Mocha Habits · Version 2.0 · Effective [DATE YOU PUBLISH]
The short version: what you write in Mocha Habits stays on your phone. We never receive it.
[LIKE THIS]. Everything else is final. A privacy policy that names no controller is not valid under GDPR Art. 13, and App Review rejects a policy URL showing placeholders.
[YOUR FULL LEGAL NAME], trading as Mocha Habits, is the data controller for the personal data described in this policy.
| Established in | United Arab Emirates |
|---|---|
| Contact address | [BUSINESS POSTAL ADDRESS] |
| Privacy contact | [email protected] |
| General contact | [email protected] |
A data protection officer is not appointed. Our processing is not on the scale that requires one, and the categories of data that would ordinarily trigger the requirement are not held by us at all — see section 2.
Mocha Habits is built so that the most personal things in it never reach us. Specifically, these never leave your device:
They are held in the app's own storage on your phone, protected by your device's encryption. We have no copy, no backup and no way to read them — not on request, not under legal compulsion, not by accident.
Your email address, and a display name if you provide one. Needed to give you an account and let you sign in on more than one device.
So your setup follows you to a new phone: your habit names and descriptions, categories and life areas, schedules and daily targets, which days you marked complete, rest days, program enrolments, breathing session counts, your app preferences and theme, and whether you have finished onboarding.
Habit names are written by you and can be personal ("therapy homework", "no drinking today"). They are stored because syncing habits is the feature. If that matters to you, name them in a way you are comfortable with, or use the app without an account.
Whether your subscription is active, and an anonymous purchase identifier. Payment is handled entirely by Apple or Google — we never see your card, billing address or full name from the transaction.
A number: how many coach messages you sent on a given date. No message content, not even a length. It exists solely to stop a stolen account running up an unlimited AI bill.
When you send a message to the coach:
Your journal and mood are not sent by default. Settings → Private journal is ON when you install the app. With it on, the coach receives your habits and consistency only. If you turn it off, a short excerpt of your most recent entry and today's mood are included so the coach can respond to what is actually going on — and turning it off is how you give explicit consent to that, which you can withdraw at any time by turning it back on.
The coach is not a therapist and does not diagnose. It refuses medical, medication, legal and financial questions, and it will not help build a habit that would harm you. See the Terms of Service, section 2.
Our database and authentication run in Supabase's EU West (Ireland) region. Your account and habit data is stored in the European Economic Area and stays there.
We are established in the United Arab Emirates, so our access to that data from the UAE is itself an international transfer under EU and UK data protection law. It is covered by the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum. The same clauses cover our US-based processors in section 7. You can request a copy of these safeguards at the address above.
| Processor | What they handle | Where |
|---|---|---|
| Supabase | Authentication, database, server functions | EU West (Ireland) |
| Anthropic | Generates coach replies; retains nothing for us | United States |
| RevenueCat | Subscription status | United States |
| Apple / Google | Payments, app delivery, push notification transport | Global |
| Vercel | Hosts this website | Global edge network |
Each is bound by a data processing agreement.
Two regimes apply to Mocha Habits at the same time, and we comply with both.
We are established in the UAE, so Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies to our processing. Under it you have rights of access, correction, erasure, restriction of processing, objection, and data portability, and you may complain to the UAE Data Office.
Mocha Habits is offered to users in the EU and UK through the App Store and Google Play, so the EU GDPR and UK GDPR apply to our processing of those users' data under Art. 3(2), and our database sits in Ireland. The legal bases below are stated in GDPR terms because that is the stricter of the two regimes; UAE users get the same treatment.
| What | Why | Legal basis |
|---|---|---|
| Email, display name | To create and secure your account | Performance of a contract — Art. 6(1)(b) |
| Habit structure and preferences | To sync your setup across your devices | Performance of a contract — Art. 6(1)(b) |
| Subscription status | To unlock what you paid for | Performance of a contract — Art. 6(1)(b) |
| Coach usage count | To prevent abuse and control cost | Legitimate interests — Art. 6(1)(f) |
| Journal excerpt and mood sent to the coach | Only if you switch off "Private journal" | Explicit consent — Art. 6(1)(a) and Art. 9(2)(a) |
| Security and fraud records | To keep accounts safe | Legitimate interests — Art. 6(1)(f) |
Information about your mental and physical wellbeing is special category data under GDPR Art. 9, and sensitive personal data under the UAE PDPL. We have designed the app so that we do not process it at all: it stays on your device. The single exception is the journal excerpt described in section 4, which happens only on your explicit, revocable consent.
Where we rely on legitimate interests, we have balanced those interests against your rights and concluded that a per-day message count — with no content attached — is the least intrusive way to prevent abuse. You may object to it under Art. 21 using the contact address above.
| Account and habit data | Until you delete your account, then erased immediately |
|---|---|
| Coach usage counts | 90 days, then deleted automatically |
| Administrative and security logs | 180 days |
| Subscription records | As long as required for tax and accounting under UAE law — currently 5 years from the end of the relevant tax period |
| Everything on your device | Until you delete it, or delete the app |
You have the right to: access your data; have it corrected; have it erased; restrict or object to processing; receive it in a portable format; and withdraw consent at any time without affecting processing already carried out.
Two of these are built into the app and need no request:
For anything else, email [email protected]. We respond within one month, as GDPR Art. 12(3) requires.
If you are unhappy with our response you can complain to your regulator: the UAE Data Office if you are in the UAE; the Information Commissioner's Office (ico.org.uk) if you are in the UK; or the supervisory authority in your country of residence if you are in the EU.
Mocha Habits is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and notify you directly without undue delay where the risk is high (GDPR Arts. 33–34, and the corresponding obligations under the UAE PDPL).
If we change this policy in a way that affects you, we will tell you in the app before the change takes effect. The version number and date at the top always reflect the current text.