Privacy Policy

Draft — pending legal review. Last updated 14 September 2026.

The short version

Without an account, everything stays on your device. With an account we store your email, your habits and your check-ins so they sync and so pacts work. We do not sell anything to anyone, and you can delete all of it from inside the app.

Controller

Philipp Trinh, Döscherstraße 3, 22083 Hamburg, Germany. Contact: [email protected].

What we process

• Before you sign in: nothing leaves your device. Habits and check-ins live in local storage.
• Account: email address and password (stored hashed by our authentication provider). Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
• Your content: habit names, cadences, check-in dates, pact names and memberships. Same legal basis.
• Purchases: whether your Premium entitlement is active — from a subscription or from the one-off lifetime purchase. Apple and Google are the merchants of record; we never receive your payment details and never see your card.

What other members of a pact can see

Members of a pact you join can see the pact's habit, its members' display names, and which days each member checked in. They cannot see your other habits, your email, or anything outside that pact.

Anyone holding an invite link sees a preview before joining, and without an account: the habit's name and icon, its cadence and weekly target, how many people are in the pact, and the display name of the person who created it. No email addresses, no other members' names, and nothing about who checked in when.

Launch list on this website

Before the app is in the stores, you can leave your email address on this website to hear when it is. We store the address, when you signed up and when you confirmed. Nothing counts until you tap the link in the confirmation email; an address that is not confirmed within seven days is deleted. Legal basis: your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time by writing to the address above.

We send one email, on the day CountIn launches, and then delete the whole list. The address is stored with Supabase and the emails go out through Resend — the same processors as below.

Processors

• Supabase — database, authentication and hosting, in an EU region.
• Resend — sending the account emails (confirmation and password reset) and the launch-list emails. It receives the address the email goes to, and nothing else. Delivery runs through an EU region.
• RevenueCat — subscription status.
• Apple and Google — app distribution and payments, as merchants of record.
• Cloudflare — serving this website.

What we do not do

No advertising, no ad identifiers, no sale or sharing of personal data, no third-party trackers on this website, and no reading of anything on your device beyond the app's own data.

Retention and deletion

Data is kept while your account exists. Profile → Delete account removes the account together with your habits, check-ins and pact memberships. Backups roll off within 30 days. You do not have to ask us — but you may, at the address above.

Your rights

Access, rectification, erasure, restriction, portability and objection under Arts. 15–21 GDPR, and the right to complain to a supervisory authority.

Children

CountIn is not directed at children under 16.