Privacy Policy

Version 2026-11-02.2 · Effective: 2 November 2026 · Last updated: 1 November 2026
Codegridz · support@codegridz.com · Rz-207, Dwarka Sector-16A, New Delhi, India

1. Who we are

Codegridz ("we") operates the INAT HABIT app. Contact: support@codegridz.com. Address: Rz-207, Dwarka Sector-16A, New Delhi, India.

This draft describes what the INAT HABIT code actually does today. It must be reviewed and completed by the developer, and by a qualified adviser, before publication.

2. What we collect

Each category below says what is collected, whether it is required, why, where it is stored, who processes it, how long we keep it and how you can access, correct or delete it.

2.1 Account and sign-in

• What: Name, email address, account ID, profile picture if you add one, and a password if you sign up with email. The password is stored only by Clerk, in hashed form, never by INAT HABIT. If you choose Google or Apple, Clerk receives your name and email address from that provider.
• Required or optional: Required. The app cannot be used without an account
• Purpose: Create and secure your account, sign you in, send verification and password-reset codes by email, and show your name and photo in the app
• Stored: With Clerk, our sign-in provider. A session token is kept in your phone's secure storage (Keychain on iPhone, Keystore on Android), never in ordinary app storage
• Who processes it: Clerk. Google or Apple only if you choose to sign in with them
• Retention: Until you delete your account
• Access, correction and deletion: Edit your name and profile picture in Profile. Delete the account in Profile, then Settings, then Delete Account

2.2 Profile and preferences

• What: Display name, profile picture (kept on your device and, if you are signed in, also saved to your account with Clerk), diet preference, workout days and time, reminder times and categories, calorie and water targets, quiet hours
• Required or optional: Optional
• Purpose: Personalise your schedule and dashboard
• Stored: On your device. Copied to Supabase only if you turn on cloud backup
• Who processes it: Supabase, if cloud backup is on
• Retention: On your device until you delete app data or your account. The cloud copy until you turn backup off or delete your account
• Access, correction and deletion: Edit in Profile. Turn off cloud backup to remove the cloud copy

2.3 Food and nutrition logs

• What: Foods you add from the library, custom meals, favourites, meal log text and estimated calorie and macro totals
• Required or optional: Optional
• Purpose: Show your daily nutrition summary
• Stored: On your device, and in the cloud backup if it is on
• Who processes it: Supabase, if cloud backup is on
• Retention: As for profile and preferences
• Access, correction and deletion: Remove entries in the app. Turn off backup or delete your account to remove the cloud copy

2.4 Skincare routines and notes

• What: Routine steps, product names you enter, your notes, clinician instructions you type, treatment nights and daily dryness, redness and stinging check-ins. This is health-related information
• Required or optional: Optional
• Purpose: Run your routine and show irritation warnings
• Stored: On your device, and in the cloud backup if it is on
• Who processes it: Supabase, if cloud backup is on
• Retention: As for profile and preferences
• Access, correction and deletion: As above

2.5 Workout, sleep, water and habit records

• What: Workout duration and completion, hours slept, water amounts, task completion timestamps, the confirmations or details you submitted as verification, a daily completion percentage kept as your streak history, and the milestones you have earned
• Required or optional: Optional
• Purpose: Verify tasks and calculate your progress, streaks and milestones
• Stored: On your device, and in the cloud backup if it is on
• Who processes it: Supabase, if cloud backup is on
• Retention: As for profile and preferences
• Access, correction and deletion: As above

Meal photos

• Meal photos you choose to add are stored privately with your account, up to 10 in total. You can remove any of them at any time, and they are deleted with your account.

2.6 Photos used as task evidence

• What: INAT HABIT does not upload or store the photo. Only the file name you selected is saved in the task record. The photo stays in your device's camera or photo library
• Required or optional: Optional
• Purpose: Support your own habit verification
• Stored: File name only, on your device (and in the cloud backup if it is on)
• Who processes it: No one
• Retention: As for profile and preferences
• Access, correction and deletion: Delete the photo in your device gallery. Delete records by removing app data or your account

2.7 Reminders

• What: Reminder settings and local notifications. Notification text avoids naming treatments
• Required or optional: Optional
• Purpose: Remind you of routines
• Stored: Scheduled on your device by the operating system. Settings are part of the profile data above
• Who processes it: Your device's operating system
• Retention: Until you change the settings. Pending reminders are cancelled when you delete your account
• Access, correction and deletion: Turn categories off in Profile or in your phone settings

2.8 Consent and policy records

• What: The policy version you accepted, the time, and your cloud-backup choice
• Required or optional: Acceptance is required to use the app
• Purpose: Show which version you accepted and respect your choices
• Stored: On your device and, for signed-in users, in the Supabase table consent_records
• Who processes it: Supabase
• Retention: Until you delete your account Consent acceptance records are retained only while the account is active and are deleted with the account through the account-deletion process. Codegridz may retain a minimal record only where required by applicable law or necessary to establish, exercise or defend a legal claim; any such record is access-restricted and retained only for the legally necessary period.
• Access, correction and deletion: Review and change the backup choice in Profile, Legal

2.9 Technical and network data

• What: INAT HABIT contains no analytics, advertising or crash-reporting SDK, and its fonts and code are bundled inside the app. Clerk, Supabase and their hosting providers process your IP address, device details and request logs when you sign in, back up data or delete your account
• Required or optional: Required for your account, and for backup if you turn it on
• Purpose: Operate and secure the service
• Stored: Clerk's and Supabase's own logs
• Who processes it: Clerk and Supabase
• Retention: Set by Clerk and Supabase Supabase and its hosting infrastructure may generate operational and security logs, including IP address and request metadata. Their retention is controlled by the provider and the applicable project plan; Codegridz does not set or promise a fixed provider-log retention period. See Supabase's current documentation and contractual terms.
• Access, correction and deletion: Not configurable in this version

3. Third parties

INAT HABIT has no advertising, analytics or data-broker integrations. We do not sell personal data.

• Clerk: sign-in, account details (name, email address, profile picture) and sessions.
• Supabase: the database, file storage and a server function that deletes accounts.
• Google and Apple: only if you choose to sign in with them. Their own privacy policies apply to that step.
• Expo Notifications: schedules reminders on your device only.
• Fonts and code libraries are bundled in the app, so it does not load them from third-party servers.

4. Security

No system is perfectly secure, so we cannot guarantee absolute security.

• Data is sent over HTTPS.
• Your sign-in session is kept in the phone's secure storage (Keychain or Keystore).
• Database tables use Row Level Security, so signed-in users can reach only their own rows.
• The evidence storage bucket is private and limited to each user's own folder.
• Privileged actions such as account deletion run on the server. No secret or service-role key is in the app.

5. Legal bases

Where laws such as the GDPR apply: contract (to run your account), consent (cloud backup of health-related entries, which you can withdraw at any time) and legitimate interests (security and abuse prevention). For users in India, personal data is processed on the basis of the user's clear, informed and purpose-specific consent and other grounds permitted by applicable law. Where GDPR or similar laws apply, processing is based on the applicable lawful basis for each purpose; optional cloud backup is enabled only by the user's affirmative choice. Codegridz will not rely on this summary as a substitute for any additional consent or legal basis required for sensitive or special-category data.

6. International transfers

Cloud data is stored with Supabase in the US East (us-east-1) region. Account data is processed by Clerk, which may store it in other countries. Providers may process data in other countries. The primary Supabase project is configured for the US East (us-east-1) region, so data you store in the cloud is processed outside India. Supabase and its subprocessors may process limited data in other locations to provide hosting, security, support or infrastructure. Such processing is subject to the provider's current data-processing terms and applicable transfer safeguards required by law. Users should consult the current Supabase subprocessor and transfer documentation.

7. Children

INAT HABIT is not directed to children under 18 years. [DEVELOPER TO CONFIRM MINIMUM AGE AND CHILDREN'S DATA OBLIGATIONS] If you believe a child provided data, contact us and we will delete it.

8. Retention exceptions

No retention exceptions are implemented. Provider backups may persist for a limited period When an account deletion request is verified, Codegridz will initiate deletion of the account and associated active cloud records within 30 calendar days. Residual copies in provider-managed backups, if any, may remain until the provider's normal backup rotation or deletion cycle completes, subject to applicable law and the provider's terms. Codegridz does not promise a backup-erasure date it cannot independently control.. Law may require limited retention in specific cases Supabase and its hosting infrastructure may generate operational and security logs, including IP address and request metadata. Their retention is controlled by the provider and the applicable project plan; Codegridz does not set or promise a fixed provider-log retention period. See Supabase's current documentation and contractual terms..

9. Your rights and requests

You can access and correct data in the app, export your on-device data from Profile, withdraw cloud backup, and delete your account in the app or through the public deletion page. For other requests write to support@codegridz.com. We aim to respond within 30 calendar days. You may also complain to your data protection authority.

10. Changes

When this policy changes we publish a new version and ask you in the app to accept it again before you continue.

11. Contact

Codegridz, Rz-207, Dwarka Sector-16A, New Delhi, India, support@codegridz.com.