Privacy policy
Controller: Inithex Consultoria Integral SPA · hello@inithex.com
Who is responsible
The controller of your data is Inithex Consultoria Integral SPA. For any privacy question or to exercise your rights, write to hello@inithex.com.
The big picture
Chabits keeps as little as possible on the server. Your meals, calories, mood, notes, food photos and journal live on your phone. Only what two people need to see at the same time to play a challenge together goes to the server, plus what is needed for your account, AI quota and subscription.
What data we process
Account: email address, user ID, display name, character, color and language, and technical sign-in logs.
Two-player challenges: the challenge rules (name, duration, goal, activities, theme), who is playing, how many tiles you moved each day ("done today") and the text of your secret offer, which the other player only sees when the server reveals it at the end. Prize photos remain on the phone in this release.
Optional AI: only if you allow it, the reduced photo you choose with its description, or a workout text, to estimate calories. They are analyzed and discarded: not stored in our database or logs. We keep the request counter and, if you report an AI result, the selected result in that report.
Subscription: the status of your Chabits AI subscription as confirmed by Apple or Google Play (product, expiry and status) and its link to your account.
Safety: reports you send (about an AI result or another player) and blocks you make.
Barcodes: the scanned number is looked up on Open Food Facts; that service also sees your IP address.
We do not process location, contacts, date of birth, weight, microphone or advertising identifiers, and there are no ads or cross-app tracking.
Why, and on what legal basis
Providing the service you ask for (account, two-player challenges, sync, subscription): performance of a contract.
Analyzing photos or workouts with AI: your explicit consent. Food and exercise can reveal health data, so we ask separately and you can withdraw at any time in Privacy without losing the rest of the app.
Protecting players and the service (reports, blocks, text filter, abuse limits): legitimate interest in a safe environment.
Meeting legal obligations, such as answering lawful requests from authorities.
We do not sell your data, use it for advertising or use it to train AI models.
Who we share it with
The other player in a challenge: your display name, character, daily progress and, at the end and only when the rules say so, your secret prize. Never your meals, calories or notes.
Processors that run our infrastructure (Supabase, OpenAI and the email provider) and independent controllers (Apple or Google Play for payments, Open Food Facts for barcodes). Details under "Processors and transfers".
Authorities, only when the law requires it.
Where it is stored
The Chabits server is hosted by Supabase in the United States. Transfers outside the European Economic Area and your country rely on the European Commission Standard Contractual Clauses included in each provider's data processing agreement.
How long
Account, profile, challenges and progress: until you delete your account.
Photos and text sent to the AI: we do not store them. OpenAI and hosting providers may retain operational or abuse-prevention data under their policies; zero retention is not promised.
Reports: automatically deleted within 90 days.
Blocks and subscription status: until you delete your account.
Data on your phone: until you delete it or uninstall the app, subject to your phone backups, which you control.
Apple and Google keep their purchase records under their own policies.
Your rights
You can access, correct, export and delete your data, object to or restrict processing, and withdraw your AI consent. Most of it can be done in the app; the rest by writing to hello@inithex.com. You can also complain to the data protection authority in your country. See "Your rights and deleting your account".
Minimum age
Chabits is for people aged 16 or over. It is not directed at minors and we do not knowingly collect data from anyone younger. If you believe a minor gave us data, write to us and we will delete it.
Security
Connections are encrypted (HTTPS), your session is kept in the phone's secure storage, every server table is protected so you only see your own data and what your partner shares with you, and prize photos are kept in private storage. No system is perfect: if a breach affects you, we will tell you as the law requires.
Changes
If we change this policy in a meaningful way we will tell you in the app before it applies. The effective date is shown above.