PRIVACY POLICY Effective: October 5, 2026 Satoshi Habits works without accounts. There is no login, no account user name, and no email address; the only names you can type are optional public display names — a Signature Card’s creator name and the HODL Surfer board name — and neither needs to be your real name. Most of what you do in the app stays on your device. Some features send data to our servers or to service providers — this policy lists each one, what it sends, and why. We use no analytics, tracking, or advertising frameworks. WHO IS RESPONSIBLE Satoshi Habits is responsible (the "controller") for the processing described in this policy. Contact for all privacy matters: info@satoshihabits.com. YOUR DEVICE IDENTIFIER On first launch the app generates a random identifier (the "device ID"). It is not your name, not an email address, and not Apple’s advertising identifier — it identifies the installation, not you as a person. It is stored in your device’s Keychain (with a working copy in the app’s own storage), and the Keychain is why it survives deleting the app: if you uninstall and reinstall, the app keeps the same device ID. It also travels in your device backup and in the app’s own iCloud backup described below, so a new iPhone normally keeps the same device ID too. This is deliberate — it is how the Signature Cards you paid for remain yours without an account (a subscription is restored through your Apple account instead). The server-side records described below are keyed to this device ID. DATA THAT STAYS ON YOUR DEVICE Habits, tasks, alarm settings, streaks, in-app balances, and your card collection are stored only on your device. We hold no copy of them and cannot read them. Your settings stay on the device too, except the few a feature needs server-side — your app language, timezone, and the reach-alert switch, described under Notifications. Like most app data, local data is included in your device backups, and the app additionally keeps a backup of it in your personal iCloud so a new iPhone can restore your progress: it includes your habit and task titles, your chain, your cards, your balances and streaks, your diamonds, your gallery hearts, your settings, the creators and cards you have hidden or blocked, and the device ID described above. Both live in your own iCloud under Apple’s terms — they are not sent to us. NOTIFICATIONS Alarm and daily-reminder notifications are scheduled locally on your device; on iOS 26 and later the alarm itself is handed to iOS, which rings it — that handoff stays on your device too. If you enable notifications, the app also registers for remote notifications about your own Signature Cards — review results, the day your card is featured, and "reach" alerts when your card is drawn or liked: the first time it happens, when it reaches a new country, and when its draw, like, or country counts pass a milestone. For this we store on our server: your device ID, a push token, your platform, the app language, your device’s timezone, and whether reach alerts are on. Delivery goes through Apple’s and Expo’s push services. You can turn off reach alerts with the "Card Reach Alerts" switch in the Node tab, and all notifications in your device Settings. Push tokens that stop working are removed automatically. COUNTRY DERIVED FROM YOUR TIMEZONE Our server derives a country from your device’s timezone setting (for example, Europe/Berlin → Germany) — nothing more precise. The app uses no GPS and no IP-address geolocation, and never reads your location. The country is used for counting the countries a Signature Card has been drawn or liked in and for wording creator notifications; the timezone itself is used to time them (for example, sending "your card is featured today" in the creator’s local morning). If you join the Miner tab’s leaderboard, the same derived country is stored with your leaderboard entry and can be shown on the public board — unless you chose to hide it, in which case a placeholder is stored instead (see Miner tab below). If you post to the HODL Surfer board with the flag shown, the same derived country is stored with your board entry and shown on the public board (see HODL Surfer board below). Timezones that do not map to one identifiable country are counted as unknown. SIGNATURE CARDS — WHAT YOU UPLOAD AND WHO SEES IT Signature Cards are optional and user-created. When you forge one, we store on our servers: the card image, title, text, the creator name you choose (it does not need to be your real name — the app offers a pseudonym), your device ID, and the purchase transaction identifiers. Every card is reviewed by a human before other users can see it; new submissions also notify us by email so review can start quickly. Once approved, the card — image, title, text, creator name, and its draw statistics — is shown to all users of the app in the Daily Draw and the shared gallery. Card images are stored in a public storage bucket and served from a web address: anyone who has the exact link can open the image, including before your card is approved. The link is long and random and is not published anywhere, but you should treat anything you upload as potentially public from the moment you upload it. The image is uploaded as soon as you have finished cropping it — before you forge and before any payment — so that forging is fast; if you then abandon the card, that upload stays in the bucket under its long random link until you ask us to delete it. Photos you pick or take for a card are also kept in the app’s local sketch history on your device (the two dozen most recent — you can delete them there, and START OVER removes them all); that history is not part of the iCloud backup. CARD STATISTICS When another user collects or likes your card, our server counts the draw or like and that user’s country. These statistics are stored per card only — the device ID of the person who drew or liked the card is not stored with them. We also record which count milestones a card has passed, so we only notify you once per milestone. The resulting totals (draws, likes, countries) are visible to all users. REPORTS AND MODERATION Any user can report any card. A report stores the card, the reason, your note, and your (the reporter’s) device ID on our server, and is additionally sent to us by email so we can react quickly. Any player can likewise report any entry on the HODL Surfer board: such a report stores the entry, its name as it stood, the reason, your note and your (the reporter’s) device ID on our server, and is emailed to us the same way. Reports are kept as moderation records. Creators who violate the Content Guidelines can be blocked by device ID. AI ARTWORK ("SIGNATURE STYLE" AND "AI GENERATE") While forging a card you can optionally use AI, in one of two ways. With "Signature Style", the cropped image you uploaded is sent through our server to Google’s Gemini 3.1 Flash Image model ("Nano Banana 2", part of Google’s Gemini API), together with a fixed styling instruction that lives on our server. With "AI Generate", no image of yours is sent — instead, the description you type is sent through our server to that same Google model, placed inside a fixed instruction template that lives on our server. In Genesis mode our server also attaches one picture of its own to that request: the app’s own artwork of its mascot, so the model knows what he looks like — nothing of yours is in it. Before it is sent, your description is shortened to at most 160 characters, stripped of invisible control characters (line breaks included, but not the joiner that holds multi-part emoji together) and lightly tidied: the characters "<" and ">" are replaced by a space, and runs of spaces become a single space. Apart from that, it is sent as you wrote it — so please do not type anything you would not want to share with Google. In both cases the resulting image comes back to your device. Our server does not keep a copy of the image you send, of the description you type, or of the result; per device it keeps only bookkeeping about the attempts themselves — how many you have used, how many Google’s safety filter refused in a row, and, if refusals keep repeating, a time until which AI artwork rests on that device, plus when that row was last written. Your description is kept on your device, alongside the image, in the app’s local sketch history until you delete it. Google processes the image or the description as our service provider under its own terms — see Google’s Gemini API terms and privacy policy for how Google handles submitted content. Nothing is sent to Google unless you tap the style or the generate button. VOICE INPUT (DICTATION) In the Verify tab you can dictate a task instead of typing it. Dictation uses Apple’s speech recognition: on devices that support on-device transcription for your language, your speech is transcribed entirely on the device and the audio never leaves it; on devices that do not, iOS sends the audio to Apple’s servers for transcription under Apple’s terms. Either way, we never receive the audio or the transcript — the recognized text only fills the task field on your screen, and the task you keep is stored on your device like any typed task. Nothing is recorded unless you tap the microphone. Listening ends by itself a few seconds after you stop speaking, and at once if you tap the microphone again or leave the Verify tab. DEVICE INTEGRITY CHECK The AI artwork features are protected with Apple App Attest, which proves a request comes from a genuine copy of the app. The first time you use an AI feature, your device asks Apple’s App Attest service to vouch for a key it created; after that, each AI request carries a signature made with that key, the key’s identifier and a challenge our server issued. For this, an Apple-generated key identifier and public key are stored on our server, bound to your device ID, together with three technical values the check itself needs: the key’s signature counter, which is what lets us reject a copied or replayed request; whether the key came from a development or a released build of the app; and the time the key was last used. This involves no personal information beyond the device ID. PURCHASES All purchases are processed by Apple. We never see your payment details, your name, or your Apple ID. Subscription status is managed by RevenueCat under an anonymous identifier that RevenueCat generates — we never give RevenueCat the device ID this app creates. Because the purchase library talks to RevenueCat from your device, RevenueCat sees your IP address like any internet service, and the purchase library reads and sends it the identifier Apple assigns your device for our apps (not the advertising identifier — we never collect that), together with your App Store country, device model, app version and preferred languages. Our server keeps a log of purchase events — the anonymous RevenueCat identifier, the event type, the product, the price and currency, the transaction identifiers, whether it was a test purchase, any cancellation reason, and the complete event RevenueCat delivers, stored as it arrives — to operate purchases and keep records. For Signature Cards, the purchase’s transaction identifiers — Apple’s and RevenueCat’s — are stored with the card so your purchase can be honored across reinstalls. Because the same identifier appears both on the card and in that purchase log, a Signature Card purchase can be traced to the device that forged the card — that is how we tell a paid card from an unpaid one. FEEDBACK The feedback form in the Node tab sends us your message, the subject you pick, a shortened form of your device ID, and — only if you choose to type one — an email address, which we use solely to reply. It reaches us as one email to info@satoshihabits.com, sent through our email provider Resend by way of our website’s server at Cloudflare, and is not stored in a database; if you typed an email address it becomes the reply address, which is how we answer you. MARKET DATA AND OTHER CONNECTIONS The app fetches public Bitcoin data from mempool.space and CoinGecko — block and network data straight from mempool.space, the price charts straight from CoinGecko, and the current price and the long-term price history through our own server, which asks CoinGecko for them (if our server cannot be reached, the app asks CoinGecko for the current price directly). It fetches mining-pool logos from GitHub, card images from our database provider’s storage (Supabase), and the audio it downloads — the Signal, ambience and sleep tracks, plus Signal Radio, its cover art and its timetable — from our storage and delivery provider Cloudflare at radio.satoshihabits.com. Like every internet request, these services see your IP address; the app sends them no personal data. Links in the app — partner links, the App Store, and the sources we cite — leave the app: they open in your browser or in the App Store, and from that point you are on someone else’s site, where this policy no longer applies. Like any site you visit, the site you opened sees your IP address. Most partner links carry a referral code in the web address, so the partner can attribute the visit; the rest rely on a discount code you enter yourself. We add nothing about you or your device to any link. IP ADDRESSES AND SERVER LOGS Our server uses IP addresses in memory to limit request rates (abuse prevention). They are not stored in our database and are never used for geolocation. Standard technical server logs exist at the infrastructure level, as on virtually every online service. RADIO LISTENER COUNT While Signal Radio is playing — including while the app is in the background and while your phone is locked — the app tells our server every 30 seconds that someone is listening, so the radio card can show a listener count. Each signal carries exactly one piece of information: a single throwaway token (two random numbers plus the moment you pressed play), created fresh each time you start listening and discarded when you stop — no user ID, no device ID, no location, nothing about you. Like every internet request it also carries your IP address, which our server uses only for the in-memory abuse-prevention cap described under IP ADDRESSES AND SERVER LOGS above. Tokens live in our server’s memory only and are never written to our database: a token whose last signal is more than 75 seconds old stops being counted, and is cleared from memory when the count is next read. The listener count itself — one number, with nothing attached to it — is all this ever produces: nothing about any individual listener is ever shown or shared, and no one can be identified from the number. While the radio player is open on screen and the app is in the foreground, the app also asks our server for the current count — once when it opens or the app returns to the foreground, and then once a minute — whether or not you are listening, including before you ever press connect; that request carries no token, only the ordinary information every internet request carries, including your IP address, used as described above. The radio page on this website (satoshihabits.com/radio) works the same way and counts into the same number. While its audio is playing — including with the tab in the background — your browser sends our server the same 30-second signal with the same kind of token: created when you press connect, held only in the page’s memory, and gone when you decouple, reload, or close the tab. Nothing is written to your browser, so we cannot recognise you when you come back. Before you connect, and while playback is paused, the page sends no such signal. While the page is on screen it also asks our server once a minute for the current count; that request carries no token — only the ordinary information every web request carries, including your IP address, used as described above. WHAT WE DO NOT COLLECT No analytics, no tracking, no advertising identifiers, no contacts, no GPS or precise location, no cookies. We do not use Firebase, Amplitude, Mixpanel, Google Analytics, Facebook SDK, or any other analytics or advertising framework. There are no user accounts, and we do not know your name — a creator name or a board display name is whatever you choose to type, not your identity — or, unless you type it into the feedback form, your email address. MINER TAB The Miner tab is optional and reads Bitcoin mining hardware you own. Five things can happen, and only the last one is on by default in the sense that it needs no setup: • Finding your miner. When you tap the find button, the app asks each address on your local network whether it is a miner. iOS asks for Local Network permission the first time. The scan never starts on its own, with one exception: while you are on the Miner tab, if a miner you have already added stops answering — or a different device answers at its address — the app repeats the same scan — at most once per outage — to find that miner again at a new address. It stops as soon as you leave the tab, and none of it leaves the network your phone is on. • Reading it at home. While you are on the Miner tab with the app in the foreground, the app asks the miner itself, on your local network, for its readings every few seconds — every miner you have saved that is your own hardware, when you are on the overview — and streams its live log straight from it while its dashboard is on screen. On the app’s other screens it still asks each saved miner for its readings about once every five minutes, so a big share found while you were elsewhere can be shown to you. A restart is the only thing the app ever sends a miner, and only after you tap restart and confirm. None of it leaves your home network, and all of it stops the moment the app goes to the background. • Reading it through your pool. When the app cannot reach the miner on your home network — you are away, or it is switched off, moved or unplugged — it asks that mining pool’s own public website for its statistics, over HTTPS, directly from your device: the request carries the payout address, which is already public at that pool. An address you typed in to watch, which need not be your own hardware, is always read this way. It does not go through our servers, and there is no separate switch for it. • The leaderboard, if you join it. Joining is an explicit tap and sends us: your device ID, your miner’s public payout address, which pool it mines to, the model information its firmware reports, your device’s timezone, and whether you chose to show or hide your country. The timezone is turned into a country and then discarded; if you chose to hide it, we store a placeholder instead of your country. Your miner’s name is deliberately never sent. While the miner stays on the board, the app sends those same details again at most once a day — the first time you open the Miner tab that day — and again whenever you change the country choice, so that a country or a firmware model that changed stays correct. While the entry exists, our server itself asks that pool’s own public website — the same public request your device makes when you are away — for the best share the pool has ever seen from that address: once an hour per entry, less often as the board grows past a few hundred entries, plus one such request each time an entry is registered again — including the once-a-day refresh and a country change. The request carries the address and nothing else about you or your phone. From the answer we keep one number and the date we recorded it, plus a note of when we last asked: that number is what the board ranks, and it appears on your row — with that date, the model, a published hashrate figure for that model from our own catalogue, and your country if it is shown — for everyone who reads the board. The rest of the pool’s answer is discarded. Leaving the leaderboard deletes the entry. • Reading the leaderboard. An ordinary request to our servers that carries nothing about your miner, and no device ID unless you have joined. It does tell us which of the app’s three languages you are reading in, so that country names come back translated; beyond that it carries only the ordinary information every web request carries, including your IP address, used as described above. Your miner’s hostname, its logs and its live readings never leave your device in any of these cases. HODL SURFER BOARD The HODL Surfer mini-game (Blockparty tab) has an optional global board. Reading it is an ordinary request to our server that carries nothing about you beyond the ordinary information every web request carries, including your IP address, plus the app language so that country names come back translated; once you have posted, the same request also carries your device ID so your own rank can be shown. Posting is an explicit tap behind a consent card — under the result of a run, or in the Blockparty tab — and sends us: your device ID, the course (the version of the price data you rode), the display name you type, your record (the stack, coins, best streak, sharks, milestones and ride time of the run), your device’s timezone — only if you chose to show a country flag — that choice, and your app language. The timezone is turned into a country and then discarded; if you chose to hide the flag, no timezone is sent and a placeholder is stored instead. The name is checked by an automatic filter before it is stored and is then shown, with the numbers, the date and the flag if shown, to everyone who reads the board — at once, without a human review. While you stay on the board, the app sends those same details again by itself whenever you set a new record and whenever you change the name or the flag choice, with the timezone of that moment. We keep one entry per device and course: a later post replaces the name and the flag choice, and the numbers only when the new record is better. If a post lands in the top ten, the app also sends your display name, rank, stack, the course and your app language to our website’s server, which emails us a notice (see Service Providers). Each entry also carries a one-way token derived from the device ID — not the device ID itself, and not reversible — so that a player you hide stays hidden for you. You can change the name, show or hide the flag, or leave the board at any time in the Blockparty tab; leaving deletes your entry from our server, and if that request fails the app keeps retrying until it succeeds. START OVER sends that same deletion request. Entries that break the Content Guidelines are removed and the device behind them is blocked from the board; reports about board entries are kept as moderation records as described under Reports and Moderation, and the entries of a retired course are deleted with it. DEVICE PERMISSIONS • Notifications — alarm and reminder alerts, and Signature Card notifications • Alarms — letting iOS ring your wake-up alarm itself, even when the app is closed, and show a snooze countdown on your Lock Screen (iOS 26 and later) • Camera / Photo Library — taking or choosing the image for a Signature Card • Motion & Accelerometer — shake-to-wake alarm, and tilt and parallax effects (cards, the Mempool block cube, the Node tab) • Microphone — voice input for dictating tasks in the Verify tab • Speech Recognition — transcribing dictated tasks (see Voice Input above) • Local Network — finding your Bitcoin miner on your home network, reading its live stats and log (mostly while you are on the Miner tab, less often elsewhere in the app), and restarting it when you confirm that YOUR CHOICES • Turn "Card Reach Alerts" off in the Node tab to stop reach notifications. • Disable notifications entirely in your device Settings. • On iOS 26 and later you can turn alarms off for Satoshi Habits in your device Settings. iOS then stops ringing the alarm itself, and the app falls back to ringing it through notifications and the running app. To stop an alarm entirely, switch it off in the app. • Report any card from the gallery; you can also hide any card from your own view. • Leave the HODL Surfer board (Blockparty tab) to delete your entry; hide any board entry from your own view. • Erase this app’s data on this device and in iCloud yourself — Node tab → START OVER. • The app’s iCloud backup has no switch of its own: it runs while your iPhone is signed in to iCloud, and START OVER removes the copy already there. • Ask us to delete your server-side data — see below. DATA RETENTION AND DELETION You can erase this app’s data yourself: Node tab → START OVER. It deletes what Satoshi Habits stored on this device — habits and tasks, PoW, blocks, cards, diamonds, streaks, alarm and Signal settings, downloaded audio and cached images, and every notification it had scheduled, and any alarm it had handed to iOS — and it deletes the app’s own iCloud backup. The reset makes one request to our servers only if you had posted to the HODL Surfer board — the request to delete your board entry; otherwise the only thing that leaves your phone is the instruction to iOS to delete that iCloud backup. Beyond that board entry, the reset touches nothing on our servers. Some things are preserved on purpose, including your install identity — so that a Signature Card you paid for is not orphaned — a purchase you have made but not yet used, the device integrity key described above, and the creators and cards you chose to block or hide and the board players you hid, because a reset must not un-block anyone. The server-side records described above stay, Signature Cards you have published stay published, and your device’s own iCloud or computer backup is Apple’s and is untouched by us. The email route below is what covers the rest. Deleting the app removes all local data, but not the device ID (it lives in the Keychain and survives uninstall) and not the server-side records described above. Signature Cards remain published until removed; a HODL Surfer board entry stays on the board until you leave it in the app on this phone or contact us; push tokens are kept until notifications are disabled or the token stops working; reports and purchase records are kept as moderation and accounting records. To have your server-side data deleted — including your cards — contact us via the feedback form in the Node tab (it includes the shortened device ID we need to find your records) or email info@satoshihabits.com. We delete data we can link to your device unless we are legally required to keep it. YOUR RIGHTS (EU/GDPR) Where the GDPR applies, the legal bases for the processing described here are: performance of a contract (operating the app, purchases, hosting and publishing your Signature Cards — Art. 6(1)(b)); your consent (notifications, the AI artwork features "Signature Style" and "AI Generate", voice input, joining the miner leaderboard, posting to the HODL Surfer board, the feedback email — Art. 6(1)(a)), which you can withdraw at any time; and our legitimate interests (moderation, abuse prevention and rate limiting, aggregated card statistics — Art. 6(1)(f)). You have the right to access, correct, delete, and receive a copy of your data, to restrict or object to processing, and to complain to a data protection authority. Because the app has no accounts, we can only link data to you through your device ID — contact us as described above and we will help. CHILDREN’S PRIVACY Satoshi Habits is not directed at children under the age of 13. We do not knowingly collect or solicit personal information from children. SERVICE PROVIDERS We use Supabase (database and storage), Cloudflare (storage and delivery for the app’s audio and Signal Radio, and hosting for satoshihabits.com and the service behind its contact form), Hetzner (server hosting), Apple (purchases, speech transcription on devices that cannot transcribe on-device, and the App Attest integrity check), RevenueCat (purchases), Expo (push delivery), Resend (email delivery for the feedback form, card reports, board reports, board top-ten notices and new-submission notices), and Google (AI artwork — styling an image you upload, and generating an image from a description you type). Some of these providers process data outside the EU/EEA. CHANGES TO THIS POLICY Updates will be reflected on this page with a revised effective date. Continued use of the app after changes constitutes acceptance. CONTACT info@satoshihabits.com