Privacy Policy

Last updated October 13, 2026

Habitect is run by Edumame Inc. (“we”). This policy says what we collect when you use Habitect on the web, in the Mac app or through its API, why, and what you can do about it. It goes with our Terms.

What we collect

• Your account. Your email address and, if you continue with Google, the name and picture Google shares. A password you set is stored hashed by our authentication provider; we never see it.
• What you write and upload. Your notes, pages, journals, comments, files, recordings, agent tasks and their results, settings and themes.
• Invites. Invite codes you use or send, and the address you leave to request an invite. Which onboarding screens you reached and when (never what you typed), so if a personal invite code let you in, Habitect's admins can see how your start went. A personal invite letter from an admin may quote totals across Habitect (how many accounts there are, how many came back on more than one day), never anything about you.
• Usage. Counts of AI generations, agent tasks and minutes of recording, so your plan's limits can apply.
• Product analytics and session recordings. Which pages you open (their address, which can include a page's title), what you click, and, while you are signed in, a recording of the screen as you use the app. While Habitect is in closed beta, recordings show the screen as you see it, including your notes and what you type, so we can learn how the app is used and improve it. They never include passwords, email addresses, sign-in codes or API tokens. You can turn this off in Settings → Privacy.
• Bug reports. When you file one: what you write, any screenshots or screen recording you attach, and diagnostics about the app at that moment (the page, recent errors, recent slow or failed requests, the editor's state and the keyboard shortcuts you last pressed, not what you typed).
• Keys and tokens. API tokens you create for agents (stored so we can check them) and, if you bring your own OpenAI key, that key, encrypted. Only its last four characters are ever shown back.
• Technical data. Server logs with your IP address, browser and the requests made, kept to run and secure the service.

We do not use advertising trackers, and we do not sell your data.

Google user data

When you choose Continue with Google to sign in, Habitect asks Google only for your name, email address and profile picture (the openid, email and profile scopes).

You may also connect Google Calendar, Gmail, Google Drive, Google Docs and Google Sheets on the Plugins page, all in one sign-in or each on its own, and all optional. Habitect asks Google for a permission only when you connect the product that needs it, and never sends email: it only writes drafts, which you review and send yourself. In Drive it sees only the Google Docs you save from Habitect, and it reads a Doc or Sheet only when you give your agent its link, never changing it. Disconnecting any of them stops Habitect using it at once.

When you connect Google Calendar, Habitect asks Google for:

• openid: confirms which Google account you connected.
• email: your email address, to show which account is connected.
• calendar.readonly: read-only access to your calendars and their events, to show your schedule on the Calendar page and to find a meeting when you ask the chat about it (for example a reminder before it).

When you connect Gmail, Habitect asks Google for:

• openid: confirms which Google account you connected.
• email: your email address, to show which account is connected.
• gmail.readonly: read-only access to your Gmail, for the mail features you use: a list of emails in your notes, or one your agent reads when you ask. Habitect never sends, changes or deletes mail.
• gmail.compose: to save drafts you or your agents write into your Gmail Drafts, for you to review and send yourself. Google has no drafts-only permission; Habitect only ever creates or updates drafts and never sends.

When you connect Google Drive to save pages to Google Docs, Habitect asks Google for:

• openid: confirms which Google account you connected.
• email: your email address, to show which account is connected.
• drive.file: to save a page you choose as a Google Doc in your Drive, and to update that Doc when you save the page again. Habitect can see only the files it saved for you, never anything else in your Drive.

When you connect Google Docs, so your agent can read a Doc you give it, Habitect asks Google for:

• openid: confirms which Google account you connected.
• email: your email address, to show which account is connected.
• documents.readonly: read-only access to a Google Doc whose link you give your agent, so it can read it when you ask. Habitect never changes your Docs with it and does not list or browse them.

When you connect Google Sheets, so your agent can read a Sheet you give it, Habitect asks Google for:

• openid: confirms which Google account you connected.
• email: your email address, to show which account is connected.
• spreadsheets.readonly: read-only access to a Google Sheet whose link you give your agent, so it can read its cells when you ask. Habitect never changes your Sheets with it and does not list or browse them.

• How we use it. Only to show you your own schedule and mail in Habitect, to save the pages you choose to Google Docs, to let your agent read the Docs and Sheets you give it, and to help you prepare for your meetings, and, for the sign-in information, to create your account, sign you in and show your name and picture. Your email address is also used for the emails described below.
• How we store it. Sign-in information is kept in your account record with our authentication provider, InsForge. For a connected account we keep only its email address and a refresh token, encrypted and bound to your account; the token never goes back to your browser. Your events and mail are read from Google when a feature you use needs them and are not stored on our servers, except what you or your agents write into your notes (such as a day's events on your journal).
• Who we share it with. No one, except the service providers listed below that host Habitect for us, and, when you ask the chat about a meeting, the titles and times of that day's events go to OpenAI to answer you. We do not sell Google user data, use it for advertising, or use it to train AI models, and no person at Habitect reads it unless you ask us to, it is needed for security, or the law requires it.
• How to remove it. Disconnect the account in the Garden, which revokes Habitect's access at Google and deletes the token here, or ask us at admin@habitect.ai to delete your account and its Google data. You can also remove Habitect's access at any time in your Google Account permissions.

Habitect's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we use it

• To run Habitect: store and sync your notes, sign you in, and do what you ask of it.
• To run the AI features you use, such as Ask, generation and meeting transcription.
• To send the emails Habitect needs: sign-in codes, invites and replies to invite requests.
• To fix bugs you report and keep the service secure and working.
• To see which features are used and where the app is slow or confusing, so we can improve it.

Who else handles it

We share data only with the services Habitect runs on, and only for the purposes above:

• InsForge hosts our database, authentication and file storage.
• Vercel hosts the website and its servers.
• OpenAI receives the text or audio you send to an AI feature, and returns the result. Under OpenAI's API terms that data is not used to train their models.
• Google signs you in when you choose Continue with Google, and gives read-only access to the calendar and mail of a Google account you connect.
• Resend delivers our emails.
• PostHog keeps our product analytics and the session recordings described above.

Agents you connect (such as Claude Code or Codex running on your own computer) reach your notes with an API token you created. What they do with your notes is governed by those tools' own terms and by your accounts with them, not by us. The same goes for any calendar or other source you connect to them.

We may also disclose data when the law requires it, to protect people's safety, or as part of a merger or sale of the service, in which case this policy keeps applying to it.

What you make public

Pages you publish are visible to anyone with the link, under your public handle, until you unpublish them. Everything else stays private to your account and the people you share it with.

Cookies and storage on your device

We use cookies to keep you signed in and to remember an invite code during sign-up. PostHog keeps a random identifier in a cookie and your browser's storage to tell visits apart; signing out or turning analytics off in Settings → Privacy clears or stops it. The app keeps a copy of your notes in your browser's storage so it is fast and works offline; signing out or clearing site data removes it.

How long we keep it

We keep your account and notes for as long as you have an account. When you delete something it is removed from the app; backups that may still hold it are overwritten in the normal course. Bug reports and server logs are kept as long as they are useful for fixing and securing the service. Session recordings are deleted automatically by PostHog at the end of its retention period; turning recordings off in Settings → Privacy stops new ones, and you can ask us at admin@habitect.ai to delete the ones already kept.

Your choices and rights

You can delete your notes at any time in the app, and read all of them through the API with a token you create. You can turn off analytics and session recordings in Settings → Privacy. In Settings → Your data you can download everything we hold for your account as one file at any time, and delete your account with all of its data yourself. For anything else about your personal data, write to admin@habitect.ai and we will act within 30 days. Depending on where you live (for example the EU, UK or California) you may also have the right to object to or limit how we use your data, to take it with you, and to complain to your data protection authority.

Security

Data travels over HTTPS, access to your notes is limited to your account by the database itself, and secrets such as your own OpenAI key are encrypted. No system is perfectly secure, so please use a strong password and keep your API tokens private.

Where your data is stored

Habitect and the services above are based in the United States, so your data is processed there. By using Habitect you understand that it is transferred there.

Children

Habitect is not for children under 13 (or the minimum age in your country), and we do not knowingly collect their data. If you think a child has given us data, write to us and we will delete it.

Changes

If we change this policy, we will update the date above, and tell you in the app or by email before a significant change takes effect.

Contact

Questions about your privacy: admin@habitect.ai.