Privacy Policy
The short version: habitGate: Level up system stores the account and progress data needed to run the app. We do not sell your personal data. You can delete your account and data at any time: see Delete your account.
Who we are
habitGate: Level up system is operated by Monarch Labs, Uttar Pradesh, India. Contact: monarchlabsapps@gmail.com.
Information we collect
Information you provide
- Account details: your email address and a password. Authentication is handled by Supabase Authentication, which stores only the credential hash — we never store your password in readable form. The app also shows Google and Apple sign-in buttons, but neither provider is currently enabled: sign-in today is email and password only, and no email-confirmation step is required — you can use your account as soon as you sign up. We will update this policy when a provider is switched on.
- Profile: your hunter name, class archetype, rank and level, with a sigil or emblem as your avatar. If you choose a photo as your avatar it is processed on your device and stays on your device — photo avatars are not uploaded to our servers.
Information created by using the app
- Quests, dungeon raids and check-ins, XP, levels and streaks, stats, sprint sessions, skill arcs, achievements, owned items, coin transactions, settings, a cloud backup of your progress, loot boxes, and purchase-entitlement records.
Device and technical information
- App version, platform, operating-system version and a device identifier are attached only to bug reports you choose to send. The app bundles no usage analytics. Crash reports are used only in builds configured with a crash-reporting DSN.
Purchase information
- Purchases are handled by Google Play. We receive purchase and entitlement status (product, purchase date, expiry), not payment card details; entitlements are validated for us through RevenueCat.
Permissions the app requests
- Photo access: only when you choose to set a profile photo — the app opens the system photo picker for camera or gallery; it does not itself hold Android's camera permission.
- Notifications: local reminders while a focus sprint runs. The Android notification permission is requested at runtime and can be refused without losing any other feature.
- Other: internet access and network-state access to sync your progress; from its notification library, permission to post notifications, keep the device awake during a sprint, reschedule after a reboot, and schedule exact alarms. The app requests no location, microphone, contacts or advertising identifier, and contains no advertising SDK.
How we use information
To run the app and sync your progress, provide rewards and features, fix bugs, keep accounts secure, answer support requests and meet legal obligations. The app contains no analytics SDK — nothing about your in-app usage is measured by a third party. Crash reports, where enabled, are used only to diagnose crashes.
Legal bases (EEA and UK users)
| Purpose | Legal basis |
|---|---|
| Providing your account and the app | Contract |
| Security, bug fixing, abuse prevention | Legitimate interests |
| Local sprint reminders (notifications), which you can decline | Consent |
| Legal obligations | Legal obligation |
Service providers and sharing
- Supabase: authentication and database hosting. Data is hosted on Supabase's managed infrastructure; the hosting region is determined by Supabase and depends on server availability. All data is encrypted at rest, so we cannot read the contents of your stored data.
- Google: Google Play billing — payments are completed in Google Play, never in the app.
- RevenueCat: subscription and purchase-entitlement processing; its webhooks reach a Supabase Edge Function. Sentry: crash reporting, only in builds configured with a DSN. No other third-party online service receives your data — the app's remaining dependencies are client-side libraries that run on your device and make no network requests of their own.
We may disclose data if legally required, or in a business transfer. We do not sell personal data and do not share it for advertising.
Retention
We keep your data while your account exists. When you delete your account we delete your profile and app data (see Delete your account). Backups may keep copies for up to 30 days and security logs for up to 90 days. Purchase and billing records required by law or fraud prevention may be kept for up to 1 year.
Your rights and choices
You can ask to access, correct, export or delete your data, to object to processing, or to withdraw consent. You can also export your progress yourself from the app (Stats → export; available to Premium users). Delete in the app (Settings -> Data & Account -> Delete Account) or see Delete your account. Email monarchlabsapps@gmail.com; we reply within 30 days.
Regional notices
EEA and UK: you can lodge a complaint with your local data protection authority. Data may be transferred to and processed in countries outside your own, including by processors located outside the EEA and UK. Where the GDPR applies, these transfers are protected by the Standard Contractual Clauses approved by the European Commission, which our processors make available.
California: we collect the categories listed above, and we do not sell or share personal information as defined by CCPA/CPRA. You may request access, deletion and correction.
Other regions: We do not share any personal data with third parties.
Children
habitGate: Level up system is not directed to children under 13. We do not knowingly collect their data. If you believe a child has given us data, email monarchlabsapps@gmail.com and we will remove it.
Security
We use reasonable technical and organisational measures, including encrypted connections. No system is perfectly secure and we cannot guarantee absolute security.
Changes to this policy
We will update the date and version above, and notify you in the app for material changes.
Contact
Monarch Labs, monarchlabsapps@gmail.com
Version history
- 0.1-draft, effective 2026-11-01: draft.