Last updated: 20 July 2026
Pact is a habit tracker with social accountability: with your explicit setup, it can notify accountability partners you choose (via WhatsApp) when you miss your habits, and let friends you connect with see a summary of your day.
The data controller is Alex Popa (individual developer, Romania, EU). Contact: support@pact-habit.com.
| Data | Why (lawful basis) |
|---|---|
| Account: email address, password (stored only as a hash by our auth provider). | To create and secure your account — performance of our contract with you. |
| Profile: a username, first/last/display name, optional birth date and gender, optional profile photo, and the country and city you tell us you are from. | To personalise the app, to let people find you, and to understand where Pact is used — our legitimate interest in operating and improving the product. Your username is public: anyone signed in can find you by it. Country and city are self-declared — we do not read your device location or GPS — and your city is used to suggest people near you only if you turn your profile public. |
| Your content: habits, daily logs and notes, goals, to-dos. | The core function of the app — performance of our contract. |
| Accountability partners: the name and WhatsApp number you enter for each partner. | To deliver the alerts you set up. You are responsible for having your partner's agreement before adding them. |
| Friends: mutual friend links, and a daily summary of your progress (see below). | To provide the friends feed you opted into by accepting a friend link. |
| Subscription status: your plan and its validity period. | To give you access to paid features — performance of our contract. |
Signup source: a short marketing tag if you arrived via a campaign link (e.g. ?src=ig). |
To know which channels bring people to Pact — legitimate interest. It is not an advertising identifier and is not shared. |
This is designed to be private by construction, not by promise. When you and another person accept each other's friend link, they can see only aggregate numbers about your day:
Your friends never see the names of your habits, your notes, your goals, your to-dos, your partners, or your country and city. Database access rules enforce this on the server — it is not just a UI choice. You can remove a friend at any time.
You can search for people by username. Anyone can be found by their exact username, but a private profile shows only their name and photo — never any numbers. To connect with someone private, you send a friend request they must accept. People with a public profile can be added directly, because their card is already public.
Your profile is private by default. Turning on "Public profile" means two things, both reciprocal:
Turn it off and both stop immediately: your numbers are hidden again, and you are no longer suggested to anyone. While private, your feed shows only the friends you accepted.
| Service | Role |
|---|---|
Supabase (hosted in the EU, eu-west-1) | Database and authentication. Row-level security means only you — and our automation acting for you — can read your rows. |
| Netlify | Hosting of the website and app. |
| Stripe | Payment processing. Stripe handles your card details directly; we never see or store them. We store only your plan and its status. |
| CallMeBot | Delivery of WhatsApp nudges and partner alerts. Each recipient activates CallMeBot on their own phone — that activation is their opt-in. |
| Apple / Expo | App distribution and update delivery for the iOS app. |
Optional reminders are scheduled locally on your device. You can turn them off in Account or in your system settings.
We keep your data for as long as your account exists. When you delete your account, everything is erased immediately — habits, logs, goals, to-dos, partners, friend connections and your progress summary — not after a delay. Backups roll off within 30 days.
Under the GDPR you can:
If you are in California, you have equivalent rights to know, delete, and opt out of "sale" or "sharing" of personal information. We do not sell or share personal information, so there is nothing to opt out of, and we will never discriminate against you for exercising a right.
Pact is not directed at children. You must be at least 16 years old to create an account (or the minimum age of digital consent in your country, if higher).
Data is encrypted in transit (HTTPS) and protected at rest by our hosting providers. Passwords are stored only as salted hashes. Access to your rows is enforced by database-level row-level security.
If we change this policy in a way that materially affects you, we will update the date above and notify you in the app.
Alex Popa — support@pact-habit.com · Terms of Service