Privacy Policy

Effective date: March 13, 2026

Habit School (the “Service”) values users’ personal information and complies with applicable laws and regulations related to personal information protection. This Privacy Policy explains what personal information the Service collects, why it is collected, how long it is retained, and the rights available to users.

1. Personal information we collect

The Service collects the following personal information.

• Required items: Google account email address, display name, and profile photo URL, collected automatically during Google sign-in.
• Optional items: weight, blood glucose, blood pressure, body composition data such as muscle mass, body fat percentage, and visceral fat; food photos; exercise photos/videos; sleep record photos; gratitude journal text.
• Automatically collected items: service usage records and access logs.

2. Purpose of collection and use

• Providing health habit records and statistics.
• Accumulating and managing points and HBT coins.
• Providing AI food and exercise analysis services.
• Operating gallery/community features.
• Running weekly missions and challenges.
• Improving the Service and responding to errors.

3. Retention and use period

Users’ personal information is retained while they use the Service and is deleted without delay after account deletion. If retention is required under applicable law, the information may be stored for the period required by law.

• Service usage records: deleted after account deletion.
• Uploaded photos/videos: deleted after account deletion.

4. Third-party provision

The Service does not provide users’ personal information to third parties without the user’s consent, except in the following cases.

• When the user has given prior consent.
• When required by law or regulation.

5. Entrustment of personal information processing

The Service entrusts processing of personal information to the following providers for stable operation.

• Google Firebase: data storage, authentication, file hosting.
• Google Cloud: AI analysis, including food and exercise photo analysis.

6. User rights and how to exercise them

Users may exercise the following rights at any time.

• Request access to, correction of, or deletion of personal information.
• Request suspension of personal information processing.
• Delete their account directly from the profile screen.

Requests may be made through the contact information below and will be handled without delay.

7. Security measures

The Service takes the following measures to protect personal information.

• Encrypted transmission through HTTPS.
• Access control through Firebase Security Rules.
• User-level data isolation so users can modify only their own data.
• Application of Content Security Policy (CSP).

8. Cookies and automatic collection tools

The Service uses Google Analytics to collect service usage statistics. Users may refuse cookie storage through browser settings, but some Service functions may be limited.

9. Changes to this Privacy Policy

If this Policy changes, the Service will notify users of the changes through notices in the Service.