Privacy policy

Version of 23 October 2026.

Who processes the data

The operator is the owner of Habbitonia, a private individual; the name is not published. Contact: the /support command in @Habbitonia_bot — a person reads the message, and the answer comes back there.

Habbitonia is a habit tracker that runs in Telegram and in your browser. An account is created the moment you first address the bot, the mini app or the web version.

What is collected

From Telegram

• your Telegram account id, name, username and language code — they arrive with every request and are the only way to recognise you;
• the sign-in signature confirmed by Telegram: it is verified and not stored.

What you enter yourself

• habits, goals, tasks, day slots and their schedules;
• check-ins: date, value, optionally a note, a mood rating and a link to a photo in Telegram;
• settings: timezone, day boundary, quiet hours, the daily notification limit;
• reminder rules;
• the public profile, partnerships and challenges — only if you switched them on;
• friends — only those with whom the friendship is mutual. A friend sees your name and only the habits you opened to friends yourself — and, from those, how your day is going in one word ("in rhythm", "in progress", "on pause") and your streak of days in rhythm. Hidden habits do not count; until you open one, a friend sees only your name. When you pick friends from your Telegram contacts, the bot receives only the people you picked — never your whole contact list. Whoever picks you from their contacts learns that you use Habbitonia only if you allowed it or accepted their invitation yourself. Friends see whether you can be nudged (off by default), and in a shared goal its title, taken from the proposer's habit (a habit hidden from friends — only if the proposer allowed its title to be shown), and the shared total — so each of the two can also tell how the other is doing; the other side's habit is visible only to them.
• groups — only the group chats where you yourself tapped "I'm in" under the bot's message. The group sees how many take part and the total — how many days in rhythm everyone has together, but only once at least three people stand behind it: a smaller number would give away someone's day. Your name and your day in one word — only if you switched it on; the day here is counted across all your habits, without their titles. Habit titles are not shown to the group, except the title of a goal you suggested yourself. The bot does not read the group chat and does not receive its member list; we keep the chat title, its Telegram id and which users take part in the totals. When the bot is removed from the group, this data is deleted.
• a group goal — only if you suggested it or take part in it. The group sees the goal's title (taken from the habit of whoever suggested it) and the total; the name of whoever suggested it — only if they switched their name on. How many take part is visible only to those in the group's totals — in Habbitonia, not in the chat. Which habit you take part with is visible only to you. While fewer than three take part, the total is shown neither to the group nor to those taking part — a sole participant sees only their own days.

What appears as the service works

• the log of sent notifications and reactions to them;
• unlocked achievements and spent freeze tokens;
• the fact of payment: the Telegram payment id, amount, plan, subscription term;
• the log of domain events: what happened to your account and when — without the content of your records. Achievements are computed from it, so it lives as long as the account does;
• support notes about your request, if you made one. You can see them in your data export — without the name of whoever wrote them;
• your conversation with support: your requests — with the /support command or from the app — replies to our messages and what we answered. It is in the export too — without which of us answered;
• the administrator action log: which of us opened your card, viewed your habits, event log or support conversation, wrote to you, exported, changed or deleted your data or subscription, and when, with an anonymised network address (to the subnet);
• technical server logs: request time, route, response code, an anonymised network address (to the subnet).

There are no card details anywhere: payment goes through Telegram Stars, and payment data never passes through the service in any form.

What stays in your browser

The app keeps a small amount of data on your own device, in browser storage. Nothing of it is sent anywhere, and it is erased together with the site data.

• the queue of check-ins made offline: habit id, date and value — until the connection is back and the check-in reaches the server. The queue is separated per account: on a shared device one person's check-ins are not visible to another;
• which in-app hints you have already been shown;
• small interface preferences: the chosen list view on Progress, the language of the admin panel.

There are no visit counters, advertising identifiers or tracking cookies, neither on the site nor in the app.

The session cookie in the web version

Inside Telegram the app works without cookies at all. If you open Habbitonia in an ordinary browser and log in with Telegram, the browser receives two cookies — and only these two:

• ritmo_web — the session itself. Inside is a token signed by the server: who you are, when the session was issued and when it expires. It carries no name, no habits and no check-ins. The page's scripts cannot read it, and it is sent only to this site;
• ritmo_web_csrf — a short random string the server uses to tell a request from the app apart from one forged by another site. It holds no personal data.

Both live for up to thirty days and are renewed on login. “Log out” in the settings erases them in the browser and closes the session on the server: a copy taken before you logged out will not work.

There is no consent banner on the site, and that is deliberate rather than an omission: these cookies are strictly necessary for the login to work, no analytics or advertising cookies exist, and without a login none of them is set at all.

Why

• to show your day, streaks and stats — that is, so the product works;
• to send the reminders you set up;
• to account for payments and the subscription term;
• to see where the service breaks and fix it.

The data is not used for advertising, not sold and not passed to ad networks. There are no third-party trackers or analytics scripts on the site or in the mini app.

Who it is shared with

• Telegram — message delivery and payments. Processing on Telegram's side follows their own policy;
• a hosting provider in the Netherlands — the server the service runs on and the database lives on;
• Sentry — error reports, when enabled. Habit texts, notes and sign-in data are stripped from reports before they are sent;
• Backblaze B2 — off-site storage of database backups. Copies are encrypted before upload (GPG AES256); the encryption key is not shared with Backblaze;
• an address you set yourself — if you configured webhooks, the product sends events about your check-ins and days there. Who owns that address and what happens to the data is up to you; a webhook can be switched off at any time.

Nobody else. Public authorities — only on a lawful request.

How long it is kept

• everything that belongs to the account — while the account exists;
• the notification log — 180 days, then deleted automatically;
• the conversation with support — while the account exists; it is deleted from our database with the account. Copies of your requests reach the administrators as Telegram messages and stay there;
• the domain event log and support notes — while the account exists: achievements are computed from the log, and deleting it separately would mean taking them away;
• the administrator action log — it is about our actions, not yours, and exists so you can ask who looked at your card. It stays after the account is deleted: with the internal account number, which then leads to no one — without your name or anything you kept here;
• technical logs — within a limited volume: old entries are pushed out by new ones, and every update of the service wipes the logs entirely;
• database backups — 14 days on the server and 30 days in external storage;
• payment records — as long as tax and accounting rules require, including after the account is deleted: then without a link to it.

Your rights

Both actions are available right in the product and need no correspondence:

• take everything — the /export command in the bot or the "Data and account" section in the mini app. One JSON file arrives with everything the system knows about you;
• delete everything — the /delete command or the same section. Deletion is irreversible: records are erased from the database, not marked hidden. Challenges you created and shared goals with friends disappear with the account — for the other side too. A group goal you suggested stays with the group under the same title, but without you and your days. Messages the bot has already sent to chats are not deleted.

There is one exception: payment records. The law requires keeping them, so after deletion the Telegram payment id, amount, plan and dates remain. In our database they are no longer linked to anyone: no name, no Telegram account id, nothing of what you kept here.

One caveat it is fairer to state up front: database backups are taken daily and kept for up to 30 days. A deleted account disappears from the working database at once, and from already taken copies as those copies age out and are deleted. Copies are encrypted and used only for disaster recovery.

You can correct data where you entered it. The app and the bot have no public profile or partnership; both are off by default. Removing a friend takes two taps on the Friends tab: “Remove friend” and a confirmation. They get no message about it, but you disappear from their friends list, and a shared goal, if any, ends for both of you.

How it is protected

• sign-in is possible only with a Telegram signature — an account id sent by the client is never treated as authentication;
• the connection is over HTTPS;
• inside Telegram, access tokens live in the app's memory rather than in browser storage; in the web version the session lives in a cookie the page's scripts cannot read, and every changing request is confirmed by a separate header;
• secrets and request addresses are stripped from logs and error reports.

There is no absolute protection. If data leaks, we will inform the affected users.

Children

The service is not intended for persons under 16 and does not knowingly collect their data.

Changes

The date at the top is the date of the current version. We announce material changes with a message in the bot; if you switched announcements off or the bot cannot write to you, it will not arrive — then the change shows only in the date.

Earlier versions: 21, 14, 12, 7, 6, 4 and 3 October, 27, 17 and 16 September 2026.