CoHabits Privacy Policy

Effective date: September 17, 2026 Status: Publication draft — obtain legal review before release where appropriate.

CoHabits is operated by Kaila Canas ("CoHabits," "we," "us," or "our"). This policy explains how the current version of the CoHabits mobile application handles information. The app is listed on the App Store as CoHabits: A Happier Home.

Summary

Your household's information — tasks, lists, events, projects, members — stays on your device. It is never sent to us, and the app contains no code that could send it.

An account is optional and separate from that. The app works completely without one. If you choose to create one, we hold an email address and nothing else; it exists so the same person can reach the same account from more than one device.

There is no advertising, no analytics, and no third-party tracking of any kind.

Information that stays on your device

You may enter household names, member names and initials, member colors, tasks and their details, due dates and assignees, completion records, events, shared lists and list items, and projects with their tasks and subtasks.

All of it is stored on your device in the app's own storage. It is not transmitted to us, and no part of the app is capable of transmitting it.

Completion records identify which household member marked a task complete, and when. That attribution exists so a household can tell whether shared care — pet medication, for example — has already been handled. It stays on the device with everything else.

Information we hold, only if you create an account

Creating an account is the only thing that causes CoHabits to contact a server. That server is account.cohabits.app, which we operate, and it answers exactly one question: who you are.

What it stores:

• An email address. This is what identifies your account. You provide it directly when you sign in with an address, or Apple provides it when you sign in with Apple.
• Apple's subject identifier, if you sign in with Apple. It is unique to you and to this app, so it identifies you to us and to nobody else.
• Session tokens, stored only as a one-way hash, so a copy of our database cannot be used to sign in as you.
• Apple's refresh token, if you sign in with Apple, kept for exactly one purpose: revoking the credential when you delete your account, which Apple requires. It is deleted with your account.
• Two timestamps: when the account was created and when it was last used.

What it does not store: no name, no household, no task, no list, no event, no project. Signing in, signing out, or deleting your account changes no household information anywhere.

Sign in with Apple and private relay addresses

If you sign in with Apple and choose to hide your address, Apple gives us a @privaterelay.appleid.com address that forwards to you. We treat it like any other address. Note that it will not match an address you might type when signing in elsewhere, so the app lets you attach your real address to the account deliberately if you want the two to be the same account.

Six-digit sign-in codes

When you sign in with an email address, we send a six-digit code to it. The code is stored only as a one-way hash, expires in ten minutes, can be used once, and is limited in how many times it can be requested or guessed.

Those emails are delivered by Resend (resend.com), which processes the address for the sole purpose of delivering the message. The messages contain no tracking pixel and no links to click.

IP addresses

The account service counts requests against the IP address they come from, so that a public endpoint that sends email cannot be used to flood someone's inbox or to guess codes. The address is stored in a short-lived counter and is used for nothing else — not analytics, not profiling, not advertising. It is not linked to your account record.

Permissions

Notifications is the only permission the app requests, and only when you turn on Reminders and updates in Settings.

If you allow it, CoHabits schedules a reminder for each task with a future due date. The reminder shows the task's title, its household's name, and either its description or its category — so a task's title can appear on your lock screen. Reminders are scheduled entirely on your device by iOS; nothing about them is sent anywhere, and they work with no connection.

Device backups

If you use iCloud Backup, or back your device up to a computer, that backup may include CoHabits data along with your other app data. It is created and controlled by Apple's services and your own settings, not by CoHabits. Your session token is deliberately excluded: it is stored in the iOS Keychain in a way that does not travel to another device.

Sharing and third parties

We do not sell personal information and we do not track you across apps or websites.

Your household information is never shared, because we never receive it. The limited information described above is handled by:

• Cloudflare, which hosts the account service and its database.
• Resend, which delivers sign-in code emails.
• Apple, if you use Sign in with Apple, under Apple's own terms and privacy policy.

Apple may also process App Store, download, device, or crash information as a result of your using an App Store app. We do not receive that information.

Retention, deletion, and control

Your household information stays on your device until you change or delete it. You can delete tasks, list items, lists, events, projects, project tasks, subtasks, and whole households from within the app. Deleting a household deletes everything inside it. None of it is recoverable, because we keep no copy anywhere. Deleting the app removes its local data from the device.

Your account can be deleted from inside the app, in Settings → Account → Delete account. That deletes the account record, the email address, every session, and the stored Apple credential, and revokes that credential with Apple. It cannot be undone. Your household information is untouched by it, because it was never on our server in the first place.

Signing out ends the session on that device and deletes nothing.

Children

CoHabits is a general household-coordination tool and is not directed to children under 13. We do not knowingly collect children's personal information. A parent or guardian may contact us with a concern.

Security

Household information is protected by your device: its passcode, its encryption, and the isolation iOS gives every app's storage. Your session token is held in the iOS Keychain rather than ordinary app storage.

Connections to the account service use HTTPS. Session tokens and sign-in codes are stored only as one-way hashes, so a copy of our database cannot be used to sign in as anybody. No method of storage or transmission is completely secure.

Changes

We may update this policy as the app changes. We will change the effective date and provide any notice or consent required by law for material changes. If we add synchronization, sharing between people, analytics, advertising, or purchases, we will update this policy and the App Store privacy disclosures before that behavior ships.

Contact

Operator: Kaila Canas Privacy email: support@cohabits.app