Habitcount Privacy Policy
Effective date: 24 September 2026
Last updated: 1 October 2026
This policy explains what information the Habitcount app and its servers collect, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. It applies to the current Habitcount app for iOS and to the servers that support it. Android is not part of this release.
If you live in Washington, Nevada or another place with a law specific to health data, please also read our Consumer Health Data Privacy Policy (https://apps.iesllc.ge/app-e7f4e392/legal/health).
The short version
- No account needed. Without an account, your counters and entries are stored only on your phone. We never receive them.
- Accounts are optional and only for backup, sync and friend challenges. If you create an account, we store your counters and entries on our server so we can back them up and sync them to your other devices. Some habits, such as smoking, drinking, medication or calories, can reveal things about your health. So we ask for your separate, explicit consent before we sync anything.
- Friend challenges are opt-in. Only if you challenge a friend on a counter, or accept a friend's challenge, do you and that friend see each other's chosen name and daily totals for that one counter, counted from the day the challenge started. Nothing else is shared, and either of you can stop the challenge at any time.
- No ads, no tracking, no selling. We don't show ads, we don't sell your personal information or share it for advertising, we don't track you across other apps or websites, and the app contains no third-party analytics or advertising SDKs.
- Usage statistics are off by default; you can turn them on. They are a short list of events like "counter created", never what you count. The app disables them when its phone-only mode is triggered by an EU, EEA, UK or Swiss phone or App Store region signal.
- Payments go through Apple. We never see your card details.
- You're in control. You can delete your account in the app at any time. Your synced data is then permanently deleted from our live database within 72 hours (backups expire later, see section 7).
1. Who we are
Habitcount is published by Intelligent Energy Solutions LLC, a limited liability company registered in the country of Georgia by the National Agency of Public Registry under identification number 445839816, with its registered address at 58 St. Andrew the First-Called Highway, Apartment 605, Block III, Batumi, Georgia ("we", "us", "our").
For information we process on our servers, we are the controller (the organisation that decides how and why it is used).
- Privacy questions and requests: ilia.kamyshev@iesllc.ge
- General support: ilia.kamyshev@iesllc.ge, or You → Contact support in the app
- Privacy contact: Ilia Kamyshev, Director, ilia.kamyshev@iesllc.ge. We have not appointed a separate data protection officer.
- If you are in the EU, EEA, UK or Switzerland: Habitcount is designed to use a phone-only mode when either the phone or App Store region indicates one of these places. See section 9.2
2. What we collect
What we collect depends on how you use Habitcount.
2.1 Using Habitcount without an account
Everything you create stays on your device, in a local database inside the app:
- your counters (name, emoji, colour, type, unit, step size, goals and an optional price);
- your entries (date and time, amount, time zone, and an optional note and price);
- templates you create and your settings;
- a random device ID and the date you first opened the app. The app creates these itself and keeps them in your device's secure storage. The device ID is a random number. It is not derived from your hardware and cannot be used to identify your phone in other apps.
We do not receive any of this unless you create an account and agree to sync (section 2.2), contact support (section 2.3), or unless usage statistics are on (section 2.4).
A small amount of information still reaches our server when you use the app without an account:
- Exchange rates. To show what a habit costs in your currency, the app downloads currency exchange rates from our server up to twice a day. The request contains no counters, entries or identifiers. Like any internet request, though, our server sees your IP address and basic technical details such as the time of the request. Our server gets the rates once a day from a public exchange-rate service (open.er-api.com). No information about you is ever sent to that service.
- App configuration. Future versions may also download general settings from our server, such as the minimum supported app version. These requests work the same way as the exchange-rate requests.
Habitcount 1.0 does not schedule reminders or collect a push-notification token.
2.2 If you create an account (backup and sync)
You can create an account with Sign in with Apple or email and password. We then collect:
| Category | What exactly |
|---|---|
| Sign-in details | Your email address. If you use Sign in with Apple and choose "Hide My Email", this is an Apple relay address. We also store your sign-in method, the unique ID that Apple gives us for you, and your name if Apple provides it and you allow that. For each Apple sign-in authorization, we encrypt and store the Apple refresh token so we can revoke that authorization when you delete your account. We do not store your Apple password. |
| Password (email accounts only) | We never store your password. We store a one-way Argon2id hash of it with a random salt, so the password cannot be read back from the hash. When you choose a password, our server checks it against passwords known from data breaches using the Have I Been Pwned service. Only the first 5 characters of the password's SHA-1 fingerprint are sent, which cannot identify the password or you. We also store whether and when you verified your email address, and a count of recent failed sign-in attempts with a temporary lock time, to protect you against password guessing. |
| Verification codes and reset links | For email accounts we send a 6-digit verification code, which expires after 24 hours, and password-reset links, which expire after 30 minutes. The token table stores hashes; the short-lived delivery job holds an encrypted copy until the email is sent and the job is pruned. Our email provider receives the message so it can deliver it. |
| Sessions | Hashed sign-in ("refresh") tokens, each linked to the device ID that signed in, with their creation, expiry (60 days) and revocation times. |
| Registered devices | The app's random device ID, platform (iOS), app version, operating-system version, time zone and when the device last connected. |
| Synced counters and entries | Everything listed in section 2.1 that you choose to sync: counter details including goals and prices, and entries with date, time, local day, time zone, amount, how the entry was made (for example a tap or a manual entry), optional note (up to 280 characters) and optional price. We also store your own templates and daily totals we calculate from your entries (number of entries, total amount, first and last time of the day, and whether a goal was met). |
| Settings | Language, time zone, when your day starts, which day your week starts, default currency, haptics, sounds and appearance, and the date you first opened the app, which is used for the free period. |
| Friend challenges (only if you use them) | When you challenge a friend: a random link code, which of your counters it is for, a copy of that counter's name, emoji, colour, type, unit and goal, and when the link expires (30 days after you last shared it). When you or a friend accept a challenge: which two counters are paired, who invited whom, when the challenge started and, if it was stopped, when and by whom. The name you choose for challenges is stored as your display name. See section 3.1 for what your friend sees. |
| Subscription status | See section 2.5. |
| Account-deletion receipt | If you request account deletion, we keep your account's random ID and the time of your request in a limited-retention receipt. We also encrypt this minimal record and store a separate copy so that an older backup cannot accidentally restore your deleted account. It contains no counter names, entries, notes or health details. |
When you use Sign in with Apple, our server checks Apple's signed sign-in token and exchanges Apple's single-use authorization code with Apple. We do not receive your Apple password.
Security data. To stop abuse, our server keeps your IP address, and for email sign-in your email address, in memory for up to 24 hours. It uses them to count repeated attempts, for example too many sign-in or password-reset attempts. They are not written to our database.
2.3 If you contact support
The in-app support form sends us:
- the topic you pick, your message (up to 2,000 characters) and the reply-to email address you enter;
- always: the app's random device ID, the app version, your platform (iOS) and, if you are signed in, your account ID;
- diagnostics, unless you switch them off before sending: device model, operating-system version, number of counters and subscription status.
The form never attaches your counter names, entries, notes or amounts. We store the ticket on our server and email it to our support inbox, with your address as the reply-to. The conversation then continues by ordinary email. Please don't include health details in your message unless you need to.
2.4 Usage statistics (only if you turn them on)
The setting "Share usage statistics" (You → Data) is off by default. You can turn it on or off at any time. If your three bonus days (the free period) have ended, the subscription screen still offers
"Turn off usage statistics" when this setting is on. Turning it off also deletes any unsent usage events on your phone; events already received by us follow the retention period in section 7. The events are pseudonymous, not anonymous: they carry a random device ID. While it is off, the app does not record or send usage events. Phone-only mode also blocks them, whatever the setting says (section 9.2). Region signals may not reflect where you actually live.
While it is on, the current app may send us events from a fixed list of nine names: template selected, counter created, first tap, paywall viewed, paywall dismissed, trial started, purchase completed, sign-in and free period expired. We do not record a first-launch event before you opt in, or claim that an App Store rating prompt was displayed when iOS may not show it. Each event includes its time, the app version, your platform and the app's random device ID. It may also include a few fixed details, such as which plan you picked or which sign-in method you used. If you are signed in, events are linked to your account.
Usage events never contain note text, amounts, counter names or anything you type. We use them only to understand how the app is used, for example how many people finish setting up their first counter, and to improve it. You can turn the setting off at any time. The app then stops sending events.
2.5 Subscriptions and payments
Habitcount Pro is sold through the Apple App Store. Apple processes your payment, and we never receive your card number or billing address.
We use RevenueCat to confirm purchases and track subscription status. Before you sign in, RevenueCat knows you only by a random anonymous ID. After you sign in, it is linked to your Habitcount account ID. We receive and store:
- the product you bought, the store, your subscription status (for example trial, active, in a grace period or expired), when the trial or current period ends, whether it will renew, and the store's original transaction ID;
- the purchase events RevenueCat sends us about your subscription. These can include the price and currency, the country of your store account, transaction IDs and dates.
2.6 What we do not collect
- No location. We use your time zone only to put entries on the right day.
- No contacts, photos, camera, microphone or files.
- No advertising ID (IDFA), and no device fingerprinting.
- No data from Apple Health or other apps.
- No browsing history, no session recording or replay, and no third-party analytics, crash or advertising SDKs in the app.
- The app does not use cookies. The fonts are built into the app and are not downloaded from Google or anyone else.
3. Health-related information
Habitcount is a counting tool, and you decide what to count. Some counters can reveal information about your health or habits, for example cigarettes, alcoholic drinks, pills or medication, calories, water, caffeine, exercise or meditation. The notes you add to entries can do the same. We treat all synced counters, entries, notes and the statistics derived from them as potentially health-related, including "data concerning health" under the EU and UK GDPR and "consumer health data" under US state laws.
- Without an account, this information never leaves your device.
- Before we sync it, we ask for your separate, explicit consent with a clear statement: "Store my counters on Habitcount's servers so they sync. They may include health-related habits." This consent is separate from accepting this Privacy Policy or our Terms of Use. If you don't give it, you can keep using Habitcount without sync.
- We use it only to provide the service you asked for: storing, syncing and showing your own counters and statistics, and, if you start or accept a friend challenge, showing that friend your totals for that counter (section 3.1). We don't use it for advertising or marketing. We don't sell it, and we don't share it except with the service providers that host our systems (section 5) and with friends you choose to challenge (section 3.1). We don't use it to make decisions about you or to infer anything about your health.
- Withdrawing consent. You can withdraw your consent at any time by signing out and deleting your account (You → Delete account). We then stop syncing, and your synced data is deleted as described in section 7. Withdrawal does not affect sync that already happened.
3.1 Friend challenges
Friend challenges let you compare one counter with friends. They are off until you use them, and they need an account with sync, because the totals go through our server.
- Starting a challenge. In a counter's menu, Challenge a friend makes a link for that counter, which you send with the iOS share sheet to whoever you choose. Anyone who has the link can see the counter's name, emoji and goal, and the name you chose for challenges. The first time, the app shows exactly what a friend will see and asks you to confirm, and to choose the name friends see.
- Accepting a challenge. Opening a link shows who sent it, the counter and what will be shared, with Accept challenge and Not now. Nothing is shared unless you accept.
- What each of you sees. Once a friend accepts, you and that friend see, in that counter's Stats, each other's chosen name, the total amount per day for that one counter summed over the days picked (today, 7, 30 or 90 days, or all), and on how many of those days something was logged. A friend's totals count only from the day the challenge started, never from before. Your individual entries, times, notes, prices, other counters and email address are never shared.
- Stopping. Either of you can stop a challenge at any time by swiping the friend away in the counter's Stats. From then on neither of you sees the other's totals. Deleting the counter or your account also ends its challenges.
- Legal basis. Sharing your totals with a friend is based on your explicit consent, which you give by starting or accepting a challenge after seeing what will be shared (Art. 6(1)(a) and Art. 9(2)(a) GDPR). Stopping the challenge withdraws it.
4. Why we use information, and our legal bases
The table below lists the legal bases we rely on under the EU and UK GDPR. Similar bases apply under the Law of Georgia on Personal Data Protection.
| Purpose | Information used | Legal basis |
|---|---|---|
| Creating your account, signing you in, keeping sessions, sending verification codes and password-reset emails | Sign-in details, password hash, sessions, registered devices | Performance of our contract with you (Art. 6(1)(b)) |
| Storing, backing up and syncing your counters and entries | Synced counters, entries, notes, templates, settings, derived statistics | Performance of our contract with you (Art. 6(1)(b)). For health-related information, your explicit consent (Art. 9(2)(a)) |
| Protecting accounts and our service: rate limits, lockouts, abuse prevention, security | IP address, email address, device ID, failed-attempt counts | Our legitimate interest in keeping accounts and the service secure (Art. 6(1)(f)) |
| Honouring account-deletion requests even after recovery from an older backup | Account ID and deletion-request time | Our legitimate interest in preventing deleted accounts from being restored (Art. 6(1)(f)) and, where applicable, our legal obligation to honour deletion requests (Art. 6(1)(c)) |
| Serving exchange rates and app configuration | IP address and request data, used only to deliver the response | Our legitimate interest in providing app features (Art. 6(1)(f)) |
| Answering support requests | Ticket contents, reply-to email, device ID, app version, platform, diagnostics, account ID | Our contract with you when the request concerns your account or subscription (Art. 6(1)(b)), otherwise our legitimate interest in helping you (Art. 6(1)(f)) |
| Managing subscriptions and access to Pro features | Subscription status and purchase events | Performance of our contract with you (Art. 6(1)(b)). Keeping records where the law requires it (Art. 6(1)(c)) |
| Friend challenges: showing a friend your chosen name and daily totals for one counter | Challenge links, pairings, display name, daily totals for the challenged counter | Your explicit consent (Art. 6(1)(a) and Art. 9(2)(a)), given when you start or accept a challenge; withdrawn by stopping it |
| Usage statistics | Usage events, device ID, account ID | Your opt-in consent (Art. 6(1)(a)); you can withdraw it at any time by turning the setting off. Also blocked when the app detects a phone-only region. Detection may be inaccurate. |
| Complying with the law and defending legal claims | Any relevant information | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)). For health-related information, Art. 9(2)(f) |
Where we rely on legitimate interests, you can object (section 9). We do not use automated decision-making that has legal or similarly significant effects on you, and we do not profile you.
We send only service emails: verification codes, password resets and replies to your support requests. We do not send marketing emails.
5. Who we share information with
We do not sell your personal information. We do not share it for cross-context behavioural advertising or targeted advertising, and we don't give it to data brokers.
We use a small number of service providers (processors). They handle data only on our instructions and only to run Habitcount:
| Provider | What they do | What they receive | Location |
|---|---|---|---|
| 3HCloud (server hosting) | Runs our server and database, and holds a local backup copy | All server-side data described in section 2 | Poland (EU) |
| Cloudflare R2 (off-site recovery storage) | Holds a nightly database backup and a separate minimal deletion-request ledger, both encrypted before upload; Cloudflare does not have the decryption key | Encrypted database copy and encrypted account ID/request-time records | European Union jurisdiction |
| Tucows (hosted email for iesllc.ge) | Holds our mailbox | Emails you send us and our replies | Canada |
| RevenueCat, Inc. | Confirms purchases and tracks subscription status | App user ID (anonymous, or your account ID after sign-in), purchase and subscription records, and the technical details needed to validate purchases | United States |
Independent companies with their own privacy policies:
- Apple (App Store and Sign in with Apple) processes payments, store accounts and Apple sign-ins under its own privacy policy. We receive from them only what is described in section 2.
- open.er-api.com (the exchange-rate service) receives no personal information. Our server simply downloads the day's rates.
Friends you challenge. If you start or accept a friend challenge, that friend sees your chosen name and your daily totals for that one counter from the day the challenge started, as described in section 3.1. Anyone you send a challenge link to can see the counter's name, emoji and goal and your chosen name. We don't share anything else with them.
Other disclosures. We may disclose information when the law requires it, for example to answer a valid court order. We may also disclose it to protect the rights, safety or property of our users or others, or as part of a merger, acquisition or sale of assets. In a sale, we will tell you in advance, and this policy or an equally protective one will continue to apply. We will not share your information for any other purpose without your consent.
6. International transfers
We are based in the country of Georgia. Our server is located in Poland, in the European Union, and some service providers, including RevenueCat, are in the United States. Your information may therefore be processed outside the country where you live.
When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland to a country that does not have an adequacy decision, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or rely on the recipient's certification under a recognised framework. Our server is in the EU, so hosting needs no transfer safeguard; Canada, where our mailbox is hosted, has an EU adequacy decision; for RevenueCat in the United States we rely on the Standard Contractual Clauses in its data processing agreement. You can ask us for a copy of these safeguards using the contact details in section 12.
7. How long we keep information
| Information | How long we keep it |
|---|---|
| Data on your device | Until you delete it or delete the app. Deleting your account does not delete the data on your phone. |
| Account, synced counters, entries, templates, settings and registered devices | Until you delete your account. After you ask to delete it, it is permanently deleted from our live database within 72 hours. We schedule deletion at 71 hours to allow time for processing. Until deletion completes you are signed out everywhere and the account cannot be used. |
| Habitcount session refresh-token hashes | A session token expires after 60 days. We keep its hash through expiry to detect reuse of a rotated token, then delete the record seven days after expiry. Deleting your account removes these records sooner. |
| Apple sign-in refresh tokens | Stored encrypted while your account exists. When you ask to delete your account, we request revocation of every Apple authorization token we hold. We keep an encrypted copy only while a revocation needs to be retried, then delete it after Apple accepts the request. A failed revocation is monitored for follow-up. |
| Friend challenge links and pairings | A link stops working 30 days after you last shared it. Challenges and expired links are kept until the counter or your account is permanently deleted (see the rows above and below), so a stopped challenge can't reappear on another device. They contain no entries or totals; totals are calculated when a friend's Stats are shown. |
| Items you delete while keeping your account | Marked as deleted so your other devices can remove them too, then permanently removed 90 days later. |
| Verification-code and reset-link records | Hashes are deleted 7 days after they expire. Records of the email-sending job, which contain your email address and the code or link, are deleted automatically about 7 days after the email is sent. |
| Support tickets | 24 months after you send them, then deleted automatically. Tickets you sent while signed in are deleted sooner, with your account. |
| Usage statistics (while the setting is on) | 13 months, then deleted. |
| Subscription status | Deleted with your account. When your account is permanently deleted, we also ask RevenueCat to delete its subscriber record. Apple keeps its own purchase records under its own policies. |
| Purchase events received from RevenueCat | 3 years after we receive them, then deleted automatically. We keep them to document purchases and resolve billing disputes. When you delete your account, we remove the direct account link, but the retained event may still contain a RevenueCat subscriber ID or Apple transaction ID and therefore may remain identifiable. We do not treat these records as anonymous. |
| Security data in memory (IP address, email for rate limits) | Up to 24 hours. |
| Server access logs | 14 days. They record the IP address, time, and page or API address of each request, and are used only to keep the service running and secure. |
| Backups | Nightly database backups are kept on our server in Poland and, encrypted before upload, in Cloudflare R2's European Union jurisdiction. Both copies are deleted after up to 30 days. Data you delete may remain in older backups until they expire. If we ever restore a backup, we will delete again anything that was deleted after the backup was made. |
| Account-deletion receipts | We keep the account ID and request time in our live database and an encrypted, separate recovery ledger for about 45 days after the request, long enough to cover the life of an older backup. We then delete these records on their respective scheduled retention cycles. They contain no counter content. |
We may keep information longer where the law requires it or to establish or defend legal claims. We keep it only for that purpose.
8. How we protect information
- All traffic between the app and our server is encrypted (HTTPS/TLS).
- Passwords are stored only as salted Argon2id hashes. Habitcount session refresh tokens are stored as hashes. Apple sign-in refresh tokens, which must be available to revoke, are stored encrypted. Verification codes and reset links are hashed in the token table and encrypted in the temporary email-delivery queue.
- On your phone, your sign-in token is kept in the device's secure storage (iOS Keychain). Your counters and entries are protected by your device's own security, such as your passcode and device encryption.
- Every request for synced data is limited to the signed-in account's own data.
- Repeated sign-in, sign-up, password-reset and support attempts are rate-limited, and failed sign-ins trigger increasing lock times.
- Resetting your password ends all your existing sign-in sessions.
- Database backups are made nightly. Local copies are accessible only to the server administrator; off-site copies are encrypted before upload to Cloudflare R2. The decryption key is kept separately from the server and Cloudflare.
No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities where the law requires it.
9. Your rights and choices
9.1 Controls everyone has in the app
- Edit or delete any counter or entry.
- Delete your account: You → Delete account (type DELETE to confirm). No need to contact us.
- Export your data: You → Export my data gives you an offline spreadsheet (.xlsx) of your active counters and entries, custom templates, selected settings and account details available on this device. It includes readable tabs and raw records with IDs, exact timestamps, currencies and saved costs. It does not include every record our server may retain or deleted local records. To request a copy of server-held information, email us using the contact details in section 12.
- Usage statistics: off by default; turn them on or off at any time in You → Data.
- Remove local data: delete the app from your device.
- Sign out: stops sync on that device. Your data stays on the device.
9.2 If you are in the European Economic Area, the United Kingdom or Switzerland
Habitcount is designed to use a phone-only mode when either the phone's region or the App Store account's country identifies one of these places. These signals can be wrong for someone travelling, living elsewhere, or using an account from another country. When this mode applies, new account sign-in and creation, Back up & sync, usage statistics and exchange-rate requests are switched off. New counters, entries and notes stay on your phone. If you signed in before phone-only mode applied, the app may keep your existing account identity on the phone so you can manage your subscription, sign out or request account deletion. It does not refresh your account profile or sync while phone-only mode is detected. Data synced before the mode applied may still be on our server until you delete your account. A sign-out or account-deletion request you choose to make may contact our server. Store billing and support can still contact their services. A request already in progress when the region signal changes cannot be recalled; the current App Store country may also become known after launch. The personal information we may receive while this mode applies includes:
- what you choose to send us in a support message;
- purchase information that Apple and RevenueCat pass to us when you use subscriptions;
- a sign-out or deletion request you choose to send for an existing account.
We have not appointed a representative in these countries. Phone-only mode does not itself resolve whether one is legally required, because support and subscription information may still be processed. For questions or rights requests, contact us using the details in section 12. We will update this policy if our arrangements change.
You have the right to:
- access your personal information and get a copy of it;
- correct inaccurate information;
- erase your information;
- restrict how we use it;
- data portability, meaning you can get the data you gave us in a machine-readable format;
- object to processing based on our legitimate interests;
- withdraw consent at any time. This does not affect processing that happened before;
- complain to a data protection authority, in particular in the country where you live or work, or where you think your rights were infringed. In the UK, this is the Information Commissioner's Office (ico.org.uk). In Switzerland, it is the Federal Data Protection and Information Commissioner. We'd be grateful if you contacted us first so we can try to help.
We reply within one month. For complex requests, we may extend this by up to two more months and will tell you if we do.
9.3 If Georgian law applies
Under the Law of Georgia on Personal Data Protection, you have the right to:
- be informed about how we process your data;
- access your data and get copies;
- have your data corrected, updated or completed;
- have processing stopped and your data deleted or destroyed;
- have your data blocked;
- receive your data in a portable format;
- withdraw your consent;
- not be subject to decisions based solely on automated processing.
We respond within 10 working days. In special cases, we may extend this by up to 10 more working days and will tell you straight away if we do. You can complain to the State Audit Office of Georgia (sao.ge), which took over the supervisory functions of the Personal Data Protection Service on 2 March 2026, or you can go to court.
9.4 If you are a California resident
This section applies to the extent the California Consumer Privacy Act, as amended by the CPRA, applies to us.
What we collect (categories as named in the CCPA) in the last 12 months, and where it comes from:
| CCPA category | Examples | Source |
|---|---|---|
| Identifiers | Email address, account ID, random device ID, IP address, Apple account identifier | You, your device, Apple |
| Customer records | Name (if Apple provides it), email address | You, Apple |
| Commercial information | Subscription status and purchase events | Apple via RevenueCat |
| Internet or other electronic network activity | Usage statistics (only if you turn them on), request data | Your device |
| Sensitive personal information | Account login details (email and password), health-related information in synced counters and entries | You |
We collect these for the purposes in section 4 and disclose them only to the service providers in section 5, for those purposes. We keep them for the periods in section 7.
- We do not sell or share your personal information, as "sell" and "share" are defined in the CCPA. We have not done so in the past 12 months. We have no actual knowledge of selling or sharing personal information of consumers under 16.
- We use sensitive personal information only to provide the service you ask for. We do not use it to infer characteristics about you, so the "right to limit" does not apply.
- Your rights: to know what we collect, use and disclose; to access it; to delete it; to correct it; to opt out of sale or sharing (we do neither); and to limit the use of sensitive personal information (see above). We will not discriminate against you for using these rights.
- You can use an authorised agent. We may ask the agent for proof of your written permission, and we may ask you to verify your identity directly.
- We respond within 45 days. We may extend this by up to 45 more days and will tell you if we do.
- Shine the Light: we do not disclose personal information to third parties for their own direct marketing.
9.5 If you live in another US state with a privacy law
Residents of states with comprehensive consumer privacy laws (for example Virginia, Colorado, Connecticut, Utah, Texas and Oregon) may have the right to:
- confirm whether we process their personal data and access it;
- correct it and delete it;
- get a portable copy;
- opt out of targeted advertising, sale and profiling (we do none of these).
We process sensitive data, including health-related data, only with your consent. If we deny your request, you can appeal by replying to our decision or emailing the privacy contact with "Appeal" in the subject. We will answer within the time the law requires. If we deny the appeal, we will tell you how to contact your state Attorney General. Nevada residents: we do not sell covered information as defined in Nevada law.
9.6 Health-data laws (Washington, Nevada, Connecticut and others)
See our Consumer Health Data Privacy Policy for the rights specific to consumer health data, including how to confirm, access and delete it, withdraw consent and appeal.
9.7 How to make a request
- Use the in-app controls in section 9.1 where you can. They are the fastest.
- Or email ilia.kamyshev@iesllc.ge and tell us what you would like us to do.
- To protect your data, we may need to confirm your identity first. Usually we ask you to send the request from the email address on your account, or to confirm it from inside the app while signed in. If you use Habitcount without an account, we hold almost nothing that identifies you. For support tickets, we can find them using the reply-to address you gave us.
- Requests are free, except where the law allows a fee for requests that are clearly unfounded or excessive.
10. Children
Habitcount is not directed at children. You must be 16 or older to create an account, and before you create an account the app asks for your year of birth. We use it only for that check and don't store it; we keep only the fact that you confirmed you are 16 or older. If the answer is under 16, the app doesn't let you create an account on that device. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.
11. Changes to this policy
We may update this policy when Habitcount or the law changes. We will change the "Last updated" date at the top. If we make a material change, we will tell you in the app before it takes effect. Where the law requires it, for example for a new use of health-related information, we will ask for your consent again.
12. Contact us
- Privacy: ilia.kamyshev@iesllc.ge
- Support: ilia.kamyshev@iesllc.ge, or You → Contact support in the app
- Post: Intelligent Energy Solutions LLC, 58 St. Andrew the First-Called Highway, Apartment 605, Block III, Batumi, Georgia
- Company identification number: 445839816 (Registry of Entrepreneurs, Georgia)
- EU, EEA, UK and Swiss users: no representative has been appointed. Contact our privacy address above for questions or rights requests (section 9.2).