BankedPrivacy Policy
Last updated: 1 November 2026
Banked is a habit timer. It keeps what it needs to time your habits, bank your points and sync between your devices, and nothing else. There are no ads, no analytics, no tracking and no selling of data.
Who is responsible
Nicola Distl, Switzerland. Contact: hello@bankedhabits.com.
What we store, and why
| Data | Why |
|---|---|
| An account id and a device credential, created on first launch | So your data belongs to you and syncs, without asking you to sign up |
| Your habits, schedules, plans, sessions, corrections, points and rewards | This is the app: it cannot time or reward anything without them |
| Email address and a hashed password, if you create an account | To sign you in on another device and to send confirmation and password-reset codes |
| Google or Apple account id and email, if you sign in with them | To recognise you when you sign in again |
| Your friends list and which habits you share with whom | To show friends what you chose to share |
| IP address, in server logs and short-lived rate-limit counters | To keep the service running and stop abuse (for example password guessing) |
This policy covers both the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR). The legal basis is performance of our contract with you (Art. 6(1)(b) GDPR) for running the app, and our legitimate interest in security (Art. 6(1)(f)) for logs and rate limits. The optional AI feature below is based on your consent (Art. 6(1)(a)).
What friends see
Nothing, until you share a habit. For a shared habit, the friends you chose see its name, which days you did it and your streak. They never see how long a session was, your points, your rewards or any habit you have not shared.
Personal encouragement (optional, off by default)
If you turn on personal encouragement in Account & data, once a day the names and difficulty of your habits, the name of the reward you are saving for, and a description of your streak and level are sent to Anthropic to write the short lines shown under the timer. Turning it off stops this and deletes the lines already written.
Who processes data for us
- Google Cloud (Cloud Run, Cloud SQL) hosts the service and its database in Belgium (europe-west1).
- Resend delivers emails (confirmation and password-reset codes), and so receives your email address.
- Anthropic, only if you turned on personal encouragement, as described above.
Resend and Anthropic are based in the United States. Transfers to them rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the EU Standard Contractual Clauses in each provider's data processing agreement, with the Swiss amendments for transfers from Switzerland.
On your device
The app keeps a copy of your data on the phone so it works offline, plus device settings such as sound and reminders. The device credential is kept in the iOS Keychain, which is why reinstalling the app brings your account back.
How long we keep it
Until you delete your account. Stats → Account & data → Delete account removes your account and everything in it from our database immediately. Database backups are kept for 7 days and then overwritten. Password-reset and confirmation codes expire within an hour.
Your rights
You can ask for a copy of your data, its correction or deletion, restrict or object to processing, and receive your data in a portable format, by writing to hello@bankedhabits.com. You can withdraw consent for the AI feature at any time in the app. You also have the right to complain to a data protection authority, in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), and in the EU the authority of the country where you live.
Children
Banked is not directed at children under 13 (16 where your country requires it) and does not knowingly collect their data.
Changes
If this policy changes, the new version is posted here with a new date. A change that widens what is shared will be announced in the app first.