Privacy Policy

Last updated: 20 April 2026

We built Ritual to be the habit tracker we wanted to use. Part of that means keeping as little of your data as we need to, never selling it, and being straightforward about what happens when you tap each permission prompt. This page is the plain-English version of that promise.

TL;DR

🔒

We only collect what we need to run the app: your email, a display name, and the habits you log.

🚫

We don't sell your data, run ads, or track you across other apps.

📸

Photos and location are only used when you choose to attach them as habit proof.

🪪

Face ID stays on your phone — we never see it.

🗑️

You can reset or delete all your data from inside the app, any time.

Who we are

Ritual is built by Bixu Studio, a small indie studio based in Australia. If you ever want to get in touch about your data, email ritual@bixustudio.dev — a real human will reply.

What we collect

Account information

Email address — to sign you in and send password reset links.
Password — never stored in plain text. Hashed and handled by our auth provider (Supabase).
Display name and chosen avatar icon — shown only inside the app.
Your stated goal — the one-line "why" you enter during signup, stored on your profile.

Habit data

The habits you create (name, cadence, settings).
Each time you log a habit (timestamp, streak count, XP earned).
Any proof you voluntarily attach: a photo, or a location check-in.

Device permissions

Ritual asks for these permissions only when a feature needs them:

Camera & Photos — only used when you choose to attach a photo as habit proof. Photos are stored against your account (so you can see your own history) and are never shared with anyone else.
Location — only read when you use a location-based habit (e.g. "check in at the gym"). We store the check-in, not continuous location tracking. Ritual never tracks you in the background.
Face ID / Biometrics — used locally on your device to unlock the app if you turn on the biometric lock. The biometric data itself never leaves your device and is not visible to us.
Notifications — used to send habit reminders you've opted into. You can turn these off any time in iOS Settings.

What we don't collect

We don't use third-party analytics SDKs that track you across apps (no Facebook SDK, no ad trackers, no fingerprinting).
We don't collect your contacts, calendar, messages, or health data.
We don't run ads, so we don't collect anything that would power one.

How we use your data

We use your data only to:

Authenticate you and keep your account secure.
Store, display, and sync your habits and progress across your devices.
Send transactional emails you asked for (e.g. password reset).
Diagnose crashes and bugs when they happen, so we can fix them.

We do not sell, rent, or share your personal data with advertisers or data brokers.

Who we share data with

We use a small number of trusted providers to actually run the service. Each one only sees what it needs to do its job.

Supabase — hosts our authentication and database. Your account and habit data lives here, encrypted at rest and in transit. Their privacy policy.
SiteGround — hosts bixustudio.dev (including this page and the password reset page). They do not receive your app data.
Apple — distributes the app via the App Store and handles any optional purchases. We never see your payment details.

If we ever add another provider, we'll update this page before it goes live.

Where your data lives

Your data is stored on Supabase infrastructure. Supabase uses Amazon Web Services data centres; your data may be stored in a region outside Australia. It is encrypted in transit (TLS) and at rest.

How long we keep it

We keep your account and habit data for as long as your account exists. If you use the Reset my data option in the app, we wipe all your habits and logs but keep your account. If you use Delete my account, we permanently delete your auth record and every row of data attached to it, usually within seconds.

We may keep minimal backup copies for a short period (up to 30 days) for disaster recovery, after which they are purged.

Your rights

No matter where you live, you can:

See your data — everything we have about you is visible in the app.
Correct your data — edit your profile and habits any time.
Delete your data — tap Delete account in Profile settings, or email us.
Export your data — email ritual@bixustudio.dev and we'll send you a copy.
Revoke permissions — manage Camera, Location, and Notifications in iOS Settings at any time.

If you're in the EU, UK, or California, you also have rights under GDPR / UK GDPR / CCPA (to access, rectify, erase, restrict, or object to processing). Email us to exercise any of them.

Children

Ritual isn't directed at children under 13 and we don't knowingly collect data from them. If you believe a child has created an account, email us and we'll remove it.

Security

We take sensible steps to protect your data — encryption in transit and at rest, hashed passwords, Row Level Security on every database table — but no online service is ever 100% secure. If something goes wrong, we'll tell you about it honestly and quickly.

Changes to this policy

If we make material changes, we'll update the date at the top and, where reasonable, notify you in-app or by email before the change takes effect. Continued use of Ritual after that means you accept the update.

Contact

Questions, requests, or concerns? Email ritual@bixustudio.dev.