Privacy Notice

Introduction

This privacy notice describes how we collect, use, share and otherwise process your personal data in connection with your use of the Trabit mobile application (App) and our website, trabit.net (Site).

Trabit is not intended for children, and we do not knowingly collect data relating to children.

Please read the following carefully to understand our practices regarding your personal data and how we treat it.

Who we are

Matthew Bowler is the controller and is responsible for your personal data (we, us, or our in this notice).

If you have any questions about this notice or how we handle your data, contact us at bowlerm007@gmail.com, or visit our Support page.

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues.

Changes to this notice

We keep this notice under regular review. If we make a material change, we'll show an in-app notice the next time you open Trabit — this is the one channel guaranteed to reach every user, since push notifications require you to have separately opted in via Settings.

It's important the personal data we hold about you is accurate and current — you can update your name, season phase, and other profile details at any time from within the App.

The data we collect about you

We collect the following categories of personal data:

• Identity Data — your name and age range, provided during onboarding.
• Contact Data — your email address, used for sign-in and account recovery.
• Account Data — your Trabit account credentials, or, if you choose Sign in with Apple or Google, the identity information those providers share with us (typically your name and email).
• Health Data — if you link a habit to Apple Health, we read specific metrics (for example step count) from HealthKit to automatically mark that habit complete for the day. This access is read-only — Trabit never writes to or modifies your Apple Health data. You control this per habit, and can revoke access at any time in iOS Settings.
• Wearable Data — if you connect a WHOOP account, we read recovery, HRV, resting heart rate, sleep performance, and day strain data via WHOOP's API to automatically mark linked habits complete and to show your history over time. This access is also read-only, and you can disconnect it at any time in Settings.
• Content Data — the habits, notebook entries and prompts, and tests you create, including their names, schedules, categories and colors, the values you record against them, and the text of your notes.
• Photo Data — if you use a photo habit, the photos you take or choose as evidence. They're stored privately in our database provider's file storage and are only visible to you.
• Social Data — only if you choose to join Social: the name and username you show there, the people you follow, block or report, and the Consistency Rating we calculate from your completion history. Your rating, rank and name are visible to other Trabit users on the leaderboard; your habits, notes and tests are not.
• Voice Data — if you use dictation in the notebook, your speech is turned into text by Apple's speech recognition service on your iPhone. We receive only the resulting text, never the audio.
• Feedback Data — any message you submit via the feedback form in Settings.
• Device and Usage Data — technical information needed to operate the App and diagnose problems, such as your device type and operating system version, and product analytics about how the App is used (for example which screens are viewed and which steps of setup are completed), linked to your account ID.
• Notification Preferences — which reminders you've turned on (habit reminders, evening and backlog reminders, the morning check-in, and Social notifications), their times, and your device push token if you allow notifications.
• Waitlist Data — if you join the waitlist on the Site, your email address and phone number.
• Payment Data — if you subscribe, Apple processes your payment directly; we receive only your subscription status and entitlement from our payments provider (RevenueCat), never your card details.

We do not collect any special category data beyond the Health/Wearable Data described above, and we do not collect location data or data from advertising networks or data brokers — Trabit has no ads and no location tracking.

If you lock your notebook with Face ID, the check happens entirely on your iPhone. We never receive any biometric data, only whether the unlock succeeded.

How we collect your data

• Registration. We collect your Identity and Contact Data when you create an account, either directly or via Sign in with Apple/Google.
• Using the App. Each time you create or update a habit, log, or test, we collect the Content Data you enter.
• Apple Health. If you link a habit to Apple Health and grant permission, we read the relevant Health Data from your device.
• WHOOP. If you connect your WHOOP account, we read the relevant Wearable Data via WHOOP's API on your behalf.
• Photo habits. When you attach a photo to a habit, we upload it to private storage linked to your account.
• Social. If you join Social, we collect the name and username you choose and the follows, blocks and reports you make, and calculate your Consistency Rating each day.
• Analytics. As you use the App, it sends usage events to PostHog, our analytics provider.
• Waitlist. If you join the waitlist on the Site, we collect the email address and phone number you enter.
• Feedback. If you submit the in-app feedback form, we collect your message and associate it with your account so we can act on it — this is a one-way channel; we don't offer in-app live chat or phone support.
• Notifications. If you allow notifications and turn on any reminder in Settings or during setup, we collect a device push token to deliver them.
• Subscribing. If you subscribe, Apple and RevenueCat process the transaction and share your subscription status with us.

How we use your personal data

We only use your personal data when we have a lawful basis to do so:

We do not use your data for advertising, do not sell it, and do not make any decisions about you based solely on automated processing.

Who we share your data with

• Supabase (our backend/database provider), which hosts our database and authentication in the EEA (Ireland). Every table in our database enforces row-level security, so your data is only ever accessible to your own authenticated account, even at the database layer.
• Apple and Google, if you choose to sign in with either — they process your sign-in identity data under their own privacy policies.
• WHOOP, if you connect your account — WHOOP processes the authorization under their own privacy policy.
• PostHog, our product analytics provider, which stores App usage events in the EU (Frankfurt).
• Expo, whose push notification service delivers the reminders you've turned on to Apple's notification service.
• Other Trabit users, who can see your Social name, rating and rank if you join Social. Nothing else about you is visible to them.
• RevenueCat, our subscription management provider, which relays your entitlement status from Apple to our backend.
• Apple, as the distributor of the App through the App Store, for payment processing, and for HealthKit access if you enable it.
• Law enforcement or regulators, where we're legally required to disclose information.

We do not share your data with marketing partners, advertisers, or data brokers — we don't work with any.

International transfers

Your data is primarily stored in the EEA (Ireland), via Supabase. Because Trabit is used from the UK, this involves a transfer of your data outside the UK to the EEA, which is covered by the UK's own adequacy regulations for EEA countries — no additional safeguard is required for this specific transfer.

Expo and RevenueCat may process limited data (your push token, or your anonymous subscription identifier) in the United States, under their own transfer safeguards.

If you sign in with Apple or Google, or connect WHOOP, a limited amount of identity/wearable data is processed by those companies as part of the relevant flow, under their own respective privacy policies and transfer safeguards.

Data security

• Your data is stored on Supabase's infrastructure in the EEA (Ireland), and all connections between the App and our backend use TLS (HTTPS) encryption in transit.
• Every table in our database has row-level security enabled, restricting access to your own data even if a database credential were compromised — access is enforced at the database layer, not just in the App's own code.
• A copy of your recent data is cached on your device so the App works offline. Signing out clears it.
• You're responsible for keeping your device and account credentials secure — don't share your password with anyone.

Data retention

We retain your account data for as long as you have an active account.

We keep Waitlist Data until the App is publicly available and we've let you know, or until you ask us to remove it.

You can delete your account and all associated data at any time from within the App, in Settings — this is immediate and permanent.

Your legal rights

Under UK data protection law, you have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate or incomplete data — you can update most of this yourself in the App.
• Delete your data — available immediately and directly in Settings, or by contacting us.
• Object to processing based on legitimate interests.
• Restrict our processing of your data in certain circumstances.
• Port your data to another service, where technically feasible.
• Withdraw consent at any time for anything we process on that basis (Health/Wearable Data access, notifications, Social, the waitlist) — directly in the App, in iOS Settings, or by contacting us.

To exercise any of these rights, contact us at bowlerm007@gmail.com. You can also complain directly to the ICO at any time.

Description of data categories

• Identity Data: name, age range.
• Contact Data: email address.
• Account Data: your Trabit credentials, or Apple/Google sign-in identity data.
• Health Data: the specific Apple Health metrics you've linked to a habit (read-only).
• Wearable Data: the specific WHOOP metrics you've linked to a habit (read-only).
• Content Data: habit, notebook and test names, schedules, categories, the values you record, and your notes.
• Photo Data: photos you attach to photo habits.
• Social Data: your Social name and username, follows, blocks, reports, and Consistency Rating (only if you join Social).
• Voice Data: the text of anything you dictate (the audio itself never reaches us).
• Feedback Data: the text of any feedback you submit.
• Device and Usage Data: device type, OS version, diagnostic information, and product analytics events.
• Notification Preferences: which reminders you've turned on, their times, and your device push token.
• Waitlist Data: the email address and phone number you enter on the Site.
• Payment Data: your subscription status and entitlement (never your card details, which Apple processes directly).

Trabit is a trading name of Matthew Bowler. Copyright Matthew Bowler 2026.