Privacy Policy

Last updated: October 2026

      In short: Your habit data stays on your device or in your own iCloud/Google Drive. We run no servers of our own and never receive the names and contents of your habits. The app sends crash reports (on by default, switchable in settings), usage statistics, and purchase records — see below for details.
    

1. Data Controller

The responsible party ("data controller") within the meaning of the General Data Protection Regulation (GDPR) is:

Heinrich Hermann
Draisstraße 12
76351 Linkenheim-Hochstetten
Germany
Email: hello@routinecanvas.com

2. Data the App Sends

Your habit data itself (names, notes, completions) is never sent to any third party. The following technical data is sent by the App:

Crash and performance reports (on by default) — Firebase Crashlytics collects crash reports with stack traces, a random installation ID, device model, OS and app version, a few technical settings (number of habits, whether cloud sync is enabled, theme, language), and short logs of UI actions and backup steps. Habit names and contents are not included. Crash reporting is switched on by default; you can switch it off at any time in the App's settings ("Send Crash Reports").
Usage statistics (on by default) — Firebase Analytics collects screen views, a timestamped "habit completed" event (without habit name or content), purchase events, whether Pro is active, and standard events (first open, app update, session). It also receives a random app-instance ID, a device identifier (on iOS the vendor ID, on Android the advertising ID where available), device model, OS version, language, and an approximate region derived from your IP address. There is no in-app switch for analytics.
Technical settings (on by default) — Firebase Remote Config fetches flags that decide which technical errors are reported. It receives your country and language code, time zone, OS version, and the app's bundle ID.
Purchase data — We use RevenueCat to process in-app purchases and subscriptions. RevenueCat receives an anonymous app user ID, purchase transactions and receipts, and technical data such as device model, OS and app version, and store country. The legal basis is the performance of the contract pursuant to Art. 6(1)(b) GDPR. We maintain a data processing agreement with RevenueCat in accordance with Art. 28 GDPR.

3. What We Never Receive

The names, notes, and contents of your habits — they stay on your device and in your own cloud account
Your e-mail address, account name, or other contact details
Advertising data — the app shows no ads and does not use your data for advertising or sell it
Any data stored on our own servers — we run no servers of our own

4. Local Data Storage

All of your habit data, routines, settings, and progress are stored locally on your device. We do not have access to this data. If you uninstall the App without creating a backup, your data will be permanently deleted.

5. Optional Cloud Sync

You may optionally enable cloud backup through your personal iCloud (iOS) or Google Drive (Android) account. When enabled:

Your backup data is stored in your own cloud storage account, not on our servers.
iCloud and Google Drive apply their own encryption to data stored in your account.
You may additionally enable end-to-end encryption with a personal passphrase. When enabled, your data is encrypted with AES-GCM-256 on your device before upload, using a key derived from your passphrase (PBKDF2-HMAC-SHA256). Without your passphrase, no one can read the backup — including us.
We never have access to your cloud storage or your backup data.
You can disable cloud sync or delete backups at any time from within the App.

6. Data Deletion

Since your data is stored locally on your device and optionally in your personal cloud account:

You can delete all local data by uninstalling the App or using the in-app data management options.
Cloud backups can be deleted from within the App's settings or directly from your iCloud or Google Drive account.
Crash data retained by Firebase Crashlytics is automatically purged according to Google's data retention policies.

7. Third-Party Services

The App uses the following third-party services, each with their own privacy policies:

Firebase Analytics (Google Ireland Ltd.) — usage statistics
Firebase Crashlytics (Google Ireland Ltd.) — crash reports, switchable in settings
Firebase Remote Config (Google Ireland Ltd.) — technical error flags
RevenueCat (RevenueCat Inc., San Francisco, CA) — subscription and purchase management

Usage statistics (Firebase Analytics) and configuration data (Firebase Remote Config) are processed by Google according to its retention policies. Contact us at hello@routinecanvas.com to exercise your rights regarding this data.

8. Your Rights Under GDPR

As a data subject, you have the following rights under the GDPR:

Right of access (Art. 15 GDPR) — You have the right to obtain confirmation as to whether personal data concerning you is being processed and to request access to that data.
Right to rectification (Art. 16 GDPR) — You have the right to request correction of inaccurate personal data.
Right to erasure (Art. 17 GDPR) — You have the right to request deletion of your personal data, subject to legal retention obligations.
Right to restriction of processing (Art. 18 GDPR) — You have the right to request restriction of processing under certain conditions.
Right to data portability (Art. 20 GDPR) — You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
Right to withdraw consent (Art. 7(3) GDPR) — Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing.
Right to lodge a complaint (Art. 77 GDPR) — You have the right to lodge a complaint with a supervisory authority if you believe your data is being processed unlawfully.

9. Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you. If you object, we will cease processing your data unless we are required to continue processing it by law.

10. Children's Privacy

RoutineCanvas is not directed at children under the age of 16. We do not knowingly collect any personal information from children. If you believe a child under 16 has provided us with personal information, please contact us so we can take appropriate action.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be reflected on this page with an updated "Last updated" date. Continued use of the App after changes constitutes acceptance of the revised policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or wish to exercise any of your rights, please contact us at:

hello@routinecanvas.com