BumuStudios·Türkçe sürüm·ImageToPdf policy·PdfPages policy

Who this policy is from

This policy covers the Android application Habit Loom: Habit Tracker (shown on your home screen as Habit Loom), distributed through Google Play under the package name com.bumustudios.habitnest. It is written by the app's developer, BumuStudios, an independent developer. Questions can be sent to the address in Contact.

What the app does

Habit Loom is a habit tracker. You create habits with a name, an icon, a colour and a schedule (every day, specific weekdays, or a number of times a week), optionally with a daily goal and a unit such as "8 glasses", and check them off each day. The app shows your current and best streaks, completion rates, a heatmap, a calendar and trends, lets you correct past days, and can remind you of a habit at a time you choose. There is no account and no subscription.

Your habits stay on your device

This is the most important section, so it is stated plainly:

• Your habits are never uploaded by the app. The app has no backend of its own. It does not send your habit names, icons, schedules, goals, reminder times or check-ins anywhere, and the usage statistics and crash reports described below never contain them: a crash report shows where in the code a crash happened, not your habits.
• They are stored in the app's private storage on your device, in a local database that other apps cannot read. Whatever you type as a habit name stays there; it is shown back to you in the app and, if you turn on a reminder, in that reminder's notification on your own device.
• Backups you make yourself go only where you choose. Under Settings → Export backup the app writes every habit and its history to a readable JSON file, and under Settings → Restore from backup it reads one back. Both go through the Android system file picker: you choose the location (your phone's storage, a USB drive, or a cloud service you have installed, such as Google Drive), and the app is given access only to the one file you pick. The file is not sent anywhere else. Restoring replaces the habits in the app only after you confirm, and only after the whole file has been checked.
• No storage permission is requested on any Android version. The system file picker makes one unnecessary.

What the app stores locally

The app keeps the following in its own private storage on the device. None of it is sent to the developer:

• your habits — name, icon, colour, schedule, daily goal and unit, reminder time, archived state, order and the date each was created — and your check-ins (which day, and how many);
• your theme, text size, language, first-day-of-week, sound and vibration choices, and the date of the last "all done for today" message, so it appears at most once a day;
• whether the one-time "remove ads" purchase is active, the end time of a "24 hours without ads" period, and a counter of how many interstitial ads have been shown, used to keep ad frequency low;
• whether the app has already asked for notification permission, and its own bookkeeping for Google Play's in-app update prompt.

Android backup to your Google account

Unlike most of our apps, Habit Loom deliberately includes your habits, your check-ins and your app settings in Android's own backup, because losing years of history when moving to a new phone is the most common complaint about habit trackers. If backup is turned on in your phone's settings, Android copies these two items — the habits database and the settings file — to the backup storage of your Google account and restores them when you set up a new phone or reinstall the app; they are also copied when you move to a new phone with Android's device-to-device transfer. This backup is performed by Android and Google under your own Google account, under the Google Privacy Policy; the developer has no access to it. You can switch it off in your phone's settings (usually Settings → Google → Backup; the exact path varies by manufacturer and Android version).

Everything else is excluded from Android backup and device transfer: the ad-removal and "24 hours without ads" state, the interstitial counter, your advertising consent choices (these must be made on each device), and the Firebase identifiers described below.

Google's advertising and consent components also keep their own settings on the device, under Google's control, and the Google Firebase components described below keep three random identifiers in the app's private storage: a Firebase installation ID, the Analytics app-instance ID and a Crashlytics installation ID. Unlike your habits, these identifiers travel with the usage statistics and crash reports. Uninstalling the app or clearing its data removes everything the app has stored on the device, these identifiers included; a copy in your Google account backup is managed by Android and Google, and a backup file you exported stays wherever you saved it until you delete it.

Reminders and notifications

Each habit can have one optional reminder at a time of day you choose, on the habit's scheduled days. The reminder is scheduled on your device with Android's alarm service; it is skipped if the habit is already done, and its notification offers a Mark done button that records the check-in directly on your device. Nothing about a reminder is sent over the network.

• Notification permission (POST_NOTIFICATIONS, Android 13 and later) is asked for only when you switch a reminder on, after a short explanation in the app. If you refuse, the reminder is still saved, the app tells you notifications are blocked and offers a shortcut to the system settings, and nothing else in the app changes. On Android 12 and older, notifications do not need a separate permission.
• Restoring reminders after a restart (RECEIVE_BOOT_COMPLETED): Android forgets all scheduled alarms when the phone restarts. This permission lets the app re-schedule your reminders after a restart. The same step runs after an app update and when the clock or time zone changes, so a 09:00 reminder follows your local 09:00. It reads only your own reminder settings, on the device.
• The app does not request the exact-alarm permission; reminders may arrive a few minutes late when the phone is saving power.

Advertising — Google AdMob and mediation partners

The app is free and is supported by ads served through Google AdMob (Google Ireland Limited / Google LLC, depending on your region). AdMob is embedded in the app as a software development kit, and it does collect data, independently of the developer. When ads are served, AdMob and Google's advertising partners may collect and process:

Mediation partners

The app also contains the software development kits (adapters) of six other ad networks, used through AdMob mediation: AppLovin, Unity Ads, Liftoff Monetize (Vungle), Meta Audience Network, Mintegral and Pangle. When the app requests an ad, AdMob may pass that request to one of these partners, which then serves the ad. A partner that receives a request receives the same categories of data listed in the table above — the advertising ID, approximate location derived from the IP address, device information and ad interaction events — and processes them under its own privacy policy, as an independent party, not on the developer's behalf. Which partner serves a given ad is decided by AdMob; the app's own code does not address any partner directly. Your consent choices (below) are passed on to these partners through the same Google consent tooling.

• AppLovin — AppLovin Privacy Policy
• Unity Ads — Unity Game Player and App User Privacy Policy
• Liftoff Monetize (Vungle) — Liftoff Privacy Policy
• Meta Audience Network — Meta Privacy Policy
• Mintegral — Mintegral Privacy Policy
• Pangle — Pangle Privacy Policy

The app does not request GPS or precise location permission, and it does not send your habit names, check-ins or any other content to AdMob or to any partner. The developer receives no personal data from AdMob or its partners — only aggregated, anonymous reporting such as impression and revenue totals.

Because ads require an advertising identifier, the app declares the com.google.android.gms.permission.AD_ID permission. The ad formats and where they appear:

• Banner — at the bottom of the Habits list and of the Stats screen (only when they have something to show) and of each habit's own page. Never on the Today screen, where you check habits off.
• Interstitial (full-screen) — when you close the "all done for today" message, which appears at most once a day, and after you save a new habit. The first two such moments after installing show no ad, and two full-screen ads are never shown within two minutes of each other.
• Rewarded — only if you choose Settings → 24 hours without ads: you watch one short video and the app shows no other ads for the next 24 hours. It is optional and nothing in the app is locked behind it.
• App-open — when you return to the app, at most once every four hours. It is not shown when the app is first started, when you open it from a reminder notification, or when you come back from a screen the app itself opened (such as the file picker or the notification settings).

How Google handles this data is governed by Google's own policies, not by this one:

• Google Privacy Policy
• How Google uses information from sites or apps that use our services
• AdMob and third-party advertising

Usage statistics and crash reports — Google Firebase

To see how the app is used and to find and fix crashes, the developer has built two Google Firebase services into it: Google Analytics for Firebase and Firebase Crashlytics. Google provides them as the developer's data processor, and they are active only in the version of the app distributed through Google Play. The app adds no custom events, no user ID or user properties and no custom keys or log messages, so Analytics collects only what it collects automatically. The one thing the app adds is described in the last row of the table: reports of certain non-fatal errors.

Analytics records that a screen was shown and for how long, not what you do on it, and crash and error reports show where in the code something went wrong, not your content: the app does not add your habit names or check-ins to them. Neither service receives your name, your email address or any account details.

In the EEA, the UK and Switzerland, the consent form described below under "Your advertising choices" also covers Analytics: your choices there decide whether Analytics may store its identifiers on your device and whether the data may be used for advertising. Use of the data for advertising ("ad user data") and for ad personalisation stays off there until you consent. You can change your choice at any time from Settings → Privacy options; the entry appears where it is required. The app has no separate switch for the usage statistics or the crash reports; uninstalling it stops both.

Analytics keeps data linked to an installation's identifiers for no longer than 14 months; aggregated reports that contain no identifiers may be kept longer. Crashlytics keeps crash and error reports for 90 days.

Google processes this data on the developer's behalf, as its data processor, under the Firebase and Google Analytics data processing terms. It may be processed on Google's servers outside your country, including in the United States, and it is encrypted in transit (TLS).

Google describes these services here:

• Privacy and security in Firebase
• Google Privacy Policy

Purchases — Google Play Billing

The app offers one optional, one-time, non-consumable purchase that permanently removes ads. There is no subscription and nothing recurring.

The transaction is handled entirely by Google Play Billing. The developer never sees or receives your card number, bank details, billing address or full name. Google Play reports only aggregated sales figures, and Google Analytics for Firebase records that a purchase was made — product, name and price, with no payment details (see above). Inside the app, the purchase is recorded as a single true/false flag on your device, restored from your Google Play account when you reinstall or move to a new device. Your handling of payment data by Google is covered by the Google Privacy Policy and Google Play's terms.

The app also uses Google Play's in-app update service to check whether a newer version is available in Google Play and to offer it to you; this check is made with Google Play on your device and involves none of your habit data.

Your advertising choices

If you are in the EEA, the UK or Switzerland

Before personalised ads are requested, the app shows a consent form built with Google's User Messaging Platform, where you choose what you allow. Your choice is stored on your device by Google's component, is respected on later launches, and is passed on to the mediation partners listed above.

You can change your decision at any time: open the app, go to Settings → Privacy options, and the same form reappears. You may withdraw consent there. Withdrawing consent does not disable the app; you will still be able to track your habits, and ads may still be shown in a non-personalised form. The same choices also apply to Google Analytics for Firebase, as described above.

If you are in a US state with a privacy law

Where a US state privacy law gives you the right to opt out of the sale or sharing of personal information or of targeted advertising, that choice is offered through the same Google consent tooling, where it applies, and the Settings → Privacy options entry appears where it is required.

Everywhere else

The privacy options entry appears only where a consent choice is legally required, so you may not see it. You can still control advertising at the operating-system level: open Android Settings → Privacy → Ads (the exact path varies by manufacturer and Android version) to reset your advertising ID, or to delete it entirely, which stops apps from receiving a stable advertising identifier.

Removing ads completely

Buying the one-time ad removal stops ad requests from the app altogether. The optional "24 hours without ads" pauses the banner, interstitial and app-open ads for one day.

Permissions the app requests

These are the permissions the app declares itself. The Google components and the mediation partners' SDKs built into it add a few more that Android grants at installation without asking you: Google Play's billing, licence-check and install-referrer permissions, Android's advertising-services permissions, an attestation permission that the Liftoff (Vungle) SDK uses against ad fraud, and ordinary system permissions to check the Wi-Fi connection state, keep the device awake briefly, run background work and use vibration. None of them gives access to your habits, files, contacts or location. The app requests no storage, camera, contacts, microphone, location (precise or approximate), calendar, health or account permissions, and no exact-alarm permission, on any Android version.

Children

This app is a general-purpose utility. It is not directed at children under 13 (under 16 in the EEA, or the equivalent minimum age in your country), it is not listed in a children's category, and it is not designed for or marketed to children. The developer does not knowingly collect any personal information from children. If you believe a child has provided personal information through the ad, analytics or crash-reporting services in this app, contact the address below and contact Google, whose services would hold it.

Data retention

The developer runs no server and keeps no user data of its own. The usage statistics and crash reports are held by Google on the developer's behalf: Analytics data linked to an installation's identifiers for no longer than 14 months (aggregated reports without identifiers may be kept longer), and crash and error reports for 90 days. Your habits and settings stay on your device until you delete them, clear the app's data or uninstall the app. A copy in your Google account's Android backup is kept and deleted by Android and Google according to your backup settings, and a backup file you exported stays where you saved it until you delete it. Data collected by Google through AdMob and Google Play is retained according to Google's own retention schedules, described in the Google Privacy Policy; data received by a mediation partner is retained according to that partner's policy, linked above.

Security

Your habits are kept in the app's private storage, which Android isolates from other apps. The app has no server that could be breached and no account that could be taken over. Data sent by the Google and partner components travels encrypted (TLS). An exported backup file is ordinary, unencrypted JSON so that you can read it; keep it somewhere you trust.

Legal bases and your rights

Where the GDPR (EU/UK) applies, the legal basis for personalised advertising is your consent, collected through the form described above and withdrawable at any time. Non-personalised advertising, fraud prevention and the security of the ad services rely on legitimate interests. Processing your purchase is necessary to perform the contract you enter when you buy ad removal. The usage statistics and crash reports rely on the developer's legitimate interest in keeping the app working and understanding, in aggregate, how it is used; storing Analytics identifiers on your device and any advertising use of the data follow your choices in the consent form.

Under the GDPR, and under Turkey's KVKK (Law No. 6698) on equivalent terms, you have the right to ask whether your personal data is processed, to access it, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent. You may also lodge a complaint with your national data protection authority — in Turkey, the Kişisel Verileri Koruma Kurumu (KVKK).

Your habits never reach the developer, so you exercise these rights over them directly in the app: you can edit or delete any habit and any day, export everything with Settings → Export backup, and erase everything by clearing the app's data or uninstalling it. The usage statistics and crash reports are pseudonymous: they carry random identifiers, never your name or email address, so the developer cannot tell which records are yours. Where the consent form is shown, you can withdraw consent at any time in Settings → Privacy options, and you can object to this processing, or ask about it, by writing to the address below. Uninstalling the app or clearing its data ends the link to the old identifiers, and data already sent then expires on the schedule above. You can also reset or delete your advertising ID in Android's settings at any time. Requests concerning advertising data must be directed to Google, or to the mediation partner concerned, as the party that holds it, using the tools in their privacy policies linked above. For anything else, or for help finding the right route, write to the address below.

Changes to this policy

If the app's data practices change — for example if a new third-party service is added — this page will be updated and the "last updated" date at the top will change. Material changes will also be reflected in the app's Google Play listing. Continuing to use the app after an update means you accept the revised policy.

Contact

For any question about this policy or about privacy in this app, write to: