Privacy Policy

Effective date: August 25, 2026

Who we are

WatchHabit is a Boomerang Byte product. Boomerang Byte is a brand of 41.22 Inc. (dba), the legal entity and merchant of record.

Questions about your privacy: support@watchhabit.com

The short version

WatchHabit is privacy-first by design. Your watch collection lives on your phone. We collect as little as we can, we never sell your data, and we run no advertising and no analytics trackers of any kind — none, on the app or the server.

What WatchHabit keeps on your device

Everything in your collection is stored locally on your phone: your watches (brand, model, reference, notes, dates), your photos, your wear diary, and — if you enter them — purchase prices, sold prices, and serial numbers. The app works fully offline; your phone is the primary copy of your collection.

What leaves your phone

• Your collection backup (on by default). So you don't lose your collection if you lose your phone, WatchHabit backs up your watches, photos, wear history, notes and dates to our own server — a private server we operate, not a third party's cloud platform.
• Prices and serial numbers (off by default). Purchase prices, sold prices, and serial numbers never leave your phone unless you deliberately turn on the “Include prices & serials in backup” toggle in Settings. If you turn that toggle back off, those values are actively scrubbed from the server. These values are never shown publicly anywhere in the app, regardless of that toggle — the social feed, boards and reviews never display a dollar figure.
• Your account. By default your account is anonymous (see below). If you choose to link an email so you can sign in on a new phone, that email leaves your phone.
• Photos — with identifying metadata stripped, twice. Watch photos you back up or post are stripped of camera and location metadata (EXIF/GPS) on your device at import, and then every photo is independently decoded and re-encoded on our server before storage — a second, structural pass that removes any metadata even a modified copy of the app might fail to strip. Neither step is optional and neither can be turned off.
• Content you choose to post. If you use the social feed, boards, or reviews, the photos, notes, ratings and text you submit leave your phone — that is the point of posting them. See “Social features” below for exactly what is and isn't attached to your identity.

What we deliberately do NOT collect

This is the part most services get wrong, so we're explicit:

• No advertising or analytics SDKs. No third-party trackers. No telemetry — not on the app, not on the server.
• No location data. Photo EXIF/GPS is removed on import and again on our server, structurally, before a photo is ever stored.
• No contacts, no advertising identifiers, no cross-app or cross-site tracking.
• No public collection values. Purchase prices, sold prices, and serial numbers are never displayed anywhere public in the app, and never leave your phone unless you opt in to backing them up privately.
• We never sell your data, to anyone, ever.
• Our server logs record only the request method, path, and status code — never the contents of a request, never your private fields, never your access token.
• We never see your payment card. Pro subscriptions are billed entirely by Apple; we receive only a subscription-status flag, never card or billing details (see “Payments” below).

Your account

• Anonymous by default. On first launch, the app creates an anonymous account tied to a secret token stored in your device's secure Keychain. No name, no email, no sign-up form.
• Email is optional. You can link an email address so you can sign in and restore your collection on a new device. We use it only to (a) send you a one-time sign-in code and (b) identify your account so it can be restored. We send that email through Resend, our email provider, from sign-in@watchhabit.com. We do not send marketing email.
• A public handle is optional, and separate from your email. If you engage with the social feed, you may claim a handle to post under. Claiming a handle never requires or reveals your email address, and vice versa.

Social features: feed, boards, and reviews

• You choose visibility per post. Posts, comments, boards, and reviews can be published under your handle or fully anonymously — your choice at the moment you create them. When you post anonymously, no username, handle, or other identity marker is shown to other users anywhere in the app.
• Verified-owner reviews. A review can carry a “Verified owner” badge, earned by a private, server-side check that you own or owned the watch being reviewed. The badge proves ownership — it never reveals or implies your identity, and it works the same way whether the review itself is posted under your handle or anonymously.
• Blocking and muting. Muting someone silently stops their posts, comments, and boards from appearing in your feeds — they are never told. Blocking does that in both directions and additionally prevents them from following you, commenting on your posts, reacting to your content, or pinning your posts to their boards; any existing follow between you is ended automatically. This is enforced on our server, in every relevant feed and listing — not just hidden client-side.
• Reporting and moderation. You can report content you believe breaks our rules. Reports are reviewed by us through an internal moderation tool; you may report anonymously. If we remove content following a report, we notify the person whose content was removed — we do not remove things silently.
• An honest note on anonymity. “Anonymous” means no other user, and no public part of the app, ever shows your identity. It does not mean we have no internal record of which account created a given post or report — we need that internally to operate moderation and to enforce our acceptable-use rules (see the Terms of Use). That internal record is never exposed on any public route, and our own leak-testing specifically checks for this on every release.

Where your data lives, and who can reach it

• Our own server. Your backup is stored in a database, and your photos as files in storage that is yours alone, on a server we operate (hosted at Hostinger). Each account's private data is isolated; one account cannot read another's.
• Access-controlled, not end-to-end encrypted. Your backup is protected by access controls — only your device's token can reach it — and is transmitted over HTTPS. In the interest of honesty: it is not end-to-end encrypted, which means we are technically able to access stored data in order to run and back up the service. We access it only as needed to operate the service, and prices and serial numbers are excluded from the server entirely unless you opt in.
• Daily backups, and an honest retention note. We take a daily backup of the server database for disaster recovery, kept for up to 14 days. If you had the prices/serials toggle on and later turned it off, those values are removed from the live data immediately but can persist in a disaster-recovery backup for up to 14 days before that backup rotates out.

Payments (Pro subscription)

WatchHabit Pro ($29.99/year or $4.99/month) is sold as an auto-renewing in-app subscription and billed entirely by Apple through the App Store. We never receive, see, or store your card number or other payment details. We receive only a subscription-status signal (active, expired, etc.) from Apple's systems — not your payment information.

The third parties involved (sub-processors)

Services that can reach personal data as part of running WatchHabit:

• Hostinger — hosts the server that stores your backup and photos.
• Resend — sends your one-time sign-in code emails.
• Apple — processes Pro subscription payments; see “Payments” above.

Two more services are involved in making WatchHabit reachable at all, but never see app content or personal data:

• Cloudflare — resolves watchhabit.com's DNS (which server to connect to). Traffic is not routed or proxied through Cloudflare — it goes straight from your device to our server.
• Namecheap — our domain registrar. It has no access to app content.

No analytics companies. No advertising networks. No data brokers.

Your control over your data

• Your phone is the source of truth. You can view, edit, and delete anything at any time, offline.
• Delete means delete. Deleting a watch, post, comment, board, or review removes it from your device and marks it for deletion on the server.
• Account deletion. You can ask us to delete your account and everything backed up for it by contacting support@watchhabit.com.
• Export. You can export your collection from the app (including an insurance-ready summary, a Pro feature) at any time; that export happens on your device.

Children

WatchHabit is not directed to children under 13, and we do not knowingly collect data from them.

Changes to this policy

If we change how WatchHabit handles your data, we'll update this page and its effective date, and surface a notice in the app for material changes.

Contact

support@watchhabit.com
Effective date: August 25, 2026