Privacy
Privacy notice
Version 1.6 · Last updated 7 October 2026
Habitus Mind holds real personal data — your account, what you log about your body, and details of people you meet. This notice sets out exactly what is stored, where it goes, and what you can make us do about it. Two parts deserve your attention above the rest: health data and data about other people.
1. Who is responsible
The controller (GDPR) and data user (Malaysia PDPA) for habitusmind.com is Habitus Mind, based in Kuala Lumpur, Malaysia.
Any of these reaches us directly:
- Email — privacy@habitusmind.com, for privacy and data requests
- Contact form — the form on the habitusmind.com homepage
- WhatsApp — +60 12-210 4914
Under Article 12 a request is valid however it reaches us. We will not refuse one for arriving through the "wrong" channel.
2. What we collect
| Category | What it is | Where it comes from |
|---|---|---|
| Account | Your email address, which is how you sign in, and whether you have confirmed it. Username, display name, hashed password, group, status and language, plus an encrypted two-factor secret if you turn two-factor on | You, when you create an account or add an email in your Profile |
| Sign-up and email checks | One-time codes we email to confirm an address or reset a password, stored only as a salted hash. Each sign-up attempt, with the IP address and the email address entered, used to limit repeated sign-ups. Once you have received the welcome grant of AI Credits, a one-way hash of your email address, so the same address cannot claim it twice | You, and automatic |
| Security | Sign-in attempts with IP address and approximate location (city/region/country, derived from IP by Cloudflare — no separate geolocation provider), sessions, password-reset and two-factor challenges, rate-limit counters | Automatic |
| Audit | A log of significant actions taken in your account | Automatic |
| Fitness | Food entries, foods you save, foods you submit to the Food Library, your Circle membership and the invitations you create, lines you send or accept, exercise entries, weight logs, targets, quests, generated summaries | You |
| Numerology | Names, dates of birth and notes for people you add, and the readings generated from them | You |
| Network Tracker | Contact names, phone numbers, emails, employers, job titles, locations, social handles, traits, free-text notes, meeting records, and photographs including name cards | You |
| Enquiries | Name, email, message and IP address from the contact form | You |
| Calculator submissions | Your name and date of birth from the public numerology calculator, together with the root number, day master, twelve codes and nine-palace grid that date produces. Both fields are required and both are stored when you press Calculate, which the page states above the button. We use it to see which numbers come up, not to contact you. A phone number is optional and only stored if you add one underneath your result. The IP address is stored as a one-way hash, used to rate-limit the page and nothing else | You |
| Usage | Credits consumed, AI token usage, how much of each daily limit you have used today, and your AI Credit wallet (credits granted to you, and later purchased, that never expire) | Automatic |
We do not collect payment card details. We do not sell personal data, and we do not share it with data brokers or advertisers.
3. Health data — and what that means legally
What you log in the fitness module is health data. Weight, food intake and exercise say things about your body, and under GDPR Article 9 that is a "special category" — the most strictly protected class of personal data there is.
We process it on the basis of your explicit consent under Article 9(2)(a), given by choosing to use the fitness module and enter data into it. You can withdraw that consent at any time by asking us to delete your fitness records; we will do so, and you can keep using everything else.
It is visible only to you and to administrators of your group. We never use it for advertising, never sell it, and never share it with insurers or employers.
One exception is yours to make: a food you submit to the Food Library (its name, brand, serving, calories, protein and the source you give) is shown to other members once an approver accepts it, without your name, and it stays in the library, no longer linked to you, if your account is closed.
If you join a Circle, the other members see your display name and when you joined. You can send one food or exercise line to one member, who sees your display name, the line, its date and meal, and your note, and can accept or decline it; nothing is written into their account until they accept. The leaderboard shows the percentages you switch on: the share of days you logged, were within 10% of your calorie target, met your protein target, or how far you moved towards your target weight, shown as percentages to the members of your circle only, each one off until you switch it on. Nobody in a circle can see your diary, weights or targets.
When a circle leader emails an invitation, the address goes to our email provider to deliver that one message. We keep only a one-way hash of it, to limit how many invitations a circle sends.
This is not a medical service. Nothing generated by the fitness module is medical advice, a diagnosis, or a substitute for a qualified professional.
4. Data about other people
Network Tracker and Numerology exist so you can store information about other people — their names, dates of birth, phone numbers, employers, notes about your conversations, and photographs of their name cards. Those people are data subjects too, and they did not give it to us. They gave it to you.
You are responsible for what you enter about them. Only record what you have a proper reason to record, keep it accurate, and do not enter anything a person would be shocked to read about themselves. Under Article 14, someone whose data you hold may be entitled to be told that you hold it.
If someone asks us to remove data another user holds about them, we will locate it and act — we can, because those records are indexed by owner. Ask through either channel in section 1.
5. AI processing
Some features send your content to Anthropic to be processed by its AI models: reading and fitness summaries, name-card text extraction, and contact recall prompts. That means the relevant text or image — including the personal data it contains — leaves our servers and is processed in the United States.
Anthropic acts as our processor and, under its commercial terms, does not use the data to train its models. If you would rather no AI feature ever touched a particular record, do not run an AI action on it; the rest of the app works without them.
6. Cookies and analytics
We use a strictly necessary session cookie to keep you signed in. It cannot be switched off — without it there is no sign-in — and it needs no consent.
In the European Economic Area, the United Kingdom and Switzerland, nothing else is set unless you agree to it. Visitors there see a cookie banner. Google Analytics and Google Tag Manager are not merely disabled before you choose: they are not loaded at all, so no request reaches Google and no identifier is stored until you accept.
Everywhere else, including Malaysia, Google Analytics runs on the public pages by default. There is no banner. You can switch it off at any time with the button at the end of this section, and if your browser sends Global Privacy Control we treat that as switching it off, so analytics never loads. A choice you have already made, either way, is kept. We tell the two groups apart by the country Cloudflare derives from your connection; the only answer is "ask first" or "don't", it is not stored, and if the country cannot be determined you are asked first.
The signed-in app carries no analytics whatsoever. Google Analytics and Tag Manager were removed outright from the dashboard, fitness, network tracker, people, profile, settings, number method, history, enquiries and sign-in pages on 6 September 2026 — not gated there, removed.
They previously loaded on those screens, which meant Google received page paths and interaction events from pages about your weight, your food, and the people you have met. Consent would have made that lawful; it would not have made it a reasonable thing to do with health data. Analytics now runs only on the public marketing pages — home, contact and the blog.
reCAPTCHA is treated as essential and is not gated. It protects the request-access form and the sign-up form from spam and automated sign-ups, and we rely on legitimate interests for it. Gating it would make those forms unusable for anyone who declines cookies. It appears only on those two forms, not across the site.
| Cookie | Set by | Purpose | Needs consent? |
|---|---|---|---|
| Session cookie | Habitus Mind | Keeps you signed in. HttpOnly, Secure, SameSite=Strict, checked server-side on every request | No — strictly necessary |
hm.consent | Habitus Mind | Remembers your cookie choice, once you make one; nothing is stored until you do. Kept locally in your browser and never transmitted anywhere | No — it only records a decision you made |
| reCAPTCHA cookies | Tells humans from bots on the request-access and sign-up forms | No — see above | |
_ga, _ga_* | Google Analytics | Counts visits and distinguishes browsers, on marketing pages only | Yes in the EEA, the UK and Switzerland. Elsewhere on by default; switch it off below |
You can change your mind whenever you like, wherever you are — one button, the same panel. Rejecting there switches analytics off on this page and every page after it:
Clearing your browser's site data for this domain also clears the choice (outside the EEA, the UK and Switzerland, that means analytics is on again until you switch it off), and your browser's own cookie controls will block these cookies regardless of what you pick here.
7. Lawful bases
- Contract (Art. 6(1)(b)) — running your account and the modules you use.
- Explicit consent (Art. 9(2)(a)) — fitness and health data.
- Consent (Art. 6(1)(a)) — analytics for visitors in the EEA, the United Kingdom and Switzerland (section 6). Elsewhere, analytics is on by default under this notice, and you can switch it off at any time with the button in section 6 or with Global Privacy Control.
- Legitimate interests (Art. 6(1)(f)) — keeping the service secure and available: sign-in attempt logging, rate limiting, audit trails, and answering enquiries you send us. The same basis covers keeping the free tier fair: limiting repeated sign-ups and keeping the hashed address that stops a second welcome grant.
- Legal obligation (Art. 6(1)(c)) — where the law requires us to retain or disclose something.
8. Who receives it
- Cloudflare, Inc. — hosting, CDN, and the D1 database your data lives in.
- Anthropic, PBC — AI processing, as described in section 5.
- Google LLC / Google Ireland Limited — analytics and reCAPTCHA.
- Resend: our email delivery service. It receives your email address and the text of the messages we send you: sign-up and password reset codes, the welcome message, and confirmation that your account was deleted. We send no marketing email.
Cloudflare, Anthropic and Google are US-based, so personal data is transferred outside the EEA and outside Malaysia. Those transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on Standard Contractual Clauses in each provider's data processing terms. The email delivery service is covered by the same safeguards wherever it processes data outside the EEA or Malaysia. We also disclose data where legally compelled to.
9. How long we keep it
| Data | Kept for |
|---|---|
| Account, fitness, contacts, readings | Until you delete them, or until your account is closed |
| Sessions, reset and two-factor challenges | Until they expire, then removed |
| Emailed one-time codes | Valid for 10 minutes and for one use; the hashed record is deleted within about a day |
| Sign-up attempts (IP address and email entered) | About 24 hours, then deleted |
| A sign-up that was never confirmed | Until someone completes it or signs up with that address again. Ask us and we will remove it |
| Welcome-grant record | A one-way hash of the email address, kept after the account is deleted so the grant cannot be claimed twice. It cannot be turned back into your address |
| Sign-in attempts and rate-limit counters | 24 hours, then deleted automatically. Failed sign-in records for your account are also cleared the moment you sign in successfully |
| Audit log | 24 months, then deleted automatically |
| Enquiries | 24 months, then deleted automatically — sooner if you ask us to |
| Google Analytics | No longer than 14 months, the platform maximum |
To delete your account, email privacy@habitusmind.com from the address you sign in with (see section 11). Deleting it removes your records straight away rather than keeping a dormant copy, signs you out on every device, and we let you know once it is done. The exceptions: entries in the audit log stay for their 24 months without your account attached to them, the welcome-grant hash above stays, and anything we must retain to meet a legal obligation stays for as long as that obligation lasts.
10. How we protect it
- Passwords are hashed with PBKDF2-SHA256, a unique random salt per user, and compared in constant time. We never store, log or transmit your password.
- Optional two-factor authentication, with its secret stored encrypted.
- Sessions use 256-bit random tokens checked against the database on every request, so disabling an account or signing out takes effect immediately.
- Rate limiting and account lockout on repeated failed sign-ins.
- Emailed one-time codes are stored only as a salted hash, work once, expire after 10 minutes, and are cancelled after five wrong attempts.
- A strict Content Security Policy, HSTS, and CSRF protection on state-changing requests.
No system is perfectly secure. If something does go wrong, our breach notification commitments set out exactly what we will tell you and when.
11. Your GDPR rights
Where the GDPR applies to you, you may request access to your data, correction, erasure, restriction, portability, and object to processing we base on legitimate interests. Where we rely on consent — including the explicit consent for health data — you may withdraw it at any time, without affecting processing already carried out.
To use any of them, email privacy@habitusmind.com from the address your account signs in with, so we know the request is really yours. If your account has no email address, use either of the other channels in section 1 and we will confirm it is you before acting. For access or portability we send you everything your account holds as one JSON file; passwords and security codes are never included. For erasure we delete the account and everything in it, as set out in section 9.
We respond within one month, and will tell you if we need longer. We do not charge for this. Because you hold an account, we can identify your records precisely, so these rights are real and actionable here rather than theoretical.
12. Your PDPA rights
Malaysia's Personal Data Protection Act 2010, as amended, gives you rights of access and correction, the right to withdraw consent, the right to limit processing for direct marketing, and — following the 2024 amendments — data portability. To ask for a copy of your data or for your account to be deleted, email privacy@habitusmind.com as described in section 11, or use any channel in section 1.
13. Children
Habitus Mind is not intended for children. Anyone can create an account, and our terms require you to be 18 or older to do so. We do not knowingly process children's data. If you believe a child's data is held here — including as a contact recorded by another user — tell us and we will remove it.
14. Changes
Material changes update the version and date at the top of this page. If a change widens what we collect or introduces a new purpose, we will ask you again rather than rely on a decision you made about something narrower.
15. Contact and complaints
Email privacy@habitusmind.com. If you use the contact form or WhatsApp instead, say that your message is a privacy request so it is not read as a general enquiry. Security issues go through the security page instead.
You may complain to a supervisory authority without coming to us first. In the EEA or UK that is your national authority; in Malaysia, the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi).