Privacy Policy — Photo Habit Tracker

Last updated: August 28, 2026

This policy explains what Photo Habit Tracker (the “App”) collects, how it’s used, and the controls you have. The short version: your habits and photos stay on your device by default, we collect only what’s needed for the features you turn on, we don’t sell your data, and we don’t track you across other apps.

Who runs this app

Photo Habit Tracker is an indie iOS app built and operated by Puya Seid-Karbasi. Questions about this policy or your data: pseidkarbasi@gmail.com.

Data stored on your device only

The following never leaves your device unless you explicitly opt in to a feature described below:

  • Your habits (name, icon, color, schedule, notification preferences)
  • Your check-in photos
  • Notes you attach to check-ins
  • Precise GPS coordinates of check-ins (only if you enabled optional location sharing — see below)
  • Streak and completion history
  • App preferences

All of the above live in a private on-device database. Other apps cannot read it. If you delete the app, this data is removed along with it.

Accountability Buddy and Pods (opt-in)

If you choose to use the Accountability Buddy or Pods features, we send the following to our servers so your buddy or pod members can see your progress:

  • A display name (generated for you, and changeable — it does not need to be your real name)
  • An anonymous user ID we generate for you (a random UUID, not your device ID, not your Apple ID, not your IDFA)
  • An optional one-line tagline you write about yourself
  • A summary of each habit you share with a buddy: name, icon, color, streak count, scheduled days, and the date of your latest check-in
  • Check-in photos you take, uploaded to our backend so they can be displayed to your buddy. Photos are stored privately — only you and the buddies you connect with can view them, using short-lived signed URLs
  • Optional coarse location label attached to a check-in (see Location below)
  • When you were last active in the app, which you can turn off in Settings
  • Push notification tokens issued by Apple so we can send your buddy notifications on your behalf

To help you find friends who already use the app, we offer an optional contact-discovery step. If you allow contact access:

  • We compute a one-way cryptographic hash of each contact’s phone number on your device
  • We send only the hashes to our server and check them against hashes of other registered users
  • We never send, store, or log actual phone numbers or contact names
  • You can decline contact access without losing any other feature

Direct messages

If you and another person are buddies or pod members, you can send each other text messages. You cannot message someone you are not connected to.

Message text is stored on our backend so it can be delivered and shown in your conversation history. Messages are visible to you and the person you sent them to. They are not end-to-end encrypted, and we can technically access them — we do so only when investigating a report of abuse.

The text of a message may appear in the push notification delivered to the recipient’s device, the same as in any messaging app.

You can mute a conversation, block the other person, or report them from inside the conversation. Deleting your cloud data removes your messages from both sides of every conversation.

Explore — finding buddies by country (optional)

Explore lets you browse people who are open to being a buddy, grouped by country. If you are discoverable — the default, which you can turn off in Settings — other users may see your display name, profile photo, tagline, and country. Your precise location is never shown in Explore; only the country.

A country only appears in Explore once at least three discoverable people are in it, so a country listing can never identify one individual.

Your country comes from the App Store storefront your device reports. If your device does not report one, we resolve it once from the IP address of a single request using ipapi.co, a third-party geolocation service, and store only the resulting two-letter country code. The IP address itself is not stored.

Your display name, tagline, and photo screening

Display names are checked against a blocklist. Taglines and profile photos are automatically screened for offensive content using Amazon Comprehend (text) and Amazon Rekognition (images), both running inside our own AWS account. Content that fails screening is rejected when you try to save it.

Reporting and blocking

If you report another person, we store the report along with a snapshot of their display name, tagline, and profile photo as they were at the time, so the evidence survives any later edit. Reports are emailed to the developer and reviewed by a person. Reporting someone also blocks them immediately.

If you block someone, we store that you blocked them. Blocking is mutual in effect: neither of you will see the other in suggestions or Explore, and neither can message, react to, or send reminders to the other. You can see and undo your blocks in Settings → Blocked people.

Photo analysis for personalization

When you attach a photo to a check-in and you use the Buddy or Pods features, a small thumbnail of that photo is sent to Anthropic, our language-model provider, to derive habit-relevant tags (for example “outdoors”, “gym”, “meal”). Those tags decide which daily insight card you are shown. Anthropic does not retain the image or train on it. The full-resolution photo is never sent. If you do not use Buddy or Pods, your photos are never uploaded and this never happens.

Location (optional)

Photo Habit Tracker can optionally attach a coarse location label to check-ins you share with a buddy. This is off by default and never happens without your explicit action.

What we collect. When you turn on Share check-in location with buddies on a specific habit and grant “When in Use” location permission, your device captures a single GPS reading at the moment you check in for that habit. We reverse-geocode that reading on your device into a short place label — typically a neighborhood and city (for example, “Prospect Park” or “Mission District, San Francisco”). We never read, store, or share a street-level address.

What stays on your device. The precise GPS coordinates (latitude, longitude, and accuracy) are kept locally on your phone alongside the check-in record, for potential future features like a personal map view of your own habits. They are never sent to our servers and never shared with buddies.

What we share with your buddy. Only the short place label (“neighborhood, city”), attached to that specific check-in, sent through our backend to the buddy or pod members connected to you. The place label is never included in push notification previews on the lock screen — it is only visible when your buddy opens the check-in inside the app.

How you control it. Three independent controls; any one of them turns location off:

  • Per-habit toggle (Habit → Edit → Location). Off by default for every habit.
  • Master kill switch (Settings → Privacy → Share location with buddies). Suppresses location sharing across all habits.
  • iOS system permission. Revoke under Settings → Privacy & Security → Location Services → Habit Tracker. Without this permission, no location is ever captured regardless of the in-app toggles.

Changes of mind. Turning off a toggle stops sharing location on all future check-ins immediately. Place labels already attached to past check-ins remain visible to buddies who received them. Deleting your cloud data removes all of your check-in records — including any attached place labels — from our backend.

Analytics

The app sends anonymous product usage events (for example “user launched the app”, “user created a habit”, “user checked in”) to our backend so we can understand how the app is used and improve it. These events include:

  • A random install ID generated on first launch (not your Apple ID, not your IDFA, not your device hardware ID)
  • App version, iOS version, device model generation, locale, App Store storefront country
  • The event name and a small set of scalar properties describing the event

Analytics events never contain your habit names, photos, notes, message text, phone number, contacts, location coordinates, or any free-text content. The event schema is enforced by our code to prevent any of that from being sent accidentally.

Tracking

We do not track you. Specifically:

  • We do not use Apple’s Advertising Identifier (IDFA) or any other cross-app identifier
  • We do not share your data with advertising networks, analytics vendors, or data brokers
  • We do not show ads
  • We do not link your data with data collected by other apps, websites, or offline sources

Apple’s App Tracking Transparency prompt is therefore not shown, because the app does not engage in “tracking” as Apple defines it.

Third parties we rely on

Your data flows through the following providers strictly to operate the app’s features:

  • Amazon Web Services (AWS) — hosts our backend servers and photo storage (S3), and runs the content-screening services described above. Our data lives in the us-west-2 region. AWS acts as our data processor and does not use your data for their own purposes.
  • Apple Push Notification service (APNs) — delivers push notifications to your device. Apple’s push infrastructure sees only the notification payload and the destination device token.
  • Anthropic — receives check-in photo thumbnails to generate the personalization tags described above. Anthropic does not retain them or train on them.
  • ipapi.co — receives the IP address of a single request, once, only when your device does not report an App Store storefront, to resolve a country code.
  • Amazon SES — delivers report and feedback emails to the developer.

We do not share data with any other third party.

Your rights and controls

  • Delete cloud data: Settings → Delete Cloud Data wipes your user record, habits shared with buddies, photos, messages, blocks, and any attached location labels from our servers. Your on-device data is also reset.
  • Disable features: buddy, pods, messages, Explore discoverability, location, contacts, photos, and notifications are all optional. You can disable any of them without affecting the others.
  • Revoke permissions: iOS Settings → Privacy & Security → Location Services / Contacts / Notifications / Photos → Habit Tracker to revoke any permission at any time.
  • Export: Settings → Backup exports all your habits, completions, and photos to a JSON file you control (iCloud Drive, Files, email to yourself, and so on).
  • Contact us: pseidkarbasi@gmail.com for any question about your data or to request deletion outside of the in-app flow.

Children

Photo Habit Tracker is not directed at children under 13 and we do not knowingly collect personal information from children under 13.

Data retention

  • Active users: we retain your buddy-related data (user record, habit summaries, photos, messages, location labels) as long as your account is active. Photos and messages are kept until you delete them or delete your account — they are not expired automatically on a schedule. An earlier version of this policy said check-in photos were deleted after 180 days; that was inaccurate, and no such automatic deletion was ever in place. You can remove all of it at any time from Settings → Delete Cloud Data.
  • After account deletion: records are removed from the active database immediately. Photo files and backup logs may persist in provider backups (AWS) for up to 30 days before being permanently purged, per standard AWS retention.
  • Analytics events: stored for 90 days, then automatically deleted.

Changes to this policy

If we change this policy in a way that materially affects you, we’ll update the “Last updated” date at the top and — for significant changes — surface a notice inside the app or via the support channel. Continued use of the app after a change means you accept the updated policy.

Contact

Questions, data requests, or complaints: pseidkarbasi@gmail.com. To report another user, use Report inside the app — it reaches us immediately.