Privacy Policy — Photo Habit Tracker

Last updated: September 30, 2026

This policy explains what Photo Habit Tracker (the “App”) collects, how it’s used, and the controls you have. The short version: your habits and check-ins live on your device and are backed up to your private account so you can restore them or use the app on another device, we collect only what’s needed for the features you turn on, we don’t sell your data, and we don’t track you across other apps.

Who runs this app

Photo Habit Tracker is an indie app for iPhone and Android built and operated by Puya Seid-Karbasi. Questions about this policy or your data: pseidkarbasi@gmail.com.

Your habits and check-ins

The app keeps your data in a private database on your device that other apps cannot read. When you set up the app it creates an account for you, and your habits and check-ins are backed up to it. That lets you restore them on a new phone, move between iPhone and Android, and see them in the web app at habit.pdawg.blog. The backup contains:

  • Your habits (name, icon, color, schedule, reminder and streak-alert settings)
  • Your check-ins: when you checked in, any note you attached, the place name if you turned on location sharing (never GPS coordinates), and the check-in photo with its thumbnail

Only you can see this backup. Buddies and pod members see only the habits you choose to share with them, as described below. Precise GPS coordinates and your app preferences never leave your device. Deleting the app removes the on-device copy; Settings → Delete Cloud Data removes the backup (see Your rights and controls).

Accountability Buddy and Pods (opt-in)

If you choose to use the Accountability Buddy or Pods features, we send the following to our servers so your buddy or pod members can see your progress:

  • A display name (generated for you, and changeable — it does not need to be your real name)
  • An anonymous user ID we generate for you (a random UUID, not your device ID, not your Apple ID or Google account, not an advertising ID)
  • An optional one-line tagline you write about yourself
  • A summary of each habit you share with a buddy: name, icon, color, streak count, scheduled days, and the date of your latest check-in
  • Check-in photos you take, uploaded to our backend so they can be displayed to your buddy. Photos are stored privately — only you and the buddies you connect with can view them, using short-lived signed URLs
  • Optional coarse location label attached to a check-in (see Location below)
  • When you were last active in the app, which you can turn off in Settings
  • Push notification tokens issued by Apple (iPhone) or Google Firebase Cloud Messaging (Android) so we can send your buddy notifications on your behalf

To help you find friends who already use the app, we offer an optional contact-discovery step. If you allow contact access:

  • We compute a one-way cryptographic hash of each contact’s phone number on your device
  • We send only the hashes to our server and check them against hashes of other registered users
  • We never send, store, or log actual phone numbers or contact names
  • You can decline contact access without losing any other feature

Direct messages

If you and another person are buddies or pod members, you can send each other text messages. You cannot message someone you are not connected to.

Message text is stored on our backend so it can be delivered and shown in your conversation history. Messages are visible to you and the person you sent them to. They are not end-to-end encrypted, and we can technically access them — we do so only when investigating a report of abuse.

The text of a message may appear in the push notification delivered to the recipient’s device, the same as in any messaging app.

You can mute a conversation, block the other person, or report them from inside the conversation. Deleting your cloud data removes your messages from both sides of every conversation.

Explore — finding buddies by country (optional)

Explore lets you browse people who are open to being a buddy, grouped by country. If you are discoverable — the default, which you can turn off in Settings — other users may see your display name, profile photo, tagline, and country. Your precise location is never shown in Explore; only the country.

A country only appears in Explore once at least three discoverable people are in it, so a country listing can never identify one individual.

On iPhone, your country comes from the App Store storefront your device reports. On Android, or if an iPhone does not report one, we resolve it once from the IP address of a single request using ipapi.co, a third-party geolocation service, and store only the resulting two-letter country code. The IP address itself is not stored.

Your display name, tagline, and photo screening

Display names are checked against a blocklist. Taglines and profile photos are automatically screened for offensive content using Amazon Comprehend (text) and Amazon Rekognition (images), both running inside our own AWS account. Content that fails screening is rejected when you try to save it.

Reporting and blocking

If you report another person, we store the report along with a snapshot of their display name, tagline, and profile photo as they were at the time, so the evidence survives any later edit. Reports are emailed to the developer and reviewed by a person. Reporting someone also blocks them immediately.

If you block someone, we store that you blocked them. Blocking is mutual in effect: neither of you will see the other in suggestions or Explore, and neither can message, react to, or send reminders to the other. You can see and undo your blocks in Settings → Blocked people.

Photo analysis for personalization

When a check-in photo is backed up to your account, a small thumbnail of that photo is sent to Anthropic, our language-model provider, to derive habit-relevant tags (for example “outdoors”, “gym”, “meal”). Those tags decide which daily insight card you are shown. Anthropic does not retain the image or train on it. The full-resolution photo is never sent. Check-ins without a photo are never sent.

Location (optional)

Photo Habit Tracker can optionally attach a coarse location label to check-ins you share with a buddy. This is off by default and never happens without your explicit action.

What we collect. When you turn on Share check-in location with buddies on a specific habit and grant “When in Use” location permission, your device captures a single GPS reading at the moment you check in for that habit. We reverse-geocode that reading on your device into a short place label — typically a neighborhood and city (for example, “Prospect Park” or “Mission District, San Francisco”). We never read, store, or share a street-level address.

What stays on your device. The precise GPS coordinates (latitude, longitude, and accuracy) are kept locally on your phone alongside the check-in record, for potential future features like a personal map view of your own habits. They are never sent to our servers and never shared with buddies.

What we share with your buddy. Only the short place label (“neighborhood, city”), attached to that specific check-in, sent through our backend to the buddy or pod members connected to you. The place label is never included in push notification previews on the lock screen — it is only visible when your buddy opens the check-in inside the app.

How you control it. Three independent controls; any one of them turns location off:

  • Per-habit toggle (Habit → Edit → Location). Off by default for every habit.
  • Master kill switch (Settings → Privacy → Share location with buddies). Suppresses location sharing across all habits.
  • iOS system permission. Revoke under Settings → Privacy & Security → Location Services → Habit Tracker. Without this permission, no location is ever captured regardless of the in-app toggles.
  • Location sharing is available on iPhone only. The Android app does not request location permission.

Changes of mind. Turning off a toggle stops sharing location on all future check-ins immediately. Place labels already attached to past check-ins remain visible to buddies who received them. Deleting your cloud data removes all of your check-in records — including any attached place labels — from our backend.

Analytics

The app sends anonymous product usage events (for example “user launched the app”, “user created a habit”, “user checked in”) to our backend so we can understand how the app is used and improve it. These events include:

  • A random install ID generated on first launch (not your Apple ID or Google account, not an advertising ID, not your device hardware ID)
  • App version, operating system (iOS or Android) and its version, device model, locale, and on iPhone the App Store storefront country
  • The event name and a small set of scalar properties describing the event

Analytics events never contain your habit names, photos, notes, message text, phone number, contacts, location coordinates, or any free-text content. The event schema is enforced by our code to prevent any of that from being sent accidentally.

Tracking

We do not track you. Specifically:

  • We do not use Apple’s Advertising Identifier (IDFA), Android’s advertising ID, or any other cross-app identifier
  • We do not share your data with advertising networks, analytics vendors, or data brokers
  • We do not show ads
  • We do not link your data with data collected by other apps, websites, or offline sources

Apple’s App Tracking Transparency prompt is therefore not shown, because the app does not engage in “tracking” as Apple defines it.

Third parties we rely on

Your data flows through the following providers strictly to operate the app’s features:

  • Amazon Web Services (AWS) — hosts our backend servers and photo storage (S3), and runs the content-screening services described above. Our data lives in the us-west-2 region. AWS acts as our data processor and does not use your data for their own purposes.
  • Apple Push Notification service (APNs) — delivers push notifications to your device. Apple’s push infrastructure sees only the notification payload and the destination device token.
  • Google Firebase Cloud Messaging (FCM) — delivers push notifications to Android devices. Google’s push infrastructure sees only the notification payload and the destination device token. We do not use Google Analytics or any other Firebase product.
  • Anthropic — receives check-in photo thumbnails to generate the personalization tags described above. Anthropic does not retain them or train on them.
  • ipapi.co — receives the IP address of a single request, once, on Android, or when an iPhone does not report an App Store storefront, to resolve a country code.
  • Amazon SES — delivers report and feedback emails to the developer.

We do not share data with any other third party.

Your rights and controls

  • Delete cloud data: Settings → Delete Cloud Data wipes your user record, your backed-up habits and check-ins, photos, messages, blocks, location labels, and the tags derived from your photos from our servers. The habits, photos and notes on your device are kept, so you can keep using the app without an account.
  • Disable features: buddy, pods, messages, Explore discoverability, location, contacts, photos, and notifications are all optional. You can disable any of them without affecting the others.
  • Revoke permissions: on iPhone, Settings → Privacy & Security → Location Services / Contacts / Notifications / Photos → Habit Tracker; on Android, Settings → Apps → Habit Tracker → Notifications. You can revoke any permission at any time.
  • Export: Settings → Backup exports all your habits, completions, and photos to a JSON file you control (iCloud Drive, Files, email to yourself, and so on). Export is currently iPhone-only; on Android, the account backup described above serves the same purpose.
  • Contact us: pseidkarbasi@gmail.com for any question about your data or to request deletion outside of the in-app flow.

Children

Photo Habit Tracker is not directed at children under 13 and we do not knowingly collect personal information from children under 13.

Data retention

  • Active users: we retain your buddy-related data (user record, habit summaries, photos, messages, location labels) as long as your account is active. Photos and messages are kept until you delete them or delete your account — they are not expired automatically on a schedule. An earlier version of this policy said check-in photos were deleted after 180 days; that was inaccurate, and no such automatic deletion was ever in place. You can remove all of it at any time from Settings → Delete Cloud Data.
  • After account deletion: records are removed from the active database immediately. Photo files and backup logs may persist in provider backups (AWS) for up to 30 days before being permanently purged, per standard AWS retention.
  • Analytics events: stored for 90 days, then automatically deleted.

Changes to this policy

If we change this policy in a way that materially affects you, we’ll update the “Last updated” date at the top and — for significant changes — surface a notice inside the app or via the support channel. Continued use of the app after a change means you accept the updated policy.

Contact

Questions, data requests, or complaints: pseidkarbasi@gmail.com. To report another user, use Report inside the app — it reaches us immediately.