Privacy Policy

1. Introduction

Routine Craft ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Routine Craft mobile application.

2. Information We Collect

• Account: Your email address, provided by Google when you sign in. We never see or store a password — sign-in is through Google only.
• Habit Data: Habit names, completion records, reminders, and preferences you create inside the app. We receive these only if you subscribe; otherwise they stay on your device and we never see them.
• Crash Reports: Anonymous diagnostic data collected via Sentry to improve app stability. No personally identifiable information is included.
• Device Info: Limited device identifiers used solely for crash reporting.
• Encryption Key: A locked copy of the key that opens your habit names, kept with your account so your habits can be read again on a new device. We cannot open it without the separate secret described below.

3. How We Use Your Information

• To provide, operate, and maintain the app and its features.
• To back up and sync your habits across your devices — only if you subscribe. Without a subscription, nothing you create in the app is sent to us.
• To process and manage your subscription payments.
• To identify your account across your devices.
• To diagnose crashes and improve performance.

4. Third-Party Services

• Supabase — Authentication and your locked encryption key for everyone, and encrypted habit storage for subscribers only, on servers located in India.
• Cloudflare — Holds the secret that protects your encryption key, kept separate from the database on purpose.
• RevenueCat — Subscription and in-app purchase management.
• Sentry — Crash reporting and performance monitoring.

Each third-party service has its own privacy policy governing how it handles your data. We are not responsible for their practices.

5. Data Security

If you do not have a subscription, your habits never leave your device. There is no cloud copy to protect.

Your encryption key is stored with your account, locked. This is what lets your habits be read again when you reinstall the app or sign in on another device. Without it, habit names already saved on your phone could not be opened.

If you subscribe, your habit names are encrypted on your device using AES-256-GCM before they are sent anywhere, and they stay encrypted on our servers. The key that opens them is itself locked, using a secret held on separate infrastructure (Cloudflare) from the database — so a breach of the database alone cannot reveal your habits.

Because we hold that secret, we are able to restore your data when you sign in on a new device. That is deliberate: it is what makes your backup work. It also means we are technically capable of reading your habit names. We do not, and we do not sell or share them.

All communication uses TLS. No method of transmission over the internet is 100% secure.

6. Data Retention

We retain your personal data for as long as your account remains active. You may permanently delete your account and all associated data at any time from Settings → Account → Delete Account. Deletion is irreversible and takes effect immediately.

7. Your Rights

• Access: View all your data through the app at any time.
• Deletion: Permanently delete your account and all data via Settings → Account → Delete Account.
• Export: Download your habit data via Settings → Export Data.
• Correction: Update your account information within the app.
• Contact: Reach us with any privacy request at husain.slatewala@gmail.com.

8. Children's Privacy

Routine Craft is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us immediately and we will delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through an in-app notification or a notice within the app. Continued use of the app after changes become effective constitutes your acceptance of the updated policy. The effective date at the top of this page reflects the date of the latest revision.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact us at:

Email: husain.slatewala@gmail.com