Privacy in habit apps

A habit log is not a step count. It is a diary of what you are trying to become, what you swallow, how you slept, whether you drank, what mood you claimed at 11 p.m., and sometimes a note you would not put on a shared calendar. Treating that file like a public analytics event is a category error. Privacy in a habit app is not a badge. It is a set of tests you can run in an afternoon.

Do you need an account to track habits is the first test: can you log without becoming a user. The second is airplane mode. The third is what "AI" means when the copy says coach. The fourth is export: can you leave with a file. Fail any of those and you are renting a diary.

This is not legal advice, and it is not a claim that local storage makes you invisible. Phones have backups, screenshots, and shared tablets. It is a claim that the default should be on-device, with the network as an opt-in.

Four tests that beat a privacy page

Airplane mode. Turn the radios off. Add a habit, log it, open whatever coaching or insights the app promises. If logging dies, the source of truth is a server. If coaching dies, the model is not on the phone. A product can still offer optional sync. It should not require the tower to tick a box.

No account. Skip sign-in. Use the app for a week. If skip is missing, or if skip still phones home with a persistent id, you did not skip. Guest mode that is actually local is rare enough to prize.

On-device AI. Apple Intelligence, on a capable iPhone, can run Foundation Models on the device. That is a specific architecture: the prompt and the habit rows do not need to leave the phone for a summary. A "coach" that needs an API key in the cloud is a different architecture. You cannot see the difference in a screenshot of a chat bubble. You can see it in airplane mode. On-device AI versus a cloud coach is the companion.

Export. Settings should produce a CSV or similar that opens in a spreadsheet, without Health raw samples you did not mean to duplicate, and without tokens. Exporting your habit history is the walk-through. If export is premium-locked, your diary is a hostage.

Wendy Wood's context-cued habits do not need a vendor profile. Harkin's progress monitoring needs a record you control. Lally's automaticity work was a local practice. None of this is an argument against every cloud. It is an argument against a cloud you cannot turn off.

What the policy should say in plain language

Where is the source of truth: device, server, or both. What syncs if you sign in: names, notes, mood, body measurements, settings. What never leaves: Health raw samples, for a product that got this right. What analytics still collect when you are signed out, including whether habit names travel with events. Names are not metadata. "Drank less," "medication," "therapy homework" are content.

Who the subprocessors are. A Sign in with Apple button still involves Apple. A Google sign-in still involves Google. Firebase as a sync layer still involves Google's servers, which may be outside your country. That can be an honest backup. It should be described as a backup, not as "we never see your data" if the database contains habit rows.

Children, sale of data, ads. Habit apps should not be ad networks. If the policy is silent, that is not comfort. Deletion: account deletion should delete the cloud copy, and uninstall should delete the local copy. You want both, in writing.

Charles Duhigg popularised inspecting the loop. Inspect the vendor the same way. Cue (open app), routine (log), reward (a number). If a fourth party is in that loop, name it.

Question	Good answer	Walk-away answer
Airplane mode	Logging and on-device insights still work	"Connect to continue"
Account	Optional, skippable, local-first	Required before the first tick
AI	Named as on-device, fails closed without a network	"Our cloud coach," no offline test
Analytics	Policy lists events, including whether names are sent	Vague "improve the product"
Export	CSV on demand	Support ticket, or not at all

BJ Fogg's tiny behaviour is easier to start when the first screen is the habit, not a permissions waterfall. Ask for Health, notifications, and iCloud later, at the moment they do a job. A first-launch grab for everything is a tracking product wearing a habit costume.

Habit AI is a useful example of the tests above: data lives on the phone with no account required, Apple Intelligence coaching runs on-device so you can put the phone in airplane mode and still get a summary, and optional Sign in with Apple or Google is backup, not the gate. Read the privacy policy for what optional analytics still include. The architecture is the point. The brand is optional.

Run the tests on any tracker you already use. If airplane mode breaks the coach, you learned something the screenshots did not say. Switch or stay, but stay on purpose.

Read next

Do you need an account to track habits is the sign-in test. On-device AI versus a cloud coach is the model test. For the product that tries to pass both, see how Habit AI works.