1. Information we collect
Information you provide
We collect the information needed to create and maintain your account, including your name and email address. If you sign in with Apple or Google, we receive the account information that provider makes available to us, such as a provider identifier, verified email address, and name. Apple may provide a private relay address when you choose Hide My Email.
We also store the habit information you choose to create: habit names or categories, tracking type, target, creation date, completion dates, streaks, attempt history, and reminder choices. If you contact support or make a privacy request, we receive the information included in that communication.
Information generated when you use the service
- Account and session data: an internal user ID and authentication tokens. Access and refresh tokens are stored on your device in the iOS Keychain.
- Technical data: iOS platform, app version, time-zone identifier, request dates and times, IP address, and standard server or connection logs needed to operate and secure the service.
- Subscription data: product identifier, plan, purchase and entitlement status, expiration date, trial status, billing-issue or grace-period status, and related purchase events supplied by Apple and RevenueCat.
- Notification settings: whether reminders are enabled and the daily reminder time you select. Habit reminders are scheduled locally on your device.
The current service does not include advertising, cross-app tracking, third-party analytics SDKs, or access to your precise location, contacts, camera, or photo library.
2. How we use information
We use information to create and authenticate accounts; synchronize habits, completions, streaks, and history; determine access to subscription features; restore purchases; deliver reminders you request; provide support; maintain security; prevent abuse; investigate errors; comply with law; and improve the reliability and usability of Twenty-One.
Where applicable law requires a legal basis, we generally process information to perform our agreement with you, based on our legitimate interests in operating and securing the service, with your consent where required, or to comply with legal obligations.
4. Payments and subscriptions
Apple processes purchases through the App Store. RevenueCat helps us determine whether your subscription entitlement is active. Apple and RevenueCat may receive an app user identifier and purchase information such as the product purchased, transaction status, and expiration date. Their handling of information is governed by their respective policies.
Twenty-One does not directly receive or store your complete payment-card number.
5. Notifications
If you enable reminders, Twenty-One asks iOS for notification permission and schedules the reminder locally on your device. Reminder text may include the habit name and target. You can change notification permission in iOS Settings and change or remove habit reminders in the app where available.
6. Data retention
We keep account and habit information while your account is active and for as long as reasonably necessary to provide and secure the service. Authentication challenges and one-time exchange records expire and are deleted after they are no longer needed.
After a verified deletion request, we delete or de-identify account information unless retention is required for security, fraud prevention, accounting, dispute resolution, or legal compliance. Deleted information may remain temporarily in protected backups until those backups are overwritten under their normal lifecycle. Subscription transaction records may be retained where required for tax, accounting, fraud prevention, or legal compliance.
7. Your choices and privacy rights
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. You may also withdraw consent and complain to your local data-protection authority.
- Update available habit or account information in the app.
- Change notification permission in iOS Settings.
- Manage or cancel an Apple subscription in Apple subscription settings ↗.
- Delete your account from the account settings in the app. Apple-linked accounts require a fresh Sign in with Apple confirmation.
Deleting the app does not delete your account or cancel an App Store subscription. We may need to verify your identity before acting on a privacy request, and we will not discriminate against you for exercising a privacy right.
8. Data security
We use reasonable administrative, technical, and organizational safeguards designed to protect information. Authentication tokens are stored in the iOS Keychain and network requests use encrypted connections. No service is completely secure, so absolute security cannot be guaranteed.
9. International data transfers
We and our service providers may process information outside the country where you live. Where required, recognized safeguards are used for international transfers. Contact us if you need more information about safeguards relevant to your information.
10. Children’s privacy
Twenty-One is not intended for children who cannot legally consent to the processing of their personal information under the laws where they live. If parental or guardian consent is required, the service may be used only with that consent. If you believe a child provided information without valid consent, contact us so we can investigate and take appropriate action.
11. Changes to this policy
We may update this policy when the service, our data practices, or applicable law changes. We will revise the effective date and provide additional notice when required.
12. Contact us
For privacy questions or other data-rights requests, contact us through support@twentyonehabit.com. Account deletion is available directly from the app's account settings. Twenty-One is operated by Karen.