Privacy Policy

You create an APEX account with an email address and a password. Passwords are never stored in readable form — authentication is handled by Supabase, which stores a hashed password only. If you choose to sign in with Google instead, we store the Google account identity linked to your APEX account rather than a password.

Password-reset emails are sent by Supabase Auth, using the email address on your account.

The app stores the following so that it can work at all:

• Your answers to the eight onboarding questions, together with the personalized starting habit plan generated from them, held as a draft until you confirm it, plus a flag recording whether onboarding is complete.
• Your habits: the habit name, which weekdays it is scheduled for, whether it came from your generated plan, was suggested, or was created by you, its position in your list, and whether and when it was archived.
• Your completions: which habit was marked complete on which calendar date. This is what your progress and consistency views are built from.
• Your subscription record: the status of the subscription, the current period start and end, trial start and end where a trial applies, and cancellation flags.

Your account record also carries a small number of unused fields inherited from the project template — full name, avatar, billing address and payment method. APEX does not currently write anything into them, and the app never asks you for that information.

APEX does not receive, process or store your card details. Paddle acts as the Merchant of Record for APEX purchases and handles the payment transaction, billing and the related payment processes, including applicable tax. Card details are entered into Paddle's checkout and stay with Paddle.

What APEX receives back is the subscription state described above — whether a subscription is active, the period it runs for, and whether it has been cancelled — which is what unlocks access to the app.

• To create and operate your account, and to sign you in.
• To generate your personalized starting habit plan from your onboarding answers.
• To record your habits and daily completions, and to show your progress and consistency.
• To manage your subscription and decide what your account has access to.
• To keep the service secure, to detect and prevent abuse, and to answer your support messages.
• To operate, maintain and troubleshoot the service itself.

We do not use your habits, completions or onboarding answers for advertising, and we do not build advertising profiles.

APEX uses Supabase authentication cookies to keep you signed in. The browser authentication client can access these session cookies; recovery proof cookies are httpOnly.

Three additional short-lived httpOnly cookies — apex-recovery-email, apex-recovery-sent-at and apex-recovery-verified — are used only while you are going through the password-reset flow, and only for that purpose.

The marketing intro animation on the public site uses a single key in your browser's sessionStorage so it does not replay on every visit. That value stays in your browser.

There are no advertising cookies and no cross-site tracking cookies on APEX.

We keep the list of providers deliberately short. These are the only ones involved:

• Supabase — authentication and database hosting. Your account, habits, completions and subscription records live here.
• Paddle — payments and Merchant of Record. Handles checkout, billing and payment-related processes including tax.
• Vercel — application hosting. We also use Vercel Analytics, which collects aggregate, privacy-friendly page-view data rather than tracking individual people across sites.
• Google — involved only if you choose to sign in with Google.

These providers act on our behalf to run the service, and are not permitted to use your data for their own unrelated purposes.

APEX does not sell your personal data, and does not share it with third parties for their own marketing purposes.

Your account and the data attached to it — onboarding answers, habits, completions and subscription records — are kept while your account is active, because the service cannot show you your history without them.

When you ask us to delete your account, we delete or anonymise the personal data associated with it, except where we are required to retain certain records — for example, transaction and tax records held in connection with a purchase.

You can also delete your account yourself in the app: from the Account page, or — without an active subscription — from the corner of the sign-up and plans screens. Once billing is safely resolved, deletion proceeds to its final stage: your profile, habits and their history are deleted, and any subscription is canceled with Paddle first, so nothing more is charged.

You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to export it, or ask us to delete your account and its data. Depending on where you live you may also have the right to object to or restrict certain processing, and to complain to your local data protection authority.

To make any of these requests, email support@apexhabit.app from the address on your APEX account, so that we can identify the account without asking you for more personal information than necessary.

APEX is not intended for anyone under 16, and we do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has created an account, contact support@apexhabit.app and we will remove the account and its data.

APEX is available internationally, and the providers listed above operate infrastructure in more than one country. This means your data may be stored or processed outside the country you live in, including in countries whose data protection rules differ from your own.

Where that happens, we rely on our providers to apply appropriate safeguards for those transfers. The protections described in this policy apply to your data wherever it is handled.

Passwords are stored hashed by Supabase and are never visible to us. Session cookies are httpOnly, and access to your habit data is restricted to your own account. No online service can promise perfect security, but we take reasonable measures to protect your data and to limit who can reach it.

We may update this policy as APEX changes. When we do, we will update the date at the top of this page. If a change materially affects how we handle your personal data, we will take reasonable steps to tell you before it takes effect.

For any privacy question or request, email support@apexhabit.app.

See also our Terms of Service, Refund Policy and Support pages.