.

Signing out on a device removes the account data from that device and stops syncing; the copy on our server stays for your other devices. "Delete sync data" in Settings removes every synced record from our server immediately. Everything on our server is encrypted at rest and in transit. If you never sign in, we hold nothing about you apart from the anonymous tally above, which names nobody.

We keep an anonymous tally of app opens and build information. The reason we do this is so we know if there are issues with the app. It cannot be traced to you and is used only to help improve the app. We do not build a profile of you, we don't track you across websites, and this information will never be sold. We do not use advertising, and we never sell, rent or trade your information.

How We Use It

Only to operate the app: to sign you in, and to keep your blocks, habits, progress and unlocks consistent across your devices. We do not read your synced data except to fix a problem you ask us about. We do not use your information for advertising or marketing, and we do not sell, rent or trade it.

Email Updates

If you give us your email address to hear about new versions, we store the address and nothing else, and we only use it to send those updates. You have to confirm the address by clicking a link before we send you anything. Every email has an unsubscribe link that works in one click, and we do not track whether you opened it. Ask us and we will delete the address.

Who Else Is Involved

Supabase hosts our database and handles sign-in, processing the account and sync data described above on our behalf.
OpenStreetMap. When you pick a location for a place block, the map tiles come from OpenStreetMap's servers, so they receive the map area you look at, like any map app. The place you choose is saved on your phone only.
Amazon Web Services delivers our email updates. They handle the address and the message in order to send it, and nothing else.
Google and Apple, if you choose to sign in with them, tell us your email and name under their own privacy policies. We receive nothing else from them.
Services you choose to connect (Audiobookshelf, Jellyfin, Anki, AnkiWeb, KOReader, Chess.com, GitHub) are contacted directly by your device. We are not in the middle and never see that traffic. For Chess.com and GitHub the app reads your public activity using the username you enter, and that username syncs with the block that uses it. Anything you host yourself remains governed by you; other services are governed by their own privacy policies.

Otherwise we disclose information only where the law requires it.

If You Contact Us

The contact page on this site and the Feedback screen in the app send us what you write, plus your email address if you choose to give one. Feedback sent from inside the app also carries a short diagnostics footer so we can reproduce a problem: your device's name and model, operating system version, app version and whether Habits Pro is active, language and time zone, whether Screen Time and Health access are granted, how many blocks and habits you have, whether you are signed in, and which integrations are connected. It contains no usage data, no health values and no account details. Screenshots you attach are stored with the message. Messages are kept until we have dealt with them and go nowhere else; we never use an address you give us for marketing. To stop the form being flooded, the server keeps a salted hash of the sending IP address for one day; the address itself is never stored.

Children

Habits First is a self-management tool for the person using the device. It is not directed at children under 13, and we do not knowingly collect information from them.

Keeping It, And Deleting It

If you never sign in, we hold nothing about you apart from the anonymous tally above, which names nobody. If you do, we keep your account and synced data until you delete it. "Delete sync data" in Settings removes the synced records at once. "Delete account" on the Account screen removes the account itself and everything attached to it; if your version of the app does not have that button yet, ask through the contact page and we will do it. Deleting the app removes everything held on that device.

Your Rights

Ask what we hold about you
Ask us to correct it
Ask us to delete it
Withdraw consent by signing out or deleting the app
Revoke Health, Screen Time, usage access, location or Bluetooth permissions at any time in your device's settings

Changes

If this policy changes, the revised version will be posted here with a new date. Changed on September 11, 2026: added the Android website-blocking permission and OpenStreetMap map tiles. Changed on September 1, 2026: described the anonymous tally of app opens, added a section on email updates, and made explicit that signing in is the choice to store sync data; rewrote the synced-data list to plainly cover integration and Health-derived daily totals, connected-service identifiers, daily unlock counts, device push tokens, and paired e-reader page counts. Changed on August 26, 2026: added the Syncing section for the multi-device release, covered the Android, Mac and Linux apps, described what the contact page and in-app Feedback send us, and noted the in-app Delete account option.

Contact

Questions, or a deletion request: use the contact page.

Support

What the app does

Habits First blocks apps you choose, and gives them back when you hit a goal you set for yourself: steps, a workout, minutes read or listened to, Anki reviews, or habits checked off. Earned unlocks are banked, and you spend one whenever you decide to.

Common questions

Why does the widget number not match Screen Time?
It is not meant to. The widget counts only the apps your blocks watch, not your whole device, and it counts in five minute steps, so it reads low. Apple does not let apps export your real Screen Time totals.

A goal says zero, but I did the activity.
Open iOS Settings, then Privacy & Security, then Health, then Habits First, and check that the category is switched on. Apple deliberately hides whether an app was granted read access, so the app cannot tell the difference between "no permission" and "nothing done yet" until it has seen at least one sample.

Does a workout tracked by another app count?
Yes. Anything that writes a workout to Apple Health counts, including Strong, WHOOP, and Apple Watch. If two of them record the same session, the overlapping time is counted once, not twice.

My self hosted server says unreachable.
Habits First talks to Audiobookshelf, Jellyfin, and Anki directly from your device, so the device has to be on the same network or VPN as the server. Check the address and port, and that you are connected.

I forgot my block password.
Passwords are stored only as a cryptographic hash and cannot be recovered by anyone, including us. Each install has a small number of lifetime emergency unlocks for exactly this, shown in Settings under Security.

How do I delete my data?
Deleting the app removes everything stored on the device. If you signed in, email the address above and your account and its records will be removed.

Privacy

Your Screen Time and health data never leave your device. The full policy is at habitsfirst.com/privacy.

Anything else: the contact page.