Privacy Policy

Effective date: March 31, 2026

Instead ("we", "our", or "us") is a mobile application that helps you replace unwanted habits with healthier alternatives. This policy explains what data we collect, why, and how we protect it.

1. Data We Collect

Account Information

When you sign up via Apple, Google, or email, we store your email address, display name, and a generated username. We never see or store your Apple or Google password.

Habit & Behavioral Data

To provide the core service, we collect data you enter about:

• Habits you want to change and their healthier alternatives
• Swap logs, daily check-ins, mood ratings, and notes
• Slip logs, including optional trigger tags and intensity
• Estimated costs and frequency of habits

Health Data (Optional)

If you grant permission, we read the following from Apple HealthKit:

• Steps, active calories burned
• Heart rate, resting heart rate
• Sleep duration
• Body weight

Health data is stored securely in our database and is never sold, shared with advertisers, or used for marketing. We do not write to HealthKit. You can disconnect HealthKit at any time in your device settings.

Financial Data (Optional)

If you choose to connect your bank account via Plaid, we receive:

• Transaction amounts, dates, merchant names, and categories
• Institution name

We never see your bank login credentials — those are handled entirely by Plaid. We use transaction data solely to identify spending related to your habits and calculate savings. Bank access tokens are encrypted at rest. You can disconnect your bank at any time.

Community Data

If you participate in groups, challenges, or the community feed, we store your posts, comments, reactions, group memberships, and challenge progress. Content you post in public groups is visible to other users.

Device & Technical Data

We collect your push notification token (to send notifications you opt into) and device platform (iOS/Android). We do not collect device identifiers, IP addresses for tracking, or analytics data.

2. Third-Party Services

Service	Purpose	Data Shared
Supabase	Database, authentication, server functions	All app data (hosted infrastructure)
Plaid	Bank account connection	User ID; Plaid handles credentials directly
RevenueCat	Subscription management	User ID, purchase/entitlement status
Expo	Push notifications	Push token, notification content
Apple / Google	Authentication	Sign-in tokens (standard OAuth)

We do not use any analytics, advertising, or tracking SDKs. We do not sell your data to anyone.

3. How We Use Your Data

• Provide the service: Track habits, calculate savings, display health trends, power community features
• Send notifications: Reminders, milestone alerts, and weekly summaries you opt into
• Improve the app: Aggregate, anonymized usage patterns may inform feature decisions

We do not use your data for advertising, profiling, or sale to third parties.

4. Data Storage & Security

• All data is transmitted over HTTPS/TLS
• Financial tokens are encrypted at rest
• Row-level security policies ensure you can only access your own data
• Passwords are hashed and never stored in plain text
• Our database is hosted on Supabase (AWS infrastructure)

5. Your Rights & Controls

Access & Export

You can view all your data within the app. To request a full data export, contact us at the address below.

Deletion

You can delete your account from the Profile screen. This permanently removes all your data, including habits, swaps, health records, financial data, posts, and community memberships. Deletion is immediate and irreversible.

Disconnect Services

• HealthKit: Revoke in iOS Settings > Privacy & Security > Health
• Bank connection: Disconnect in the app's Bank Connection screen
• Notifications: Disable in the app's Notification Settings or iOS Settings

6. Children's Privacy

Instead is not intended for children under 13. We do not knowingly collect data from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

7. Data Retention

We retain your data for as long as your account is active. If you delete your account, all associated data is permanently deleted. We do not retain backups of deleted accounts.

8. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will notify you via the app or email. The effective date at the top of this page indicates when the policy was last revised.

9. Contact Us