Privacy policy

Last updated 3 October 2026

Poppy Habits is run by Gabriella Blanche, Nice, France, who is responsible for your personal data. Contact: gabriella@frejas.app.

What we store

Your email address if you have added one (to sign you in), the name and optional photo you choose, the habits you create (with their category) and when you tick them off, and the challenges, check-ins, photos, likes and chat messages you add.

You can use Poppy Habits without an account. We then store the same things, but no email address, and what you make can only be opened from the device you started on until you add your email in Settings.

If you block someone, we store that so it keeps working. If you report something, we store the report, who sent it, and a copy of what was reported, so that we can act on it. The person who looks after Poppy Habits reads what was reported, including a reported photo. The person you report or block is not told it was you.

If you turn on notifications in the iPhone app, we store the address Apple gives your phone for Poppy Habits, so that we can send them. Apple delivers the notification. The address is removed when you sign out. Reminders you set for a habit are kept on your phone.

Photos are resized and stripped of hidden information such as GPS location before they are uploaded.

To see how Poppy Habits is doing we also keep: which days you opened the app (the day, not the time), whether you found Poppy Habits on your own or through a friend's link, the feedback you send us, and your answers when we ask everyone a question. Feedback and answers are kept with your account, so that we can ask you more if we need to.

Why

To run the app for you: to show your habits and statistics, and to share your challenge check-ins with the people in that challenge. The legal basis is the agreement to provide the service (GDPR art. 6.1 b). We also count totals, such as how many people come back after a week or how many habits people have on average, to make Poppy Habits better. The legal basis is our legitimate interest in improving the service (GDPR art. 6.1 f).

Habits can say something about your health. They are private unless you choose to show them to friends, and we never sell or share them. When we count totals, the names of your habits are never part of it.

Who can see what

Private habits: only you. Challenges and their check-ins: only people who have joined that challenge. Nothing is public, and there are no ads. There are no tracking cookies.

Where the data is

Your data is stored in the EU (Ireland) with Supabase, which runs our database, sign-in and photo storage. Vercel hosts the app and Resend sends the sign-in emails. They are US companies and may process limited data, such as your email address and IP address, outside the EU. All of them process data only on our behalf, under data processing agreements and the EU standard contractual clauses or the EU–US Data Privacy Framework.

How long

As long as you use Poppy Habits, with or without an account. When you delete your account (or, without an account, everything) in Settings, your data is deleted right away and disappears from backups within 30 days.

Your rights

You can download your data and delete your account in Settings at any time. You can also ask us to correct or delete data, and complain to the French data protection authority, the CNIL (cnil.fr).

Poppy Habits is for people aged 13 and over.