Privacy Policy

Last updated: October 19, 2026

This Privacy Policy explains how Streakl processes information when you use the Streakl mobile application, visit the Streakl website, join the waitlist, send feedback, or contact us.

Streakl is operated by Philipp Romisch as a sole proprietor. For data-protection purposes, Philipp Romisch is the controller for processing described in this Policy.

Address: Holzhausenstraße 62, 60322 Frankfurt am Main, Germany
Privacy contact: philipp@streakl.app

Information We Process

Account and authentication data

Streakl uses Firebase Authentication. When you sign in with Google or Apple, Streakl may process:

• a Firebase user ID;
• your email address, display name, and profile image URL supplied by the sign-in provider;
• the authentication provider; and
• account creation and last-sign-in information.

Streakl does not receive your Google or Apple password. Google and Apple process authentication information under their own terms and privacy notices.

Habits, progress, settings, and synchronization

Streakl stores and synchronizes information you enter or generate in the app through Cloud Firestore, including:

• habit names and optional descriptions;
• habit preferences, goals, schedules, and reminder settings;
• completion history, tracked time, streaks, and statistics;
• optional notes;
• onboarding choices and app settings; and
• device and reminder records used for enabled push notifications.

Habit content is private to your account and is not published to other users. Free-text entries can reveal sensitive information; consider what you choose to store.

App usage analytics

Firebase Analytics is off until you choose Allow analytics. Manage consent under Settings → Data controls → Usage analytics. Leaving it disabled does not limit the app. Withdrawal stops new collection; existing aggregate or de-identified reports may remain.

With consent, we measure broad categories of setup, feature use, habit tracking, purchases, and access. Data includes action results, time or count ranges, broad habit categories, app and device information, language, time zone, installation identifiers, and approximate location. Checkout events can include product category, currency, and value.

We do not assign your account ID as the Analytics user ID or intentionally include habit text, notes, email addresses, feedback, notification tokens, or account identifiers in events. We do not use personal information for third-party advertising or cross-app tracking.

Crash reports and diagnostics

Firebase Crashlytics helps diagnose crashes, freezes, and stability or security issues. Reports can include error details, app state, device and operating-system information, app version, memory and storage information, and installation and session identifiers.

We do not assign your account ID to crash reports or intentionally add habit text, notes, email addresses, or feedback. Errors from the operating system or other software can contain unexpected information, so report access is restricted.

App security, configuration, and notifications

Firebase processes installation identifiers, sign-in tokens, app and device verification signals, software versions, and network information to secure the app, prevent abuse, and deliver configuration.

Local reminders are scheduled on your device. For enabled remote notifications, Firebase Cloud Messaging and our backend process device and notification identifiers, their link to your account, app and platform details, time zone, reminder preferences, scheduling, and delivery records. Manage optional reminders and notification permission in Streakl or your device settings.

Purchases and subscriptions

Apple or Google processes store payments; Streakl does not receive or store your full payment-card number. We use RevenueCat to display offers, verify purchases, manage access, and restore purchases. Data can include:

• your Firebase user ID as the RevenueCat customer identifier, or an anonymous purchase identifier before account linking;
• your email address and display name, when available, to associate the customer record with your account and assist with support;
• store, platform, product, and offer identifiers;
• transaction or original-transaction identifiers and store receipt or purchase-token data;
• purchase, renewal, expiration, cancellation, billing-issue, trial, introductory-offer, and entitlement status; and
• limited technical, device, app-version, country or region, and diagnostic information supplied by the store or SDK.

We use this data to provide access, restore purchases, prevent abuse, provide support, and meet legal obligations. Apple and Google process payment and store-account information under their own privacy notices. Purchase terms are explained in our Terms of Use.

Free and promotional access

Firebase checks your account creation and setup status, earlier promotional claims, and purchase or access history from RevenueCat to determine eligibility for free access. A separate record stores your account identifier, claim details, technical verification data, and start and expiry times. It prevents repeat claims for the same account and is not removed by ordinary in-app account deletion.

Local storage and export

Streakl stores local copies of habit and timer data, statistics, setup progress, preferences, profile-image links, and your Analytics choice to keep the app responsive.

Exports are created on your device as JSON or printable PDF files. We do not upload them to a separate export server. Any destination you choose through the share sheet handles the file under its own terms.

Deleting an account in the app clears Streakl's user-scoped local data on that device. Uninstalling the app or clearing its storage also removes app-local data, subject to operating-system backup behaviour.

Feedback and support

For feedback and support, we process your email, message, request details, app and device information, language, time zone, connection status, and relevant recent app interactions. Bug reports may include reproduction steps, expected and actual behaviour, and your follow-up preference.

Feedback is stored separately in our EU database and is not automatically removed when an app account is deleted. Processing feedback and operator notifications also involves backend services in the United States and email delivery through Brevo.

Website, analytics, and waitlist

Vercel hosts the website and processes IP addresses, browser and device information, requested pages, timestamps, and security logs. Fonts and icons are served locally, without browser requests to Google Fonts.

Vercel Web Analytics provides aggregate statistics on visits, referring websites, devices, browsers, and approximate location, including country. It uses a short-lived identifier derived from requests rather than analytics cookies. We do not link reports to app accounts or use them for advertising or cross-site tracking. This is separate from optional app Analytics. See Vercel's analytics privacy information.

If waitlist registration is available, Loops processes your email address and related delivery information to send the requested release notification. You can unsubscribe at any time.

How We Use Information and Legal Bases

We process account, habit, synchronization, tracking, export, reminder, and access data to provide the service you request under Art. 6(1)(b) GDPR.

App Analytics requires consent under Art. 6(1)(a) GDPR, including device access or storage requiring consent under Section 25 TDDDG. Withdrawal does not affect the lawfulness of earlier processing.

Crash diagnostics, app verification, and security and abuse-prevention logs rely on Art. 6(1)(f) GDPR: our legitimate interest in a secure, reliable service.

Where website measurement involves personal data, Art. 6(1)(f) GDPR supports our legitimate interest in understanding aggregate usage and improving the website without advertising profiles or cross-site tracking. Contact us to object to processing based on legitimate interests.

Purchase processing and restoration rely on Art. 6(1)(b) GDPR; legally required transaction records on Art. 6(1)(c); and necessary fraud prevention or dispute handling on Art. 6(1)(f).

Free-access eligibility and activation use Art. 6(1)(b) GDPR to provide the requested access. Retaining a minimal claim record to prevent repeat claims and resolve access disputes relies on Art. 6(1)(f) GDPR.

Enabled remote reminders rely on Art. 6(1)(b) GDPR and, where required, consent under Art. 6(1)(a) GDPR and device permission.

Support relies on Art. 6(1)(b) GDPR for service requests or Art. 6(1)(f) for our legitimate interest in responding to other enquiries. Waitlist registration relies on consent under Art. 6(1)(a). Necessary compliance or legal-claim records rely on Art. 6(1)(c) or (f), respectively.

If free-text habit content reveals special-category data, Art. 9 GDPR may apply. Streakl does not require such content; please consider this before entering particularly sensitive information.

Recipients and International Transfers

We do not sell personal information and do not use Streakl for third-party advertising or cross-app tracking. Relevant service providers and recipients include:

• Google Firebase and Google Cloud for accounts, data storage and synchronization, backend processing, free access, security, app configuration, consent-based app Analytics, diagnostics, and notifications;
• RevenueCat for customer and purchase records, offers, access verification, restoration, and free-access eligibility checks;
• Google Sign-In and Google Play for provider authentication, Android distribution, store billing, and subscription management;
• Apple for Sign in with Apple, Apple-platform distribution, store billing, and subscription management;
• Vercel for website hosting, security logs, and Web Analytics;
• Loops for waitlist and related email delivery; and
• Brevo as the SMTP delivery provider for feedback notification and support correspondence.

The primary Cloud Firestore database is located in the European Union. Backend functions for free-access verification, feedback, and related email processing run in the United States. Firebase, RevenueCat, the stores, and other providers may also process purchase, operational, support, security, and service data in the United States and other countries.

Where GDPR transfer rules apply, transfers rely on an available safeguard for the recipient and service, such as an adequacy decision or the European Commission's Standard Contractual Clauses in the applicable provider data-processing terms. Contact us for information about the applicable safeguards or a copy of them.

Retention

We retain information only for as long as needed for the described purpose:

• account, habit, progress, and settings data is kept while the account is active and removed after a valid deletion request;
• protected backup copies expire according to the applicable provider backup and recovery lifecycle and are not used to continue a deleted account;
• security and crash records are kept for investigation and resolution of incidents; installation, configuration, and notification records support active app installations and enabled reminders, subject to the provider's deletion schedules;
• when Analytics consent is active, the Google Analytics property is configured to retain event data for 2 months and user data for up to 14 months. Aggregated or de-identified reporting may remain after those periods;
• purchase and access records support active access, restoration, billing events, fraud prevention, legal recordkeeping, and unresolved disputes. Apple, Google, and RevenueCat retain their records under their policies and legal duties;
• the separate free-access record survives ordinary account deletion to verify access, prevent repeat claims for the same account identifier while the offer remains relevant, or resolve access disputes. You can request its review or deletion; continued retention requires a lawful, necessary purpose;
• feedback, delivery status, and support correspondence are kept while needed to deliver and resolve the request, provide follow-up, maintain service security, or handle legal claims;
• a minimal deletion-request record is kept only as long as reasonably necessary to demonstrate proper handling or comply with legal duties;
• website request and security logs follow Vercel's configured retention, with longer retention only for security incidents or legal duties;
• Vercel's request-derived analytics identifier is short-lived; aggregate traffic reports may remain after it expires; and
• waitlist information is retained until the waitlist closes, you unsubscribe, or you request deletion.

When longer retention is required by law or for legal claims, the information is restricted to that purpose and is not used to continue providing a deleted account.

Account and Data Deletion

Delete your account under Settings → Data controls → Delete account, or follow the account deletion instructions for an email request. Deletion removes the sign-in account, profile, habits, progress, statistics, settings, and reminder records. In-app deletion also clears account data on that device.

Deletion does not cancel a store subscription, issue a refund, or erase store purchase history. Cancel unwanted renewals in the store first. Separate purchase and customer records, free-access claims, support and security records, backups, and aggregate reports can remain for the limited purposes described above. Contact us to request deletion of separately stored identifiable records.

Your Choices and Rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to processing, receive portable data, or withdraw consent.

You can:

• change Usage Analytics under Settings → Data controls;
• control notifications in Streakl and your device settings;
• manage or cancel an active subscription in the applicable app store;
• export your habit data;
• delete your account in the app;
• unsubscribe from waitlist email; and
• contact us to exercise a privacy right or object to processing based on legitimate interests.

We may need to verify your identity before fulfilling a request. We will not ask you to send your password or an authentication code.

Right to complain

You may lodge a complaint with a data-protection supervisory authority, especially in the EU Member State of your residence, place of work, or the alleged infringement. For the controller address above, the competent authority is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden
Germany

Website: datenschutz.hessen.de

Security

We protect data with encrypted connections, account and app verification, access controls, and limits on diagnostic data. No storage or transmission method is completely secure.

Children

Streakl is not designed for children and is intended for users aged 16 and older. We do not knowingly collect personal information from children below the applicable minimum age. If you believe a child has provided information, contact us so we can investigate and delete it where appropriate.

Changes to This Policy

We may update this Privacy Policy as Streakl, its providers, or legal requirements change. We will update the last-updated date and provide additional notice where appropriate.

Contact

For privacy questions, rights requests, or account deletion, contact Philipp Romisch at philipp@streakl.app or the postal address above.