Privacy policy

Who we are

Tadly is a calm habit tracker for Android (iPhone later) and the web, made and published by M.A. Hassan — “we” and “us” in this policy. The app is built so that we don’t need to know anything about you, and this page is our attempt to say exactly what that means in practice.

If anything here is unclear, write to privacy@tadly.app. A person reads it.

What this policy covers

This policy covers the Tadly app for Android and, when it arrives, iPhone; the web app at app.tadly.app; and this website at tadly.app. It explains what information is held on your device, what can leave it and when, and the choices you have.

It doesn’t cover Google, Apple, the AI provider, or the sign-in, crash and analytics services named below when they process something on their own behalf — for instance, Google when you sign in to Drive. Where that happens, we say so below and point you to their policies.

Data that stays on your device

Everything you put into Tadly is stored locally:

• your habits — names, icons, colours, targets, schedules, Areas and routines;
• your history — completions, counts, durations, skips, rest days and streaks;
• your notes and journal entries;
• your settings — theme, fonts, card style, reminder times, widgets, app lock and the like;
• if you connect Health Connect, the steps, exercise and sleep readings Tadly takes from it and which habits they fill — see Health Connect.

In the Android app this lives in the app’s private storage on your phone. In the web app it lives in your browser’s local storage, on that device, in that browser. In both cases the data is read and written by the app running on your device. It isn’t sent to us, and we have no way to see it.

Because the data is on your device, it follows your device: it’s protected by your screen lock and your phone’s encryption, it’s removed when you uninstall the app or clear the site’s data, and it doesn’t travel to a new phone unless you move it — with a backup, an export, or sync.

Data we never collect

We never hold a password — Tadly has none to hold, because signing in happens on Google’s screen and not ours. We don’t collect your location, contacts, photos or files. We don’t fingerprint your device, and we don’t use advertising identifiers.

One thing did change here, and we’d rather it was the first thing you read than something you found later: if you choose to sign in, we hold your email address. That is the entire list of personal data on our servers, it only exists if you asked for it, and the next section is about nothing else. Everyone who doesn’t sign in stays exactly as before — unknown to us.

Some of the things we’ve promised never to build matter here too: no ads, no selling or mining of data, no content or follower feeds. Those promises are on our roadmap, next to the things we do plan to build.

The only data that can leave your device is described in the sections that follow.

Signing in

Signing in is optional and off. Tadly is a complete habit tracker without it, and nothing in the app nags you towards it. It buys two things: backup to your own Google Drive, described in the next section, and an identity that a subscription can be attached to — so that a plan bought on your phone is recognised when you open the web app, instead of being stranded on the device that bought it.

You sign in on Google’s own page and come straight back. On that page, in the same step, Google also asks whether Tadly may use a hidden app-private folder in your Drive (for backups) and a calendar of its own (for tasks); you can untick either and still sign in. Tadly never sees your Google password. Google then tells us who you are, and we create one row on our server holding a random account id, your email address, and the dates it was created and last used. That is the whole record. It is also the only personal data we hold anywhere.

Signing in on its own sends no habit anywhere. Not the names, not the notes, not a single tick. Your habits stay on your device exactly as they did before you signed in, and signing out leaves every one of them where it is. Multi-device sync is a separate switch, off by default, and the one thing that changes this — it is described two sections below, including what it cannot hide.

One more thing signing in does, if usage analytics are on: it links that device’s analytics identifier to the random account id — not to your email — so that one person on two devices is counted once. What that identifier is, and how to switch it off, is under Crash reports & usage analytics.

The account lives with Supabase, who host the database and process it under their own privacy policy. To delete the account, write to privacy@tadly.app from the address you signed in with and we’ll remove the row. You don’t have to explain why, and it costs you nothing on your device.

Google Drive backup

Backup to Google Drive is optional and off until you turn it on. When you do:

• When you sign in, Google asks — on its own page, in the same step — whether Tadly may use a hidden, app-private area of your Drive (Google calls it the application data folder) and nothing else: not your other files. Tadly never sees your Google password. Say no and everything except backup and sync still works.
• Your backup — a file containing your habits, history, notes and settings — is written to that folder from your device. It counts against your Drive storage, and it can only be opened by Tadly running on a device signed in to the same Google account.
• There is no server of ours in between. The file goes from your phone or your browser straight to your Drive. We can’t read it, and we don’t get a copy. (Signing in is separate, and does reach a server of ours — that is the section above.)
• The same folder also holds a small key file. It is the encryption key for multi-device sync, and it was created before sync existed so that what we store could be scrambled from the very first row rather than converted afterwards. The key is generated on your device, lives only in your Drive, and never reaches us. That is what lets us say we cannot read synced data — and note it sayswe cannot, not that nobody can, since the key sits in Google’s storage like everything else here.
• As part of signing in, Google may share your account’s basic profile (name, email address, picture) with the app. Tadly uses it only to show you which account the backup lives in.

Google handles the sign-in and the storage under its own privacy policy. You can stop at any time: sign out in the app, remove Tadly from your Google account’s connected apps to revoke its access, or delete Tadly’s hidden app data from Google Drive’s settings to remove the backup itself. None of that touches the data on your device.

Restoring works the same way in reverse, on a new phone or in a browser: you sign in, and the app pulls the file down from your Drive. It is one file in one format, so a backup made on the phone restores on the web and the other way round.

One difference worth knowing. On Android the app can back up on its own in the background. In a browser, backups happen when you press the button. To keep Drive access working between clicks, the browser keeps a renewal token from Google, in that browser only. When it needs a fresh access token it sends the renewal token to our server, which forwards it to Google with the app’s own credentials and hands the answer back; our server does not store it. Signing out, or Disconnect, revokes it. We’d rather spell that out than let you assume a backup is running that isn’t.

Multi-device sync

Sync keeps your habits in step across your devices. It is off until you turn it on, it needs Google Drive connected first, and it is the only feature that puts any part of your habits on our servers.

What we store, we cannot read. Before anything leaves your device it is encrypted with a key that is generated on your device and kept in your own Google Drive, in the app-private folder described above. The key never reaches us. What lands on our server is a block of ciphertext — we can delete it, we can count it, we cannot open it.

That is a narrower promise than it may sound, so here it is exactly: we cannot read it. Not nobody can. The key sits in Google Drive, so anyone who can reach your Google account can reach the key. If your Google account is compromised, so is this.

What encryption cannot hide. The server can see how many habits you have, and the date and time each one was last changed — it has to, in order to know what to send your other device. On a habit tracker that pattern is itself revealing: daily entries stopping for three weeks says something, even though every name and note is unreadable. We would rather say so than let “end-to-end encrypted” imply more than it delivers.

What is not synced. Your theme, accent, widget layout and reminders stay on the device that set them. Sync carries habits, their history and your journal, and nothing else.

Turning sync off stops the device sending anything further; what has already been stored stays until you remove it. To delete it, write to privacy@tadly.app from the address you signed in with, or delete the account entirely — the rows go with it. Deleting the key file from your Drive does not delete the data; it only makes it unreadable to everyone, permanently, including you.

Google Calendar

Tadly can put your one-off tasks — the ones set to “No repeat” — into Google Calendar, from the phone app and from the web app. It is optional, off until you turn it on, and needs you signed in with Google.

• When you sign in, Google asks — on its own page, in the same step as the rest — whether Tadly may make its own calendars and manage the events on them. That is the whole of the permission. Tadly creates one calendar called “Tadly” and can only see and change what is on it — never your other calendars or their events.
• What goes into that calendar is each task’s title, date and time, a tick when it is done, and its description when the event is first made. What comes back is what you change there: a new title, date or time, an event you add (which becomes a task), or an event you delete (which archives the task in Tadly rather than deleting it).
• The calendar’s id is kept in the app-private Drive folder described above, so your other devices find the same calendar.
• There is no server of ours in between. Events travel directly between your device or browser and Google. We can’t see them, and we don’t get a copy.

Turn the switch off and Tadly stops reading and writing the calendar. The calendar and its events stay in your Google account until you delete them there. You can remove Tadly’s access at any time from your Google account’s connected apps.

Tadly’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Calendar data is used only to keep your tasks and that calendar in step — never for advertising, never sold, and not read by anyone at Tadly.

Health Connect

On Android, Tadly can fill habits for you from Health Connect, Google’s on-device store for health and fitness data. It is off until you connect it, and you choose what Tadly may read on Health Connect’s own permission screen. Another app — Samsung Health, Fitbit, a watch — records the data; Tadly only reads it.

What Tadly reads, and why.

• Steps — to fill a habit such as “walk 8,000 steps”.
• Exercise sessions — when a workout started and ended, to fill a habit counted in minutes. Health Connect only hands workouts to an app that may also read distance and total calories burned, so Tadly asks for those as well. It does not use or keep either.
• Sleep sessions — when you fell asleep and woke, to fill a habit such as “sleep 7 hours”. Sleep stages are not used.
• Reading in the background — only if you turn on “Update while Tadly is closed”, so habits and home-screen widgets stay current about once an hour.

Tadly never writes to Health Connect, and asks for no other health data — no heart rate, weight, nutrition, cycle tracking or medical records.

Where it goes: nowhere. The readings are used on your phone to work out a day’s number — 8,412 steps, 34 minutes, 7.2 hours — and are kept in the app’s private storage. They are never sent to us, to the AI features, to crash reports or analytics, or to anyone else, and they are not part of backups or sync. The one thing that travels is the day’s number on a habit you linked, which is saved like any number you log yourself: it is in your Drive backup and, if sync is on, in the encrypted sync described above.

Tadly’s use of information received from Health Connect adheres to the Health Connect Permissions policy, including its Limited Use requirements. Health data is not used for advertising, not sold, not shared, and not used to make decisions about credit, insurance or employment.

Stopping. Unlink a habit in Tadly and it stops filling; numbers already filled stay, as yours. To withdraw access entirely, open Health Connect → App permissions → Tadly. Uninstalling Tadly removes everything it kept.

AI features

Tadly has two optional AI features: Routine AI, which suggests a routine from a description you write, and Appearance AI, which suggests a look for the app from a description you write. Both use the Claude API from Anthropic.

They only do anything when you open one and tap to generate. At that moment the app sends the text you typed, together with the names of your habits, so the suggestion can fit what you already track. That’s all. No history, no notes, no counts, no health values — and nothing is ever sent in the background or without you asking.

The request is made from your device, so like any internet request it carries your IP address. It carries no account, name or email — not even if you have signed in, because the request goes from your device to Anthropic without passing through us. Anthropic processes the request to produce the reply, under its own privacy policy.

Suggestions are just suggestions: nothing changes in your habits or your settings until you accept it. Usage limits apply, and beyond a small free allowance these features are part of Tadly Pro. If you’d rather nothing of yours reached an AI provider, don’t use them — everything else in Tadly works without them.

Crash reports & usage analytics

Tadly sends two kinds of diagnostic data: crash reports, from the phone app, and usage events, from the phone app, the web app and this website. In the phone app one switch, Settings → General → Help improve Tadly, turns both off; in the web app, Settings → Usage counts turns usage events off. None of it ever carries a habit name, a note, a logged value or anything else you typed.

Crash reports go to Sentry, on servers in the European Union. A report describes the failure and the state the phone was in: the app version, your device model and OS version, where in the code it happened, and readings like battery level, free memory and storage, connection type, language and time zone. It includes a short trail of the last few things that happened — a screen opened, the app came to the foreground — which records that they happened, not anything you typed. The app is configured never to attach a screenshot or a copy of the screen’s contents, because on a habit tracker that would photograph your habits, and never to turn the app’s own debug output into part of the report.

Two things in a crash report are worth naming plainly rather than leaving you to find them. It carries a random per-installation identifier of its own, so we can tell whether a crash hit one phone or a thousand; it is tied to no name or email, and reinstalling the app replaces it. And Sentry works out an approximate location — roughly city and country — from the internet connection the report arrives over, the way any website can. There is no advertising identifier, and no link to your Tadly account even if you have one — a crash report is not tied to the sign-in described above, and the account link described below is for usage events only. Sentry processes all of it under its own privacy policy.

Usage events go to PostHog, on servers in the United States, so this half leaves Europe. They come from the phone app, from the web app at app.tadly.app, and from this website — the website’s are described under The website below. An event is the fact that something happened, never its content: that a habit was created, not what it is called. Some events carry a category or a count — the habit’s type and how often it repeats, a journey’s length in days and how many habits it holds, the plan chosen — but never a habit name, a note, a health value or any text you typed; the code refuses any value that looks like a sentence. Alongside each one PostHog records the ordinary technical context any app sends — app version, device model or browser type, operating system, screen size, language, time zone and, on the phone, mobile network — plus a random identifier, so that returning use can be counted. On the phone that identifier is made for the installation, and reinstalling replaces it. In the web app it is kept in the browser’s local storage for that site: not a cookie, shared with no other site, and deleted with the site’s data. Either way it is tied to no name or email. If you sign in with Google, on the phone or the web, it is linked to your account’s internal id — the random string described under Signing in, never your name, email address or picture — so that we can count signed-in and paying people once across phone and web rather than once per device; signing out gives the device a fresh identifier. Every event also says whether it came from a guest or a signed-in person, and, if you have Tadly Pro, which plan — monthly, yearly or lifetime — and whether it is active, on trial or cancelled. That comes from our own billing record, described under Purchases, not from your card or from anything the payment provider holds; when that record changes, our server reports the change to PostHog under the same account id, so it does not depend on a browser being open. PostHog processes it under its own privacy policy.

The events are a fixed list, written into the app rather than decided later, and short enough to print in full. On the phone: opened, onboarding completed, habit created, habit completed, habit archived, comeback offered, comeback accepted, backup succeeded, backup failed, export completed, import completed, widget added, reminder fired, paywall shown, experiment assigned (which version of the paywall a phone was shown), trial started, paywall dismissed, purchase completed, and AI generation requested; PostHog adds its own counts of the app being installed, updated, opened and backgrounded. In the web app: a screen was shown, signed in, signed out, habit created, habit archived, habit deleted, area created, journey created, Pro page viewed, checkout opened, checkout completed, sync turned on or off, calendar turned on or off, backup succeeded, export completed, import completed, and usage counts turned off. From our server, when a web purchase is made, lapses or changes: Pro activated, Pro cancelled, Pro changed. That is everything.

On the phone, turning the switch off stops usage events immediately. Crash reporting stops from the next time you open the app, because it has to start before the app does and cannot be taken back once running — we’d rather say that plainly than let you believe it stops mid-session. In the web app, turning Usage counts off sends one last event saying it was turned off — so that we know how many people do — and then nothing more. Your browser can do the same without asking: if it sends a Do Not Track or Global Privacy Control signal, nothing is sent, whatever the switch says. The one thing neither stops is the server’s own record that a Pro purchase was made or ended, because it never passes through your browser; it can be deleted on request, as described below.

Sentry keeps errors for 90 days; PostHog keeps events for as long as the project exists. If you never sign in, nothing there is tied to you, so neither holds a per-person record that could be looked up, handed over or deleted on request — which cuts both ways, and is the honest trade for never asking who you are. If you have signed in, the usage events linked to your account id can be deleted: write to privacy@tadly.app from the address you signed in with, or ask for the account to be deleted and say you want these gone with it.

Purchases

Tadly Pro is bought through Google Play on Android and the App Store on iPhone, or on the web through Paddle. The seller handles the whole transaction: your payment details, billing address, receipts, renewals and refunds. We never see your card number, and we can’t charge you ourselves.

A web purchase is different in one way: it is attached to the Tadly account you signed in with, so it can follow you to your phone. Paddle tells our server that the account bought a plan, and we keep one row for it — which plan, its state (active, on trial, cancelled), when it renews or ends, and Paddle’s identifiers for the customer and subscription — so the app knows what to unlock and can open your billing page. No card, no address, no amount. When that row is written, our server also tells PostHog, under your account id, that Pro was activated, cancelled or changed and which plan — the purchase count described under Crash reports & usage analytics; it is the one usage event that does not come from your device. Paddle is the merchant of record and processes the payment under its own privacy policy; it knows your email address and what you bought, as any seller does.

What the app receives from the store is a confirmation that the purchase exists — a purchase token or receipt with a product identifier — so it can unlock Pro on your device. The app keeps that record locally. Purchases are tied to your store account, which is how they are restored on a new phone. The store’s own privacy policy (Google or Apple) covers what it collects to process a payment.

Permissions

Tadly asks for permissions one at a time, when a feature needs them. Every one can be declined, and withdrawn later in your device’s settings.

• Notifications — asked for only when you set your first reminder, so reminders can reach you. On some phones the app may also point you to battery settings so reminders aren’t silenced.
• Biometrics — used by the optional app lock. Your fingerprint or face is checked by your phone’s operating system, in its own secure hardware; Tadly only learns whether the check passed. It never sees, stores or transmits biometric data.
• Health Connect (Android) — asked for only when you connect it, to fill habits from steps, exercise and sleep. Read-only; you choose each data type, and you can withdraw access at any time in Health Connect. Details are in Health Connect above. Apple Health on iPhone will work the same way when the iPhone app arrives.
• Google sign-in — used only for Google Drive backup and, if you turn it on, Google Calendar sync, as described above.
• Internet — used for Drive backup, Google Calendar sync, the AI features and store purchases, and, unless you switch them off, for the crash reports and usage events above. If you never use those, Tadly works fully offline.

Home-screen widgets need no permission of their own: they read the same local data as the app.

The website

tadly.app is a plain, static website. It sets no cookies, stores nothing in your browser, runs no advertising scripts and carries no third-party trackers. It does run one analytics script, from PostHog, which counts page views and a handful of button taps — which store badge was tapped, whether “Open web app” or the Pro button was, and where on the page the button sat — along with the ordinary technical details PostHog records: browser type, the page, and the country it works out from your IP address. Nothing is kept in your browser, not even for the length of a visit once you reload or leave, so we cannot tell one visit from the next, only how many there were. If your browser sends a Do Not Track or Global Privacy Control signal, nothing is sent at all. PostHog processes what it receives under its own privacy policy. Like any website it is also served by a hosting provider, which sees the usual server logs — your IP address, browser type and the page requested — for as long as it needs them to serve the site and keep it secure.

The web app at app.tadly.app saves habits, notes and attached images in your browser’s IndexedDB storage, on your device. None of them are sent to us unless you turn on sync, and then only in a form we cannot read. The web app also sends usage events to PostHog, under a random identifier kept in local storage; what they contain, and the Usage counts switch in Settings that stops them, are under Crash reports & usage analytics above. Clearing the site’s data in your browser deletes the local copy of your habits and that identifier together.

It can also, if you ask it to, sign you in with Google, back up to your own Drive and sync tasks with Google Calendar — the same things the phone app does, described under Signing in, Google Drive backup and Google Calendar above. All are optional and all are off until you turn them on. Signing in loads one script from Google. That script and PostHog’s are the only third-party code on either site.

We promised that any analytics on the website would be cookieless and aggregate — page counts, not people — and that we would say so here. They are, and this is where we say it.

If you email us, we keep your message for as long as we need it to reply and to remember what was said. We don’t add you to any list.

Children

Tadly isn’t directed at children under 13, and you need to be at least 13 to use it. Because Tadly doesn’t collect personal data, we don’t knowingly hold any about anyone, of any age. If you believe a child under 13 has sent us personal information — for example by email — write to us and we’ll delete it.

Your rights & choices

Most of what a privacy law would call your rights — to see your data, to take it with you, to delete it — you can exercise yourself, because you’re the one holding it.

• See and export. Everything you’ve ever tracked can be exported from the app’s backup settings as a JSON file (CSV is coming). Export is free and always will be.
• Delete. Uninstall the app, or clear the site’s data in your browser, and the data is gone. Widgets go with the app.
• Sync. Turn it off in the app’s backup settings and the device stops sending. To remove what is already stored, write to privacy@tadly.app or delete your account.
• Your account. Sign out on any device to remove it from that device. To delete the account itself — the one row holding your email — write to privacy@tadly.app from that address. Nothing on your device is affected either way.
• Google Drive. Sign out in the app to stop backups; remove Tadly from your Google account’s connected apps to revoke its access; delete the hidden app data in Google Drive’s settings to remove the backup and the key file themselves.
• Google Calendar. Turn calendar sync off in the app to stop it; remove Tadly from your Google account’s connected apps to revoke its access; delete the “Tadly” calendar in Google Calendar to remove the events.
• AI. Don’t use the AI features, and nothing is sent.
• Crash reports and analytics. On the phone, one switch, Settings → General → Help improve Tadly, turns both off: usage events stop at once, crash reporting from the next launch. In the web app, Settings → Usage counts turns usage events off. In any browser, a Do Not Track or Global Privacy Control signal turns them off too, on the web app and this website alike. If you have signed in, the usage events linked to your account — including the server’s record of a Pro purchase, which no switch reaches — can be deleted on request: write to privacy@tadly.app from that address.
• Health Connect. Unlink a habit in Tadly, or withdraw access in Health Connect → App permissions → Tadly.
• Permissions. Withdraw any permission in your device’s settings. The related feature stops; the rest of the app carries on.

Depending on where you live, you may have further legal rights — for example under the GDPR in Europe or the CCPA in California — including the right to complain to your local data protection authority. For anything you can’t do yourself, including data you’ve sent us by email, write to privacy@tadly.app. We aim to reply within 2 working days, and in any case within the time the law allows.

Security

Data on your device is protected by the device itself: your screen lock and the storage encryption modern phones ship with. Tadly’s app lock adds a PIN or biometric check on top, for when someone else has your unlocked phone. Your Drive backup is protected by your Google account, so a strong password and two-step verification there protect it too. Traffic to Google, Anthropic and the stores is encrypted in transit.

No system is perfect. If we ever learn of a security problem that affects you, we’ll say so plainly and promptly — in the app’s release notes and on this page.

Changes to this policy

When we change this policy, we change the date at the top. Small edits — clearer wording, a new link — happen quietly. If a change means Tadly would start sending something it didn’t before, we’ll say so in the app’s release notes and here before it ships, and where the feature has a switch, we’ll tell you where it is.

Contact

For privacy questions and requests: privacy@tadly.app.

For everything else, see the contact page.

Effective 2 October 2026.