Habit × Hack
English

Privacy Policy

Implementation draft — not yet legally approved. Revised September 1, 2026. The effective date and unresolved items must be finalized before publication.

Handlerr Inc. (the “Company”) establishes this Privacy Policy for the handling of user information in Habit × Hack (the “Service”). This English version is a translation of the Japanese policy. If the versions differ, the Japanese version prevails.

1. Scope

This Policy applies to the Habit × Hack mobile application, official website, and contact functionality. A third-party provider's own policy may apply when you use its website or service.

2. Information We Collect

The Company collects the following information to the extent necessary to provide the Service.

2.1 Account and authentication information

  • The user ID issued by Firebase Authentication
  • Your email address and verification status when you register by email
  • Information provided by Google and Firebase for authentication when Google Sign-In is used
  • Internal profile information generated when an account is created

Passwords are processed by Firebase Authentication and are not stored in the Company's Firestore database.

2.2 Content you enter

  • The trigger and action in an If–Then Plan
  • The title and description of a My Rule

This content is stored to provide functionality to you. The Company does not currently plan to use the content itself for advertising or analytics.

2.3 Contact information

When you contact the Company through the official website, the Company collects your name, email address, and message.

2.4 Technical information

Providers such as Firebase, Vercel, and Slack may process an IP address, device or browser information, access time, and error information to provide, secure, or troubleshoot their services. The actual configuration, retention, and scope of processing must be confirmed before publication.

No advertising or in-app behavior analytics SDK has been identified in the current repository. If such technology is introduced, this Policy and the relevant store disclosures will be updated in advance.

3. Purposes of Use

The Company uses collected information to:

  • provide the Service, authenticate users, verify identity, and synchronize data;
  • store, display, edit, and delete If–Then Plans and My Rules;
  • support password resets and other account operations;
  • respond to inquiries;
  • investigate and prevent failures, unauthorized access, and misuse;
  • provide important notices about the Service or this Policy; and
  • comply with legal obligations.

If information is used for a new purpose, the Company will provide notice or obtain consent as required by law.

4. Service Providers and Processing

The Service currently uses:

  • Google Firebase for authentication and cloud data storage;
  • Google Sign-In for authentication with a Google account, subject to confirmation of its production availability;
  • Vercel to host the official website and Contact API; and
  • Slack to notify the operator of contact messages.

The Company entrusts processing only as necessary for the stated purposes and exercises appropriate oversight. The contracting entities, processing locations, subprocessors, and details of processing outside Japan must be confirmed before publication, and information required by applicable law will be provided.

5. Disclosure to Third Parties

The Company does not provide Personal Information to third parties without consent, except where permitted or required by law, including where necessary to protect a person's life, body, or property.

Processing entrusted within the necessary scope, disclosure accompanying a business succession, and joint use conducted in accordance with law may not be treated as third-party disclosure under applicable law.

6. Retention and Deletion

The Company retains information only for as long as necessary for the stated purposes or required by law, after which it is deleted or anonymized. Specific schedules for account data, contact messages, and security logs must be finalized before publication.

An in-app process for initiating account deletion is available for accounts that use an email address and password. Support for anonymous accounts and Google authentication is incomplete. The current version deletes a supported authentication account and records a deletion timestamp on the Firestore user document, but complete deletion of associated data, including If–Then Plans and My Rules, is being improved. Until that work is complete, contact the Company through the contact page if you want an account or associated data deleted.

7. Security

The Company takes reasonable safeguards against unauthorized access, leakage, loss, or damage, including access controls, authentication, protected communications, and separation of secrets.

Repository management and auditing of Firestore security rules and indexes are in progress. Before publication, the Company will verify that users can access only their own data.

8. Your Rights

Subject to applicable law, you may request notice of purpose, access, correction, addition, deletion, cessation of use, or cessation of third-party disclosure concerning your Personal Information. The Company will verify your identity, respond as required by law, and notify you of the result.

The request procedure, identity verification method, response period, and any fee must be finalized before publication.

9. Tracking and Device Permissions

The current application contains a flow that requests Apple's App Tracking Transparency permission, but no implementation of advertising or cross-company tracking has been identified in the repository. The Company will verify the distributed application's actual behavior, avoid unnecessary permission requests, and align Apple's privacy disclosures with actual practices.

If tracking is introduced in the future, the Company will explain its purpose, obtain required permission, and not unfairly disadvantage users who decline.

10. Minors

If you are a minor, obtain the consent of a parent or guardian when required by applicable law. The Service does not provide medical diagnosis, treatment, or other professional advice.

11. Changes to This Policy

The Company may revise this Policy in response to changes in the Service or law. Material changes will be announced through the Service or official website, and consent will be obtained where required.

12. Contact

Questions about this Policy or user information, requests to exercise your rights, and requests to delete associated data may be submitted through the contact page.

Operator: Handlerr Inc.

Effective date: To be finalized before publication