Atomic Flux — Privacy Policy

This policy covers the Atomic Flux iOS app (including its "Habit Streak" home-screen widget) and the backup service it syncs to. It's written and maintained by the app's developer, referred to here as "we."

The short version

• Your habit data, name, and settings back up automatically — a copy of your progress, profile answers, and preferences is kept on our server so you don't lose anything on a reinstall or new device. This happens whether or not you create an account: every install gets a private, anonymous identity used to back things up even before you ever sign in.
• Signing in adds a real identity to that backup — protected by a cryptographically verified Apple or Google sign-in, not just a name you type in — so the same data reaches you again on a new device by signing in, not just by keeping this one.
• Setup asks for your country and birthdate — self-reported, never GPS-derived, and used only in aggregate; your birthdate also confirms you're 13 or older before you can continue.
• We don't currently share or sell individually identifying data — but we do share aggregate, non-identifying usage counts with companion apps we may partner with, and we may in the future share or sell personal data too (service providers, advertising partners, or a sale of data); see Third parties for exactly what that means and how to opt out.
• Your email is stored in exactly one place, and only if you sign in. Every other record about your habits or app usage references an anonymous internal ID instead — see Storage & security.
• You can ask for your synced data to be shown to you or deleted at any time, and opt out of any future sale or sharing — see Your choices & opt-outs.

What we collect

Every install, signed in or not. The moment you finish setup, your device is given a private, anonymous identity (not tied to your name or email) that's used to back up the items below to our server. This is not optional and doesn't require creating an account — it's how your progress survives a reinstall or a new device even if you never sign in. If you go on to sign in with Apple or Google, this same data continues backing up, now also attached to that account.

Your name and interests. First-time setup asks for your first and last name and which habit topics interest you — used to personalize the app (greeting you by name, suggesting relevant habits) and included in your backup.

Habit data — each habit's title, category, icon, color, and any notes you've written for it; its weekly schedule and reminder time; every date you've ever marked it complete; your current and longest streaks; and your account-level level, XP, coins, gems, and quest progress.

Appearance settings — your chosen appearance mode (light/dark/system) and accent color.

Notification preference — whether daily habit reminders are turned on.

Country and birthdate, entered at setup — self-reported, never derived from GPS or any device location signal. Your birthdate is how we confirm you're 13 or older before you can continue — see Children — and, together with country, is used only in aggregate, never individually: things like "what fraction of our users are in a given age range," not a lookup of any one person's exact age.

Account & identity — only if you sign in. Signing in with Apple or Google adds one more thing to what we receive: your email address, the display name your provider gives us, and which provider you used. No phone number, no physical address — the name you provide comes from onboarding (above), not from Apple/Google, unless you choose not to fill it in yourself.

Companion-app usage. If you link a habit to a companion app (e.g. a language or fitness app), each time you tap to open it we record which app, its identifier, and the exact date and time — signed in or not, backed up the same way as everything else here. This is what lets the app show you patterns like "you usually do this around 8am." Your individual events are never shared outside your own backup — but we may share the aggregate count across all users (e.g. "Atomic Flux users opened Duolingo 4,000 times last month") with that companion app's team; see Third parties.

Technical & security data. Like any server, ours briefly sees the IP address a request comes from. For signed-in accounts, we hold this only in memory, only long enough to slow down repeated failed sign-in attempts, and never write it to a database or attach it to your profile. For anonymous installs, we also keep a first-seen and most-recent IP address attached to that anonymous identity (never to your name or email) — used only to slow down abuse of the anonymous-backup system, and visible only through the same administrative access described in Who can see it.

What we don't collect. Location, contacts, photos, camera or microphone access, the list of other apps on your device, advertising identifiers, or payment details. Atomic Flux doesn't request any of these, signed in or not.

How we use it

• To back up and restore your progress, name, and settings across devices and reinstalls — the entire reason this backup exists, whether or not you've signed in.
• To show you your own patterns — streaks, XP, and companion-app habits, reflected back to you inside the app.
• To keep the service working — rate-limiting abusive requests, diagnosing bugs.

We do not use your data to train models, build advertising profiles, or share it with data brokers. There is nothing else it's used for.

Storage & security

When you sign in, your device sends an encrypted (HTTPS/TLS) copy of your data to a server we operate directly — not a third-party cloud analytics platform. The same is true even before you sign in: every install's anonymous backup travels the same way, over the same encrypted connection.

On that server, your email address is stored in exactly one place: a dedicated account record, created only if you sign in. Every other table — your habits, your name, your streak history, your companion-app events — stores only an internal, randomly generated ID instead of your email. Reversing that ID back to your email is a separate, deliberate step available only for the administrative purposes described below.

Every request that reads or writes a signed-in account's data is checked against a real, cryptographically verified Apple or Google sign-in token — not just a name or email typed into a URL. An anonymous install's backup is checked against that install's own private identity instead, since there's no sign-in credential to verify it against.

Who can see it

Third parties

Today. Atomic Flux currently uses these outside services and practices:

• Sign in with Apple / Google — used only to verify who you are. Each handles your credentials under its own privacy policy; we only ever receive the email, name, and verification token they choose to share.
• Apple's public App Store search — used when you search for a companion app by name, so you don't have to type a URL by hand. This sends only the text you search for, with no personal data attached.
• Aggregate companion-app statistics — we may share a companion app's team (e.g. a language or fitness app featured in Quick Add) an aggregate count of how many Atomic Flux users opened their app, as part of exploring a partnership or featuring them more prominently. This is always a total count across every user, never tied to your name, email, or any other identifying detail — the same way "1,204 people opened this link" doesn't reveal who any of them were.

We do not currently run advertising, use third-party analytics SDKs, or sell individually identifying data.

In the future. We're disclosing this now even though none of it is active today: as Atomic Flux grows, we may share or sell personal information with third parties in these ways —

• Service providers — companies that would run parts of the app on our behalf (for example, cloud hosting or email delivery), bound by contract to use your data only to provide that service to us.
• Advertising or marketing partners — to support ads shown in the app or elsewhere, which could include sharing identifiers or usage data with an ad or marketing platform.
• Sale of data — exchanging personal information with a third party for money or other value, as its own business arrangement rather than a service performed for us.
• Business transfers — if Atomic Flux is acquired, merged, or its assets sold, your data may transfer to the company involved, under the same protections described here (or ones we notify you of first).

If we start doing any of the above, we'll update the date on this policy and, where practical, tell you inside the app before it happens. You always have the right to opt out of any sale or sharing of your data for advertising purposes — see Your choices & opt-outs.

Retention

Local data on your device stays until you delete the app. Synced data on our server — whether backed up anonymously or under a signed-in account — stays until you delete it yourself (see below) or, for a purely anonymous install, until you stop using the app entirely; there's no automatic expiry that would silently lose your streak history while you're still using it.

Your choices & opt-outs

• Access — ask us for a copy of everything stored under your account or anonymous backup.
• Deletion — tap Delete Account in Profile → Connected Account (or the equivalent anonymous-data control if you've never signed in) to permanently delete your synced habits, progress, and profile from our server, right in the app. Deleting the app itself only removes what's stored locally; use the in-app control (or email us) for your synced backup.
• Correction — your habit data, name, and settings are fully editable in the app at any time; for a signed-in account's email/name, sign out and back in with the corrected details.
• Opt out of sale or sharing — tell us at any time that you don't want your data sold or shared with advertising partners, described in Third parties. We'll honor that opt-out going forward, whether or not we're actively doing either yet.

Access requests and sale/sharing opt-outs are still handled directly by the developer today rather than an automated in-app control — email the address below and expect a response within a reasonable time.

California residents

Under the California Consumer Privacy Act (CCPA/CPRA), you have the right to know what personal information we hold about you, to request its deletion, and to opt out of its sale or sharing — including for cross-context behavioral advertising. We will not deny you service, charge you a different price, or provide a different level of service for exercising any of these rights. To exercise any of them, use the contact below; we don't currently sell or share data in a way that requires responding to a browser's Global Privacy Control signal, but we'll honor one if you send it once we do.

EU/UK/EEA residents

Where GDPR/UK GDPR applies, backing up your habit data and profile relies on your consent, which you give by using the app (for the anonymous backup) or by signing in (for an account), and can withdraw at any time by deleting your data through the in-app control. Any future sharing with advertising partners described in Third parties would require its own separate, explicit consent from you first — not just continuing to use the app.

Children

Atomic Flux is a simple, wholesome habit tracker — there's nothing in it we'd think twice about a younger person using, and building good habits is a genuinely good use of screen time at any age. Using Atomic Flux fully, with every feature, never requires an account or an email address; everything works entirely without signing in.

Setup does ask for a real first/last name and birthdate, though, and that backs up automatically the way described above — so, like most apps that collect this kind of information, we don't knowingly collect personal information from anyone under 13 (or the minimum age required by your local law) without a parent or guardian's consent. First-time setup actually asks your birthdate and won't let you continue past that step if you enter one showing you're under 13 — a real check, not just a policy statement. If you believe a child has gotten past that anyway, contact us and we'll delete the data.

Where data lives

Your synced data is processed and stored on infrastructure operated directly by the developer — not a third-party cloud platform — rather than a specific, fixed commercial data center region. If that changes (for example, a move to a commercial cloud region), this section will be updated to name it specifically.

Accessibility

Atomic Flux is built with iOS's standard interface components, which carry some baseline support for VoiceOver and other assistive technologies from the operating system itself. We haven't yet completed a dedicated accessibility audit, and we're telling you plainly rather than claiming more than is true: much of the app's text does not yet resize with iOS's Larger Text setting, and screens don't yet carry hand-written VoiceOver labels beyond what iOS infers automatically.

We're working toward the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA — the common benchmark used for app accessibility — as our goal, not a claim of where we are today.

If something in Atomic Flux is difficult or impossible for you to use because of a disability, please tell us at the address below. Accessibility reports are treated as bugs, not feature requests, and we'll get back to you.

Changes to this policy

If this policy changes in a way that meaningfully affects what we collect or how we use it, we'll update the date at the top and, where practical, note it inside the app. Continuing to use Atomic Flux after a change means you accept the updated policy.

Contact

Questions, access, or deletion requests:

Atomic Flux
info@atomicflux.app