ShareHab is operated by forgegroup.world, trading as ShareHab ("we", "us"). We are the data controller for the personal data described in this notice, and we decide how and why it is processed. You can reach us at admin@forgegroup.world.
What we collect, why, and on what basis
- Account data — email address and an encrypted password held by our authentication provider. Purpose: creating and securing your account. Basis: performance of our contract with you.
- Profile data — display name, username, avatar emoji or uploaded photo. Purpose: identifying you to friends you choose. Basis: contract.
- Habit data — habit names, frequency, optional goals and reminder times, completion dates. Purpose: providing the core service. Basis: contract.
- Social data — friendships, invitations, encouragement messages, blocks and reports. Purpose: providing social features and keeping users safe. Basis: contract, and our legitimate interest in preventing abuse.
- Technical data — IP address, device and browser information, error and security logs. Purpose: security, fraud prevention, reliability. Basis: legitimate interests.
- Purchase data — the fact that you bought a Commitment Challenge, and the order reference. Purpose: unlocking what you paid for, support, accounting. Basis: contract and legal obligation. We never receive or store your card details.
- Support messages — what you send us by email. Purpose: answering you. Basis: legitimate interests.
We do not collect your location, contacts, advertising identifiers or any special categories of personal data.
Who can see your habits
- Only me — no other user can see the habit, its history or its statistics.
- Friends — accepted friends can see the habit and its completions.
- Selected friends — only the specific friends you pick can see it.
New habits default to Only me. Private habits never appear in friend profiles, activity feeds, leaderboards, challenges, notifications, search results or shared links. This is enforced by database access rules on our servers, not only by the app interface.
Who we share data with
- Payment processing and merchant of record — Stripe. Our checkout and order process is operated by Stripe (Stripe, Inc. and its group companies, including Stripe Payments Europe, Ltd.). For eligible orders Stripe acts as merchant of record and as an independent controller for checkout, payments, fraud screening, tax compliance, invoicing, receipts and refunds. When you buy a Commitment Challenge, your card and billing details are collected and processed by Stripe under its own privacy policy. We never see or store your card details. Stripe shares your order reference and email with us so we can unlock your purchase and provide support. Your bank statement may show a descriptor that includes Stripe or Link alongside our name.
- Service providers (processors) — hosting, database, authentication, storage and email delivery providers acting on our instructions under contract.
- Professional advisers — legal and accounting advisers where necessary.
- Authorities — where we are required to disclose by law.
We do not sell your personal data and we do not use it for advertising.
International transfers
Our providers may process data outside your country, including in the United States. Where data leaves the UK or EEA we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.
Messages
Encouragement messages are visible only to the sender and the recipient. Recipients can report a message; reports are reviewed by us for safety purposes only.
Retention and deletion
We keep account, profile, habit and social data for as long as your account exists. You can delete individual habits and their history at any time. Deleting your account removes your profile, habits, completions, friendships, invitations and messages, and anonymises anything retained for security or abuse-prevention records, which we keep for up to 12 months. Order records are retained by Stripe and by us for the period required by tax law, typically 7 years. Data no longer needed is deleted or anonymised.
Security
We use encryption in transit, encrypted storage, row-level database access rules, scoped access controls and audit logging of administrative actions.
Your rights and choices
- Change habit visibility at any time.
- Turn off discoverability so other users cannot find you by search.
- Export a full copy of your data as JSON.
- Block users, remove friends and revoke invitations.
- Depending on where you live, you may have rights to access, correct, delete, restrict or port your data, to object to processing based on legitimate interests, to withdraw consent, and to complain to your data protection authority. We aim to respond within one month.
Cookies
We use only essential storage to keep you signed in and to remember an invitation code. We use no advertising or third-party tracking cookies. See our Cookie Policy for details.
Contact
Privacy questions and data requests: admin@forgegroup.world.