Privacy policy for the Habitat Flow app (iPhone)

Effective from 3 October 2026. This policy covers Habitat Flow for iPhone. The app works alongside the habitat.flow cube and Habitat Flow for Mac: it shows what your Mac is offloading from cards and lets you start a focus session that your Mac can see. The last section covers the habitat-flow.com website, Habitat Flow for Mac, e-mail sign-ups and purchases.

Who processes your data

The controller is Michał Liszcz, a sole trader trading as Motion Pikczer Michał Liszcz, NIP (Polish tax ID) 5170271864, ul. gen. Romualda Traugutta 23, 95-039 Sokolniki-Las, Poland. Contact: [email protected]. The app's server runs at habitat-system.com and is hosted in Poland.

What we collect and why

• E-mail address: to link your phone to your Habitat Flow licence, using the same address as on your Mac. Without an account, only Focus is available.
• Installation ID (a random UUID): to recognise this phone when you activate it with a code.
• Activation data: when you activate the app, we store your IP address, country, and the approximate city and internet provider derived from the IP address, to detect licence abuse.
• Push notification token (APNs), device model and iOS version: to send a “verified” notification when your Mac finishes a card.
• Focus sessions (state and time remaining): so your Mac can show the countdown from your phone. We do not store focus session history on the server.
• Data from your Mac, reported by Habitat Flow for Mac: computer name, model, app version, GB and card counts, camera labels, project and shoot-day names, the project folder tree, ingest progress (percentage, file count, speed and current file name), and the last 200 ingests. Only you can see this data, in your own account. It does not include file contents or thumbnails.

The legal basis is performance of a contract (your Habitat Flow licence), under Article 6(1)(b) of the GDPR. We process activation data based on our legitimate interest in protecting the licence from abuse (Article 6(1)(f) GDPR). The e-mail address you enter in the app is also added to our Habitat Flow mailing list; we send these updates based on our legitimate interest (Article 6(1)(f) GDPR), and you can unsubscribe with one click in any e-mail. There are no ads in the app, no cross-app tracking and no profiling. We do not sell your data.

How long we keep it

For as long as you have an account. The ingest history keeps up to the last 200 entries per Mac; older entries are removed automatically. Ingest progress and focus session state are current values that are overwritten as they change.

Deleting your account

In the app, open your account in the top right, then choose “Delete account”. The server deletes your activations together with the activation data, the list of Macs with their ingest history and folder trees, your push notification token and your focus state, and removes your e-mail address from the mailing list if it came only from the app. The Pro plan assigned to your e-mail address (a purchase or licence) is kept as a billing record. You can also write to [email protected].

Who receives your data

Apple (APNs, to deliver notifications), Resend (to send your activation code and updates by e-mail), Cloudflare (to route traffic to the server and protect it from attacks), ip-api.com (approximate location from the IP address at activation) and zenbox (server hosting). No one else.

Transfers outside the EEA

Apple, Resend and Cloudflare are US companies, so your data may leave the European Economic Area. These transfers rely on a European Commission adequacy decision (the EU-US Data Privacy Framework, for companies certified under it) or on standard contractual clauses approved by the Commission. You can get a copy of these safeguards by writing to [email protected].

Your rights

You have the rights of access, rectification, erasure, restriction of processing, data portability and objection. Write to [email protected]. You can lodge a complaint with the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

Giving your e-mail address is optional, but without it only Focus is available. We do not make decisions about you based solely on automated processing, including profiling.

The habitat-flow.com website, the Mac app and purchases

The Polish version of this section is part of our main privacy policy.

• E-mail sign-up. When you leave your e-mail on habitat-flow.com, we store the address, date, sign-up source, language, the country derived from your IP address, your IP address and browser data (user agent). We send the download link and information about your plan because you asked for them (Article 6(1)(b) GDPR), and occasional updates about habitat and Habitat Flow based on your consent (Article 6(1)(a) GDPR); you can withdraw it with one click in any e-mail. We keep the IP address, browser data and date to protect the form from abuse and to be able to show when you consented (Article 6(1)(f) GDPR).
• Habitat Flow for Mac. When you register, the app sends your e-mail and a random installation ID (we store only its hash) to our server, and we e-mail you an activation link. At activation we store the same activation data as for the iPhone app. On later launches the app sends the Mac model, chip, macOS version, amount of RAM, app version, computer name, counters (GB ingested, cards, number and length of focus sessions), camera labels and recent ingest history; never file contents. We use this to issue and refresh your licence and to show ingest status on your iPhone (Article 6(1)(b) GDPR), and to detect licence abuse and improve the app from aggregate counters (Article 6(1)(f) GDPR). The app downloads updates from GitHub, which sees the IP address of your Mac.
• Purchases. The app opens a Stripe payment page where you enter your e-mail, name, billing address and, optionally, a VAT number. Stripe passes these to us after payment; we assign the licence to your e-mail, send it to you (Article 6(1)(b) GDPR) and issue an invoice through Fakturownia, as tax law requires (Article 6(1)(c) GDPR). For fraud prevention and its own legal duties Stripe acts as a separate controller.
• Analytics and Meta Pixel. Pirsch Analytics counts visits to habitat-flow.com without cookies or profiling (Article 6(1)(f) GDPR). The Meta Pixel on habitat-flow.com runs only after you consent in the small prompt at the bottom of the page; without consent the Meta script does not load and nothing reaches Meta. It sends Meta Platforms Ireland information about the pages you visit and selected actions, together with your IP address, browser data and an identifier stored in a Meta cookie, our only marketing cookie (for example _fbp). We use it to measure how our ads on Facebook and Instagram perform, based on your consent (Article 6(1)(a) GDPR). You can withdraw consent at any time with the “cookies” link in the page footer; withdrawal does not affect processing carried out before it. We and Meta are joint controllers for collecting this data on our pages and transmitting it to Meta (Article 26 GDPR); after that Meta processes it as a separate controller under its own privacy policy. Your choice is stored in your browser (localStorage); after you decline, we delete the Meta cookies for the domain. You can also block or delete these cookies in your browser settings.
• Recipients. zenbox (hosting, Poland), Cloudflare (traffic, security, country lookup and incoming mail routing), Microsoft (our Outlook mailbox), Resend (e-mail delivery and mailing list), Stripe (payments), Fakturownia (invoices), Pirsch (analytics), Meta (Pixel), ip-api.com (approximate location at activation) and GitHub (Mac app updates). Several of them belong to US groups; transfers rely on the EU-US Data Privacy Framework for certified companies or on the Commission's standard contractual clauses.
• Retention. Mailing list: until you withdraw consent; after you unsubscribe we keep only the address marked as unsubscribed so that we do not write again. Orders, licences and invoices: for the period required by tax and accounting law, generally 5 years from the end of the calendar year in which the tax payment deadline passed, and where needed to defend claims, until they become time-barred. Mac activations and devices: until you delete your account or ask us to delete them.

Your rights described above apply here too. You can also object at any time to processing based on our legitimate interest, and to direct marketing without giving a reason.