Privacy Policy

This policy covers two distinct properties:

• The marketing website (habit42.com), which uses stock photography only — no images on the public marketing site depict real users.
• The Habit42 application, where you create an account, join challenges, and submit your own real content — including photos you upload of yourself, your progress, and your activity.

The data practices below apply to information you provide through the application unless stated otherwise.

Account & Waitlist Data

When you join our waitlist or create an account, we collect your email address, name, chosen display name, password credentials, and any profile information you provide. If you join through a challenge invite or join code, we associate your account with the relevant challenge and organization.

Health & Wellness Data

Because Habit42 is a habit-accountability and challenge platform, the Service collects information you choose to log, which may include:

• Weigh-in entries and weight data
• Daily habit check-ins and completion logs
• Challenge progress, points, and leaderboard standings

Photos & Uploaded Media

Within the application, you may upload real photographs, including:

• Profile avatars
• Weigh-in photos (e.g., scale or progress photos you submit as part of a challenge)
• Community photos (images you share in challenge community feeds)

These are images of and by real users — not stock imagery. When you upload a photo, it is automatically stored on our systems (hosted with our storage provider, Supabase) and retained as part of your account and challenge records so the Service can display it to you and, where applicable, to other participants in your challenge. Uploaded photos are not deleted automatically, and you cannot remove an individual stored photo yourself unless a delete option is expressly provided in the app for that photo type. To have stored photos removed, you may request deletion of your account or specific content by contacting support@habit42.com, subject to the retention terms below and any retention required by law.

Community Content

When you participate in community features, we collect the posts, comments, and likes you create, along with the display name and avatar associated with your account.

Payment & Entry-Fee Data

For challenges that involve an entry fee, prize, or other payment, we may record your payment status and related details. Payments themselves are made through third-party services (such as Zelle, PayPal, or Venmo); we do not collect or store your full financial account numbers or card details. Please review those providers’ privacy policies for how they handle your payment information.

Usage & Log Data

We automatically log technical details including your IP address, browser type, device information, and your interactions within the Service to ensure smooth performance, security, and troubleshooting.

We use the information we collect to:

• Manage your waitlist status, onboarding, and account authentication.
• Operate the core Service: running challenges, recording habit check-ins and weigh-ins, calculating points and leaderboards, and displaying community content.
• Store and display photos you upload, according to the visibility settings of the challenge and your account.
• Process entry fees, track payment status, and administer prizes and prize claims.
• Deliver, maintain, secure, and troubleshoot the Service.
• Send you transactional and critical communications, including system updates, security alerts, onboarding and challenge-related messages, and pre-challenge tips.
• Send optional marketing newsletters, which you can opt out of at any time.

We do not sell your personal data to third-party data brokers.

We share information only as needed to operate the Service:

Other participants

Depending on your privacy settings and the challenge you join, certain information — such as your display name, avatar, community posts, leaderboard standing, and photos you share to the community — may be visible to other participants, challenge administrators, or organization hosts.

When final results are published, participants are identified on the leaderboard and results board by their display name — not their full legal name. If you do not set a display name, your name is shown as your first name and last initial only (for example, “Sarah M.”). You control the name shown to others through your display name settings.

Service providers (sub-processors)

We rely on trusted third parties to run the Service. These currently include:

• Supabase — database, authentication, file storage, and backend functions
• Vercel — application hosting
• Resend — transactional and marketing email delivery
• Sentry — application error monitoring and diagnostics
• Payment providers (e.g., Zelle, PayPal, Venmo) — for entry-fee and prize payments

These providers process data on our behalf and are bound by their own privacy and security commitments.

Legal reasons

We may disclose information if required by law, or to protect the rights, safety, and security of Habit42, our users, or others.

Habit42 includes a display name and privacy system that lets you control how you appear to other participants. You can choose the name shown in community feeds and leaderboards. We encourage you to review these settings to manage what other users can see.

We use functional cookies and similar technologies to keep you logged in (session management) and to preserve your system preferences. We may use third-party analytics tools to monitor system stability and user engagement. Functional cookies are necessary for the Service to operate.

Your data is stored using Supabase infrastructure, including a Postgres database protected by row-level security (RLS) policies and access controls that restrict data to authorized users and roles. Uploaded photos are kept in access-controlled storage buckets.

We implement industry-standard technical and organizational measures to prevent unauthorized access, alteration, or loss of data. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your email and account data will never be sold to third-party data brokers.

We retain your personal data for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. When you delete your account, or upon a valid deletion request, we will delete or de-identify your personal data, except where retention is required by law.

Depending on where you live, you may have rights regarding your personal data, including the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Opt out of marketing communications
• Withdraw consent where processing is based on consent

Residents of certain U.S. states (including Texas, under the Texas Data Privacy and Security Act, and other states with comparable laws) may have additional rights, including rights related to sensitive data such as health-related information.

To exercise any of these rights, contact us at support@habit42.com. You can unsubscribe from marketing emails at any time using the link in those messages; note that we may still send you essential transactional and security messages.

The Service is intended only for adults aged 18 and older. It is not directed to anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has provided us with personal data, please contact us at support@habit42.com so we can remove it.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last Updated” date above and, where appropriate, notify you through the Service. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or how we handle your data, contact us at: