Brought to you by StillCFO
Habit Ledger Privacy Policy
Habit Ledger is a local-first habit tracker from StillCFO LLC. Your habits stay on your devices. You never have to create an account; signing in is optional and only needed to use Habit Ledger on more than one device.
What stays on your device
Habits, check-ins, skips, notes, reminder times, settings, and badges are stored on your phone in an on-device database. Unless you choose to sign in (see Optional account), StillCFO never receives your habit content.
The Home Screen widget reads a small summary the app writes on the same phone. Reminders are local notifications scheduled on the phone.
If you turn on iCloud sync, your habit data is copied through your own iCloud account to your other Apple devices. Apple handles that transfer; StillCFO does not receive it.
If you use the Apple Watch or Wear OS app, your phone sends today's list directly to your paired watch, and check-ins you make on the watch go straight back to the phone. That link runs between your own devices (through Apple's Watch connection or Google Play services on Android); StillCFO does not receive it.
On Android, the app's data is included in your phone's backup to your own Google account (Android Backup), so it comes back when you set up a new phone. Google handles that backup; StillCFO does not receive it. You can turn Android Backup off in your phone's Settings.
If you use NFC check-in, the tag holds only a link that opens the app to check in that habit. Nothing about you is written to the tag.
What we do not collect
- No email address, name, or phone number, even if you sign in
- No cloud copy unless you choose to sign in (see Optional account below)
- No analytics, advertising, or crash-reporting tools
- No raw Health readings sent anywhere (if you sign in, only the habit check-ins they create are synced)
Optional account
If you choose to sign in with Apple or Google, Habit Ledger keeps your buddy, habits and history in step across your devices. To do that, StillCFO stores:
- a sign-in ID from Apple or Google (a random identifier, not your email or name),
- a label for each signed-in device (for example "iPhone") and when it was last used, so you can sign devices out,
- one copy of your app data (the same contents as a backup file: habits, check-ins including ones Apple Health or Health Connect completed, notes, settings, your buddy, your birthday month and day if you added it, savings goals and subscription-tracker entries), so your other devices can sync.
With Apple, we ask for no name or email. Google's sign-in always includes your email address in the sign-in token it sends; our server reads only the sign-in ID from it and does not store your email or name.
This copy is encrypted in transit (HTTPS) and at rest by our host, but it is not end-to-end encrypted, so our server software can read it in order to sync it. We don't look at it, and we never use it for anything but syncing. It lives on Cloudflare's servers in the United States, operated for StillCFO. We don't sell it, share it, or use it for advertising. You can delete your account at any time in Settings → Account → Delete account; that removes the account, every login, every device and the synced copy from our servers. The habits already on your phone stay there.
Health (optional)
Health is off unless you turn it on in Settings. If you choose Suggest or Auto, Habit Ledger reads data you've already logged on your phone to suggest or complete a matching habit: on iPhone (Apple Health), steps, water, sleep, workouts, mindful minutes, and medication doses; on Android (Health Connect), steps, hydration, sleep, and exercise sessions. It only reads; it never writes Health data, and the readings never leave your phone. Checking a habit by hand always works. You can turn access off anytime in Settings → Health, in the Health app on iPhone, or in Health Connect on Android.
Health data is used only to check off your habits. It is never sold, never shared, never used for advertising, and never used to build profiles. Health readings themselves are never stored or synced. If you sign in, the habit check-ins they create (for example, a medication habit marked done) are part of your synced data. Habit Ledger's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements, and its use of Apple HealthKit data follows Apple's HealthKit guidelines.
Your birthday (optional)
If you add your birthday so your buddy can throw you a party, we keep only the month and day (no year), on your phone. It's included in backups, iCloud sync, and account sync like your other settings.
Who helps us run Habit Ledger
- Apple and Google: the App Store and Google Play process purchases; Sign in with Apple and Google Sign-In confirm who you are if you choose to sign in.
- RevenueCat: confirms purchases and restores.
- Cloudflare: hosts habitledger.app, the optional account server, and its database.
- Google Fonts: may serve the app's typefaces on first launch.
They act for us and may not use your data for their own purposes. We don't use any advertising, analytics, or tracking services.
Purchases
The free plan includes up to 3 habits, local reminders, and 3 starter buddies. Habit Ledger Standard ($6.99 a month) and Habit Ledger Plus ($39.99 a year, with 7 days free) are optional subscriptions. You can cancel anytime in your App Store or Google Play account.
There are no in-app coin purchases. Coins are earned by checking in and can't be bought.
Purchases are processed by Apple or Google. StillCFO uses RevenueCat to confirm that a purchase or restore went through; it receives the purchase receipt and an anonymous app user ID (or, if you sign in, your random Habit Ledger account ID, so a plan bought on iPhone also works on Android), not your habits. StillCFO never sees your card details. Restore uses the Apple or Google account on your device.
Network use
The app may download its typefaces from Google Fonts the first time it runs. That request includes your device's IP address, as any web request does, but nothing about you or your habits.
Buying and restoring use Apple, Google, and RevenueCat over HTTPS. iCloud sync, if you turn it on, uses Apple; Android Backup uses Google. If you sign in, syncing uses api.habitledger.app. Once a day the app may check habitledger.app for new seasonal items and buddies; that download sends nothing about you. Nothing else leaves the device.
Deleting your data
Without an account, everything lives on your devices, and deleting the app deletes your data. If you use iCloud sync or Android Backup, a copy also lives in your own iCloud or Google account, which only you and Apple or Google can reach. If you signed in, delete your account in Settings → Account → Delete account to remove our copy, or follow the steps at habitledger.app/delete-account.
Children
Habit Ledger does not ask for age or include social features. It is suitable for teens and families. Kid profiles never see purchase prompts, and in Kid mode signing in requires a grown-up check. Before an account is created, the app asks your age without suggesting an answer; accounts are for ages 13 and up, and under-13s are asked to have a parent sign in with the parent's own account instead. If you believe a child under 13 created an account, contact us and we'll delete it.
Changes
If this policy changes, we'll update this page and the date at the top.
Contact
Questions: support@habitledger.app. Help with the app: Habit Ledger Support.