Privacy policy

HabitGotchi - version 1.5 - in effect since May 16, 2026, updated November 10, 2026.

This is an English translation of the French policy. If the two ever differ, the French version prevails.

The short version, no jargon.

HabitGotchi is a small app that lives in your browser. All the data you put into it - today's habits, private journal, cycle tracking, garden, studio, mini-game scores - is stored on your device only. Nothing is synced to a central server. If you clear the site's data, it's gone.

Six things, and only six, are exceptions:

The AI features (the Gotchi's daily thoughts, the weekly recap and the support mode) send text to the AI provider you choose: Anthropic (the company behind the Claude model) by default, or an OpenAI-compatible service (Mistral, Groq, OpenRouter, Ollama), using an API key that you provide yourself. If you haven't set up a key, or if the AI features are turned off, no call is made. When they are on, excerpts from your journal are sent to this provider to personalize the Gotchi's replies: the thoughts use your notes from the last 48 hours, the support mode your notes from today, and the weekly recap all the notes of the week in question. The Gotchi also keeps a "memory": a short summary of one week of your activity, written by the AI, kept on your device and sent back to the provider with every AI request to give some continuity. The content of these notes therefore leaves your device. According to Anthropic's commercial terms for the API, this content is not used to train its models. For any other provider, its own terms apply; with Ollama on your own computer, the text does not leave your local network. The journal, on the other hand, is never sent to the notification server.
Weather and sun phases make two anonymous public calls to Open-Meteo and Sunrise-Sunset with geographic coordinates (Toulouse by default, can be changed). When you search for a city in the settings, the name you type is also sent to Open-Meteo to find its coordinates.
Installation counting: when you launch the app installed on your home screen (habitgotchi.fr or habitgotchi.app), a pixel is loaded once per device from GoatCounter, a cookie-free visit counter, to know how many devices have installed the app. The app attaches no identifier to it; as with any web request, GoatCounter sees the IP address and the browser's technical information. When you open Settings, the app also reads the public installation total.
Push notifications for appointments and recaps go through a small Cloudflare server that I run myself. It receives your push subscription, a random pseudonymous identifier generated on your device (a technical identifier that contains neither your first name nor any other directly identifying data), plus the time of the appointments to notify and a technical appointment identifier - but never their title, which stays stored on your device only and is only put back together locally, when the notification is shown.
Community objects: when you open the ★ Community shelf, the app downloads the list of objects shared by other people, from the same Cloudflare server. No identifier is sent. You can turn this off in Settings ▸ ★ Community. Sending one of your objects is never automatic: you have to offer it, then confirm.
Fonts (Nunito, Caveat) are self-hosted on the app's server: displaying them triggers no call to Google Fonts or to any third-party service.

Your usage is not tracked: no profiling, no cookies, no ads. The only counter is the installation count (see above), and it does not look at what you do in the app. You can erase all your data at any time from Settings, and unsubscribe from notifications.

1. Who is responsible for the processing

The data processing described in this policy is carried out by:

Émilie Josse, independent artist-author, based in Toulouse (France).
Contact: [email protected].

HabitGotchi is a personal, non-commercial project, with no separate legal entity. No data protection officer has been appointed - the author is directly responsible.

2. What data is collected

2.1 Stored on your device only

The following data is stored locally in your browser (LocalStorage: keys hg4 and its copy hg4_backup, hg_game_*, hg_lang, hg_user_config, hg_install_pinged, hg_ios_banner_dismissed, hg_last_export, hg_push_migrated, hg_returnTab; SessionStorage: hg_reopen, for the time of a reload; two IndexedDB databases: hg-rdv for appointment titles and habitgotchi for a safety copy of the garden seed). It does not leave your device:

First name and nickname, if entered at first launch.
Today's habits as you define them, and their tick history by date.
The Gotchi's stage, experience points, petals, inventory objects, active accessories.
Energy, mood, internal log events (terminal).
Private journal entries, locked by a PIN code you choose.
The companion's memory: a short summary (max ~400 characters) of your weekly activity, written by the AI from your habits and notes, updated at most once a week. Stored on your device, it is also sent to Anthropic with AI requests (see 2.2) and can be erased at any time from the journal.
Menstrual cycle tracking data, if you turn this feature on (off by default).
The state of the procedural garden, the collaborative mandala, and the paintings made in the studio.
Interface preferences (palette, theme, ambiance, inclusive-language setting, interface language, voice).
The AI provider API key you provide to turn on the AI features (Anthropic by default) and, for an OpenAI-compatible service, the address of its API and the model name.
Scores and records of the three mini-games.
The date you first launched the app, the date of your last export, and a marker showing that the installation has already been counted.
A random technical identifier generated at first launch, used as a pseudonym with the push notification server; it contains no directly identifying data (no first name, no date).
Your appointment titles, kept in a local browser database (IndexedDB, database hg-rdv) so the reminder shows the right name without the notification server ever knowing it.

2.2 Sent to third-party services

The following transfers only happen when you use the feature concerned:

Anthropic (api.anthropic.com), default provider - receives the text you type and some context about the Gotchi's state, when you use one of the AI features. The request is authenticated with your own API key, which you get directly from Anthropic. If no key is set up or if the AI features are turned off, no call is made. Depending on the feature, excerpts from your journal (mood and free text) are included in this context: the Gotchi's daily thoughts send your notes from the last 48 hours (up to three, as excerpts); the support mode your notes from today; the weekly recap all the notes of the week in question. In addition, a "memory" - a short summary of one week of your activity written by the AI (see 2.1) - is attached to every AI request; it is regenerated at most once a week from all the notes of the past week, which means those notes are sent to Anthropic at that moment. According to Anthropic's commercial terms for the API, content sent this way is not used to train its models. The journal is never sent to the push notification server.
OpenAI-compatible providers (Mistral, Groq, OpenRouter, Ollama, or the address you enter in Settings ▸ AI) - if you choose one instead of Anthropic, it receives the same content as described above for Anthropic (text you type, Gotchi context, journal excerpts, memory), with your key. I have no connection with these services: their terms and privacy policies apply, to be read before using them. With Ollama on your computer, nothing leaves your local network.
Open-Meteo (api.open-meteo.com) - receives the geographic coordinates (latitude, longitude) you set, to fetch the local weather. When you search for a city in the settings, its geocoding service (geocoding-api.open-meteo.com) also receives the name you type and the interface language. No identifier is attached to the requests.
Sunrise-Sunset (api.sunrise-sunset.org) - receives the same coordinates to work out the sun phases (sunrise and sunset), used to adapt the visual ambiance.
HabitGotchi push notification server (lazymind-push-worker.m4t-studio.workers.dev, hosted on Cloudflare Workers) - receives, when you turn notifications on: your PushManager subscription (endpoint, p256dh and auth keys); a random pseudonymous identifier (a technical identifier generated on your device at first launch, containing no directly identifying data such as your first name); the time of the appointments you want to be reminded of and a technical appointment identifier, but never their title (which stays only on your device, in a local database, and is only put back together locally when the notification is shown); activity signals (recap generated, last activity) used to schedule reminders. To prevent abuse, the server reads the request's IP address transiently in order to rate-limit it, without keeping it; this address is also processed by Cloudflare as the host (see 5 and 6). Exchanges are restricted to the app's origin and incoming data is validated before processing. This server is under my sole responsibility.
Community objects (same server as push notifications) - receives a simple read request when you open the shelf. If you offer an object, it receives its pixel grid, its name and its type, with no identifier at all. The server reads the IP address transiently to rate-limit, without keeping it; Cloudflare sees it as the host (see 5 and 6). An accepted object is visible to everyone who uses the app. The filter is automatic, with no human review, and I can remove an object at any time.
GoatCounter (habitgotchi.goatcounter.com) - cookie-free visit counter. Receives a pixel once per device, at the first launch of the installed app (path /install, or /install-app for habitgotchi.app), and a read of the public total each time you open Settings. No identifier or app content is attached, but GoatCounter sees the IP address and the browser's technical information, like any web service.
Cloudflare Pages (habitgotchi.fr, habitgotchi.app) - hosts the app. Cloudflare sees your device's IP address on every load, in its technical logs.
Cloudflare CDN (cdnjs.cloudflare.com) - serves the static p5.js file used for graphics rendering. Cloudflare records your device's IP address in its technical logs.
Framaforms (framaforms.org, a service of the Framasoft non-profit, hosted in France) - only receives what you choose to type into the "report a bug or an idea" form, if you choose to open it. Nothing is sent until you submit the form. No app data is attached automatically.

The Nunito and Caveat fonts are self-hosted on the app's server: no call is made to Google Fonts or to any third-party service to display them.

2.3 Special categories of data

Two categories of data processed by HabitGotchi receive enhanced protection under the General Data Protection Regulation (GDPR, Article 9):

Menstrual cycle tracking - health data. Tracking is off by default. By turning it on, you give explicit consent to its processing. The data stays on your device and is never sent anywhere.
Private journal - may contain, depending on what you write, data about health, sex life, or philosophical or political opinions. The journal is protected by a PIN code of your choice and stored on your device. It is never sent to the notification server. However, if you turn on the AI features, excerpts from your notes are sent to the chosen AI provider (Anthropic by default) to personalize the Gotchi's replies (see 2.2): the daily thoughts use your notes from the last 48 hours, the support mode your notes from today, and the weekly recap all the notes of the week. The companion's "memory", regenerated at most once a week from the notes of the past week, is also attached to every AI request: information derived from notes older than 24 hours can therefore leave your device. This transfer is based on your explicit consent (Art. 9(2)(a)), given by turning on the AI features and setting up your API key. If you don't want any note to be sent, don't turn on the AI features; you can also erase the memory at any time from the journal.

3. Purposes of the processing

The data described above is processed solely for the following purposes:

Letting you use the app day to day (tracking your habits, writing in the journal, growing the Gotchi, painting in the studio, playing the mini-games).
Giving you a companion that adapts to your pace through the AI features (daily thoughts, weekly recap, support mode), if you turn them on.
Adapting the visual ambiance to the weather and sun phases where you are.
Sending you appointment and weekly recap notifications, if you turn on push notifications.
Improving the app - only from the feedback you choose to send, never from automatic usage collection.
Counting, in aggregate, the devices on which the app is installed.

No data is used for: targeted advertising, commercial profiling, sale to third parties, training artificial intelligence models, or analysis of how you use the app.

4. Legal bases

The legal bases for the processing, within the meaning of Article 6 of the GDPR, are:

Consent (Art. 6(1)(a)) - for turning on cycle tracking, push notifications, the AI features, and more generally for any opt-in feature.
Steps taken prior to entering into a contract (Art. 6(1)(b)) - for the basic operation of the app on your device (providing the service).
Legitimate interest (Art. 6(1)(f)) - for offline caching through the Service Worker, proper technical operation, and the security and abuse prevention of the notification server (rate limiting, transient reading of the IP address, which is not kept), and for the installation counting.

For the special categories of data mentioned in 2.3, the processing is based on your explicit consent (Art. 9(2)(a)), given by choosing to turn the feature on.

5. Recipients and third parties

The only recipients of data are the third-party services listed in 2.2, strictly within the scope described. There are no others: no tool analyzing your usage (the only counter is the installation count, see 2.2), no ad network, no customer relationship service, no marketing platform.

Privacy policies of the active third-party services:

6. Transfers outside the European Union

Some third-party services involve transferring data to countries outside the European Union:

Anthropic - United States. Transfers are covered by the Data Privacy Framework (DPF) and, failing that, by the European Commission's standard contractual clauses.
Cloudflare (app hosting, p5.js CDN and Workers) - global infrastructure, data possibly in the United States. Covered by standard contractual clauses.
Other AI providers and GoatCounter - depending on each one's infrastructure; check with them before using them. With Ollama on your computer, no transfer.
Open-Meteo - servers in Germany (European Union). No transfer outside the EU.
Sunrise-Sunset - service run from the United States.

7. Retention period

Data stored on your device - kept until you clear the site's data in your browser, or use the full deletion button in Settings.
Requests to Anthropic - retention is governed by Anthropic's policy (see link above). HabitGotchi keeps no server-side record of these exchanges.
Push notification server data - kept as long as your push subscription is active. When you unsubscribe (from the app or by revoking it in your browser), the subscription and the associated pseudonymous identifier are deleted. Without an explicit unsubscription, the subscription and notification preferences expire automatically at the latest 90 days after you last used the app (this period restarts every time you open it). Appointment data and activity signals are deleted after their expiry date (from a few days to two weeks depending on the type). Using the "Delete everything" button in Settings immediately erases all of this data on the server, without waiting for it to expire.
Shared objects - kept until I remove them. Since they are anonymous, I can't find yours to erase them automatically, and "Delete everything" doesn't remove them. Write to me with the object's name and I'll remove it.
Requests to another AI provider, GoatCounter counting - governed by their own policies.
Cloudflare technical logs - governed by their respective policies.

8. Your rights

Under Articles 15 to 22 of the GDPR, you have the following rights:

Right of access - all the data about you is stored on your device and can be viewed with your browser's developer tools (Application tab > Local Storage, key hg4). A structured JSON export is also available directly in Settings (export button, file habitgotchi_YYYY-MM-DD.json).
Right to rectification - everything you enter (first name, habits, journal entries, etc.) can be edited directly in the app.
Right to erasure - a "Delete everything" button is available in Settings: it erases the local data in LocalStorage (keys hg4, hg_game_* and other hg_* keys), unsubscribes from push notifications and erases all associated data on the notification server (subscription, preferences, upcoming appointments, activity signals, recaps), uninstalls the Service Worker and empties its caches, then reloads the app as if launched for the first time. The two small IndexedDB databases (hg-rdv and habitgotchi) are not emptied by this button: to erase them too, clear the site data from your browser settings (Clear site data).
Right to data portability - the export feature in Settings produces a structured JSON file that can be re-imported. The hg4 structure in LocalStorage can also be read and copied freely.
Right to object and to withdraw consent - any opt-in feature (push notifications, cycle tracking, AI features) can be turned off at any time from Settings, with no effect on the rest of the app. The companion's memory can also be erased separately from the journal.
Right to restriction of processing - by default the app runs entirely locally. Turning off the opt-in features restricts processing to strictly local data.

To exercise these rights, or for any question, write to [email protected]. You will get an answer within one month.

9. Cookies, trackers and local storage

HabitGotchi sets no cookies at all, whether functional, analytical or advertising.

The app uses the following browser technologies, which are not cookies within the meaning of the ePrivacy directive but are listed here for transparency:

LocalStorage (keys hg4, hg_game_* and the other hg_* keys, detailed in 2.1) - local storage of the user data described in 2.1.
IndexedDB (databases hg-rdv and habitgotchi) - local storage of a safety copy of the garden seed and of appointment titles, read by the Service Worker to show the right name in reminders. These titles are never sent to a server.
Service Worker - offline caching of the app's files (HTML, CSS, JavaScript, images, fonts, static data) and display of push notifications. It reads appointment titles from IndexedDB (locally, on your device) to write the reminder text, but sends no personal data outside.
PushManager - management of the push notification subscription, if you turn it on.

10. Security

Local storage - data stored on your device is protected by the browser's isolation mechanisms (Same-Origin Policy). Only the app's origin can access it.
Private journal - locked by a PIN code of your choice before it is shown. Note: the PIN doesn't encrypt the stored data, it restricts access within the interface. Someone with physical access to your device and to your browser's developer tools can technically read the LocalStorage content. The safest approach is still not to leave your device unlocked.
AI provider API key - the input field is masked on screen (password-type field). The key is nonetheless stored in plain text in the browser's LocalStorage: like any local data, it can be read by anyone with physical access to your device and its developer tools.
External transfers - all requests to third-party services are made over HTTPS with certificate validation.
Notification server - the identifier used is a random pseudonym that doesn't reveal who you are; requests are restricted to the app's origin, incoming data is validated before anything is stored, rate limiting protects against abuse, and inactive subscriptions expire automatically.

11. Contact and complaints

For any question about this policy or about exercising your rights: [email protected].

If, after contacting me, you feel your rights are not being respected, you can file a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL) - cnil.fr/fr/plaintes - or with the data protection authority of your country of residence.

12. Changes to this policy

This policy may change to reflect technical or regulatory changes. The version in effect and its effective date appear at the top of the page. Any substantial change (a new recipient, a change of purpose, a new category of data) will be clearly announced when you open the app.