Privacy Policy

1. Who is responsible

This policy covers the JW Habits mobile app, this website, and the reading-plan service. The controller is:

Support requests

If you contact us, we process your email address, message, and any attachments or diagnostic information you choose to send to answer your request. The legal basis is Article 6(1)(b) GDPR for support connected to a contract, or Article 6(1)(f) for our legitimate interest in responding to other enquiries. Please send only the information needed for your request and do not send passwords or unnecessary sensitive details.

Contact us at the email above for privacy questions or to exercise your rights. JW Habits is independently developed and is not affiliated with Jehovah’s Witnesses, the Watch Tower Bible and Tract Society, or any official religious organization.

2. Website & browser demo

The website and reading-plan backend are hosted using Vercel. To deliver pages and protect the service, the hosting provider processes technical request information such as your IP address, request time, requested URL, browser and operating-system information, and security or error information.

The purpose is reliable delivery, troubleshooting, and protection against abuse; the legal basis is our legitimate interest in operating a secure website (Article 6(1)(f) GDPR). We do not integrate advertising trackers, website analytics, or externally loaded fonts into this website.

The browser demo runs in the current page’s memory. Routine names, checkmarks, reading selections, and reflections entered in the demo are not submitted to our backend or to an AI provider. We do not store these entries in cookies, localStorage, or a database. Resetting or reloading the page clears them; closing it ends the session. Your browser may restore a page from its own session cache.

Links to app stores and provider policies take you to external services. Their own privacy policies apply after you open those links.

3. Personal routines & iCloud

You can use core personal features without a social account. Habit names, goals, study logs, notes, experiences, progress, streaks, notification preferences, and app settings are stored on your device. If you use iCloud or device backups, or save an exported backup to iCloud Drive or another storage service, that service also holds a copy. Online features are described separately below.

iCloud is provided by Apple and linked to your Apple account. Its availability and backup behavior depend on your platform and settings. We cannot directly access your personal iCloud contents. Local notifications use the permissions you grant in your device settings.

Your entries may contain very personal information. Avoid including other people’s sensitive information without a lawful reason. We do not use your personal journal, notes, or study content for advertising.

4. Optional accounts & friends

Supabase provides optional authentication, profiles, and social data. Account information includes email address, user ID, authentication and session information, account creation date, and login-related metadata. Passwords are handled by Supabase Auth; we do not see your plain-text password.

Profile data includes display name, username, a selected avatar, optional bio and favorite Bible text, points, habit counts, and longest streak. The bio and favorite Bible text you save are stored in Supabase, even if you restrict their visibility to other users. There is no separate field asking for religious affiliation. Social data includes friend requests, friendships, feed events, emoji reactions, challenge invitations, participation and progress, and privacy settings.

The friends feed is intended for friends, rather than a public global feed. Supported privacy settings control which activity types are shared, including habit completions, streak milestones, Faith House progress, and achievements. A shared habit-completion event includes the habit name; an achievement event includes its name and identifier. Sharing does not upload your journal, study notes, or private experiences. In the current app defaults, the profile is visible to other app users; statistics, feed, challenges, and the favorite Bible text are set to friends, and the supported activity-sharing switches are enabled. Review these settings when using a social account. Visibility controls who can see information, rather than whether it is stored online. Information you share may be copied or captured by recipients outside the app.

We use this data to provide the account and social features you request (Article 6(1)(b) GDPR), and limited security information to protect accounts and prevent abuse (Article 6(1)(f)). Supabase and Resend can process your email address and authentication-related messages to deliver confirmation, sign-in, password-reset, or security emails. These transactional emails are used for account access and security.

5. Automatic Bible reading plans

Manual plan creation lets you choose passages yourself. When you request an automatically created plan, your topic, optional requested reading time, and app/device language are sent to our backend and to OpenAI to produce a plan. The app also sends an installation identifier, an app-integrity token, an idempotency identifier, platform, and app version to our backend. OpenAI receives the topic, generation instructions, and a hashed security identifier; the app-integrity token is not forwarded to OpenAI. Request identifiers and technical generation metadata are also processed. The service does not require your social account or send your private journal to OpenAI.

Vercel delivers the backend. Firebase App Check checks that a request comes from an allowed mobile app; depending on the platform this can involve Apple or Google app-integrity services. The backend also processes installation and network identifiers to limit abuse. Operational application logs use hashed installation identifiers and limited technical metadata, rather than raw topics, raw IP addresses, authentication tokens, or full generated plans.

Automatic generation is optional and begins when you request it. The current app flow does not include a separate consent prompt for this request. The purpose is the plan you request (Article 6(1)(b) GDPR) and protection against abuse (Article 6(1)(f)). The additional requirements for data revealing religious beliefs are explained in section 6.

Generated plans, including titles that can reflect the topic you entered, can temporarily remain in backend memory to avoid duplicate generation. The default retention is up to 24 hours; process restarts may clear them earlier. The backend does not maintain a separate plain-text topic database.

Our requests disable OpenAI response storage. This does not mean that OpenAI processes no data or retains nothing: its standard API abuse-monitoring logs can be retained for up to 30 days, subject to legal exceptions and the configured provider controls. OpenAI states that API data is not used to train its models by default unless the customer opts in. See OpenAI’s API data controls.

Use a general topic such as “gratitude” or “encouragement”. Do not include names, private experiences, health information, or other sensitive personal details in a plan request.

6. Information about religious beliefs

We do not ask you to declare a religious affiliation. A general topic such as “gratitude” does not necessarily reveal your own beliefs. However, a bio, favorite Bible text, shared habit name, or reading request can reveal religious beliefs through its content or context. Where it does, it can be a special category of personal data under Article 9 GDPR, even without a field labeled “religion”.

Processing data that reveals religious beliefs requires an applicable Article 9 condition in addition to an Article 6 legal basis. The fact that a profile field or automatic plan is optional does not itself supply that condition. Where explicit consent is needed, it must specifically and clearly cover that processing. Accepting this privacy policy, creating an account, or using a general “Generate” button is not by itself explicit consent to process sensitive data.

Keep online profile fields and plan requests free of unnecessary sensitive personal details, and do not include sensitive information about other people. You can edit or remove your profile text, turn off activity sharing, or request deletion at info@setupfast.net. Where processing is based on valid consent, you can withdraw it without affecting the lawfulness of earlier processing. This notice does not treat an optional feature as an existing consent mechanism.

7. App analytics, subscriptions & creator codes

App usage analytics

TelemetryDeck provides privacy-oriented app usage analytics, such as session starts and foreground duration, onboarding steps, screen and paywall views, purchase attempts and results, and plan-generation attempts and results. Events contain limited technical information such as app version, platform, operating-system major version, and SDK version, together with SDK-created user/session identifiers. The Android transport uses a random identifier for the current process, rather than a persistent device or account identifier. Identifier hashing or aggregation does not automatically make every event anonymous. Network information is processed to receive requests. We do not send habit names, journal entries, experiences, Bible-reading topics, profile text, or email addresses in these analytics events.

Usage analytics is enabled by default in the current app, unless a previous choice disabled it. You can turn it off in the app’s settings under “Usage analytics”. Turning it off stops further app analytics and discards pending app-side events; it does not erase events already received by the provider or disable account, purchase, or reading-plan requests you make.

Our purpose is to understand and improve usability and stability. For limited analytics that lawfully operates without prior consent, the legal basis is our legitimate interest in that purpose (Article 6(1)(f) GDPR), subject to your rights and interests. You may object using the setting above or by contacting us. An opt-out switch is not prior consent; where consent is required for processing or access to device information, including under § 25 TDDDG, it must be obtained before the relevant collection.

Subscriptions and payments

Apple App Store or Google Play processes payments. RevenueCat manages subscription entitlements and status. We may process product and transaction identifiers, purchase dates, renewal and trial status, platform, and app-specific customer identifiers to provide paid access and purchase support (Article 6(1)(b) GDPR). Statutory recordkeeping, where applicable, is based on Article 6(1)(c).

We do not receive full payment card numbers or Apple/Google account passwords. We do not sell your personal data or use these services to track you across unrelated apps for targeted advertising. We do not use Apple’s advertising identifier (IDFA) for analytics.

Creator codes and referral offers

WinWinKit (Osta Ventures ApS, Denmark) manages creator-code claims and the associated offers or rewards. It uses the same app-specific customer identifier as RevenueCat, together with a claimed code, claim/reward status, and relevant subscription or transaction information. The iOS app initializes WinWinKit with that customer identifier at app startup, before a code is entered. On Android, a code claim sends the identifier and premium status; a successful purchase with an active creator code also sends the Google Play purchase token for attribution. Network requests involve technical connection information such as the IP address.

This provides the offer you request (Article 6(1)(b) GDPR). Limited administration of claims, attribution, and abuse prevention serves our legitimate interest in operating the creator program (Article 6(1)(f)), subject to applicable consent requirements. These code requests do not send your social profile, bio, favorite Bible text, journal, or reading topic to WinWinKit. A shared customer identifier links subscription and creator-code records; it is not a guarantee of anonymity. The website demo does not initialize these app services.

8. Providers & international transfers

Depending on the features you use, the following providers receive the information needed to provide their service. Hosting, authentication, database, analytics, email, subscription, and creator-code providers act as processors where they process data on our instructions; app stores may also act as independent controllers.

Some providers and their subprocessors process data outside the EU/EEA, including in the United States. Where required, a transfer must be covered by an adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and supplementary measures. A provider’s certification only covers a transfer where that certification is current and applies to the relevant entity and processing. Contact us for information about safeguards or a copy of relevant transfer documentation.

Provider policies explain their own processing; they do not replace our responsibilities as the controller.

9. Retention, security & deletion

We keep personal information only for its purpose or an applicable legal retention requirement. Where a fixed duration depends on the account or provider configuration, the relevant deletion criteria are:

• Local entries remain until you remove them on your device. iCloud copies and device backups need to be managed separately in Apple or device settings.
• Account, profile, privacy settings, friendships, feed, reactions, and challenges remain while needed for the active account and are removed as part of account deletion, subject to lawful exceptions.
• Subscription and creator-code records are separate from your social account. They remain as needed for access, offer administration, attribution, support, and applicable legal obligations. The in-app social-account deletion does not itself send a deletion request to RevenueCat or WinWinKit; contact us to request deletion of associated service records where permitted.
• Browser demo entries exist only in the current page session. Generated backend plans use temporary memory as described in section 5.
• Hosting and security logs are kept for the configured operational retention and as necessary to investigate security incidents.
• Support correspondence is kept until the request is resolved and for any necessary legal claim or retention period. Data subject to a statutory obligation is kept for that obligation and access is restricted.
• Provider backup copies may expire separately under the provider’s backup cycle. Retained legal or security records are limited to what is necessary.

We use encrypted transport, authentication, access controls, and database access restrictions for online data. These measures reduce risk but cannot guarantee absolute security.

See Delete Account for in-app and email deletion options. Deleting an online account does not automatically remove local entries, iCloud copies, store purchase records, or cancel an app-store subscription.

10. Your rights & contact

Under the GDPR, you may request access, correction, erasure, restriction of processing, and data portability where the conditions apply. You may withdraw consent at any time. You may object to processing based on legitimate interests on grounds relating to your situation, and to direct marketing at any time.

Email info@setupfast.net. We may request only the information needed to verify your identity. We generally respond within one month; if an extension of up to two further months is legally necessary, we will explain it within the first month. Requests are generally free, subject to the GDPR’s limited exceptions.

You may complain to a supervisory authority, including in your usual place of residence, work, or the alleged infringement. The European Data Protection Board directory lists EU/EEA authorities.

Account information is needed to provide an account; without it, those features cannot be provided. Social sharing and automatic plan generation are optional. We do not use the described processing to make solely automated decisions producing legal or similarly significant effects about you.

11. Age requirements & policy updates

The app’s existing terms require users to be at least 16, or any higher minimum required by applicable law. App-store content ratings describe content suitability and do not replace account or consent requirements. If you believe personal data was collected in breach of these requirements, contact us so we can investigate and arrange deletion where necessary.

We will update this notice when features or processing change. Material changes will be communicated appropriately. Continued use is not treated as consent to new processing; where a new purpose requires consent, that consent must be obtained separately.