Effective November 10, 2026
Privacy Policy
Habits and Wisdom is a personal planner. Your plans are yours: private by default, shared only when you choose, and never sold.
1. Who We Are
Habits and Wisdom ("we", "us") is operated by Ryan Llonora, doing business as RLAutomations, Philippines. We are the personal information controller for the information described here, under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules. Our data protection officer is Ryan Llonora, reachable at privacy@rlautomations.com.
2. What We Collect
| What | Examples | Why |
|---|---|---|
| Account | Email address; name and picture if you sign in with Google or Facebook (we ask only for your basic profile and email, and we never post for you); a password (stored only as a secure hash by our login provider); if you joined with an Admin Invite, which invite you used | To create your account and let you sign in |
| Profile | First and last name, display name. Birthday and city only if you tick the box to store them | To greet you and show your name to people in groups you join |
| Your plan | Goals, tasks, chores, routines, checklists, Achieved entries, notes and journal entries, trackers, setup answers, trips | To provide the planner |
| Budget | Budget categories and plans, amounts you record (money in, money out, savings, and older transfers), the savings accounts you name (for example a bank or a cash jar) with the amount already saved that you enter, finance goals (save, earn or pay; purpose, amount and due date, and which entries count toward them), bills, vehicles with odometer and fuel readings. No bank or card connections, and no account numbers | To help you plan and track your money. Only you can see it |
| Trips and trip photos | Trips: itinerary stops (places, addresses, booking references, links), packing lists and documents checklists, packing templates you save, trip plans and expenses with the exchange rate you lock. Up to 15 photos per trip (one can be the trip's own picture), shrunk on your device before upload with their hidden location data removed | To plan and remember trips. Private to you unless you share a trip with a group: then the group sees its itinerary, lists and photos (never your money) |
| Vision boards | Boards you make: their names, template and colours, and what you place on them (pictures, quotes, notes, colours, milestones, reflections, labels, and links to your own goals, tasks, routines, savings goals and trips), with where each sits on the board. Up to 150 pictures per account, shrunk on your device before upload with their hidden location data removed | To keep your boards on every device. Private to you unless you share a board with people from your groups: then they see its shared items (and, as editors, can add and change them) and the names of the others on it. Items marked private stay with whoever added them; a link to a savings goal is always private, and your goals, budget, notes and location are never shown because of a shared board. Pictures are stored in a private space and opened only through short-lived links |
| Groups | Groups you create or join, the emails you invite, a group photo if the owner adds one (shrunk on the device, location data removed; seen only by the group), items you share into a group, check-ins you post | To let you plan together with people you choose |
| Calendar | Events you add: what, when (day, optional times, or several days), where, notes, life area and how it repeats. The Calendar also shows dates you already entered elsewhere (tasks, chores, routines, trips, bills, money goals, group tasks assigned to you) without copying them. Birthdays appear only for you, and for people in your groups who ticked "Show my birthday" (day and month only, never the year) | To show all your dates in one place. Your events are private to you |
| Subscription | Your trial dates, whether you pay monthly or auto-renew, which method you used (for example GCash, Maya or card), the amount, dates and PayMongo's reference for each payment, and the PayMongo customer and subscription IDs. Never card numbers, CVCs or wallet logins: those go straight to PayMongo | To run your subscription, show your receipts, send renewal reminders, and apply the hold and erase rules. Only you can see it |
| Look and feel | Palette, custom colors, life areas, icons, group colors | To keep your setup the same on every device |
| On your device only | Light or dark mode, text size, wallpaper, Today's section order, the vision board List or Board view, and (until you copy it into your account or clear it) an older vision board saved in this browser | Kept in your browser; we never receive them |
| Devices | For each browser or home-screen app you sign in on: a random device ID kept in that browser, a short label such as "iPhone · Safari", and when it was first and last used. No phone number, IMEI, location or contacts | To keep invited accounts to a small number of devices (Admin Invite accounts: up to the number shown when you join, normally 2), and to help you and us spot sign-ins you don't recognise |
| Visit days | The calendar days (Philippine date) on which you opened the app. Not what you did, how long, or where | To tell active and inactive accounts apart, so we can see how the app is used and who might need help |
| Technical | Sign-in session cookie; basic server logs (time, page, error details) kept by our hosting providers | To keep you signed in and the service secure and working |
We do not use advertising or tracking cookies, we do not sell or rent personal information, and we do not use your plans to build advertising profiles. We don't ask for your precise location, contacts, or government ID.
3. Sensitive Information
A birthday is stored only with your explicit consent and can be removed at any time. Budget amounts are financial information: they are visible only to you, never shared into groups, and never shown to AI. Journal entries and notes may contain things you consider sensitive; they are visible only to you. Health entries and location sharing are not available yet; if we add them, they will be off by default and ask for separate consent first.
4. Legal Basis
- To provide the service you asked for (your account, plan, groups): necessary to fulfil our agreement with you.
- Consent for optional information (birthday, city, sharing them, any future calendar connection, health entries or location). You can withdraw consent at any time in the app.
- Legitimate interests in keeping the service secure and fixing problems, balanced against your rights.
- Legal obligations, for example responding to lawful requests from authorities.
5. Who Can See Your Information
- Only you, by default. That includes your goals, plan, notes, journal and trackers.
- People in a group you joined see your name and email, anything you share into that group (as a copy; your personal item stays private), and your check-ins there. Private steps are seen only by you. Your birthday or city is shown only if you choose to share it.
- People you invite see the group's name and description and who invited them, before deciding to join.
- The person who runs Habits and Wisdom (Ryan Llonora) can see account details on an admin page: your name, email, how you sign in (Google, Facebook or email), when you joined and last signed in, the days you opened the app, the devices you signed in on (label and dates), your subscription status, and whether your account came from an Admin Invite. Never your goals, plans, notes, journal, money, trips, photos or vision boards.
- Our service providers, only to run the service, under contracts that require them to protect it (see section 6).
6. Service Providers and Where Data Is Stored
| Provider | What they do | Location |
|---|---|---|
| Supabase | Database and sign-in | Singapore |
| Vercel | Hosting the app | Singapore region, with a global network |
| Resend | Sending account emails (confirm email, reset password, subscription reminders) | United States |
| "Continue with Google" sign-in, only if you use it (on the sign-in and invite pages, Google's sign-in button is loaded from Google). Maps: when you open a place in Google Maps or show a map in a trip, Google receives that place and your device's IP address, under Google's own privacy policy | Global | |
| Frankfurter | Daily reference exchange rates. Only the currency code is sent; nothing about you | European Union |
| PayMongo | Subscription payments (GCash, QR Ph, Maya, cards) and auto-renewal. PayMongo receives your name, email and payment details; we never see your full card or wallet details | Philippines |
Storing and processing data outside the Philippines is a cross-border transfer. We remain responsible for your information and choose providers with strong security and data-protection commitments.
7. AI Features
AI suggestions are not switched on. If we add them, they will be optional, clearly labelled, and never change your plan without your approval. By default, AI will not see your journal or notes, any health entries, or any data from accounts of people under 18. You would choose separately for each kind of data, and could withdraw at any time.
8. How Long We Keep It
- While your account is open, we keep what you store in it.
- Things you delete in the app (a goal, a note, a budget entry, a trip, a group you own) leave the app right away and wait in your Recently Deleted for 30 days so you can restore them. Only you can see them there. After 30 days (or sooner, if you choose Erase) they are permanently erased. A group you delete is hidden from everyone in it during that time. Photo files are erased by a daily clean-up within about a day of that.
- If you delete your account, it closes immediately and is permanently erased after 30 days (you can cancel before then). Encrypted backups kept by our database provider roll off on their own schedule; all copies are gone within 3 months.
- When an account is erased we keep a small record with no name, email or content: the date it was opened and closed, why it closed (deleted, lapsed or other), how many days it was used, and whether it came from an Admin Invite. We use it only to understand how the service is doing.
- If your free trial or paid time ends and you don't renew, the account goes on a read-only hold: you can still open, export and delete everything. If it isn't renewed within7 days of the hold starting, the account and all its data are permanently erased, the same way as deleting your account. We email you when the hold starts and again before the erase. Payment records may be kept longer where tax or accounting law requires it.
9. Your Rights
Under the Data Privacy Act you have the right to:
- be informed about how your data is used (this page);
- access your data and get a copy of it: More → Privacy and data → Download my data;
- correct it: edit anything in the app, or your profile;
- erase or block it: delete items, or your whole account (how);
- object to processing and withdraw consent: untick optional choices at any time;
- data portability: the download is a standard JSON file;
- complain to the National Privacy Commission (privacy.gov.ph) if you believe your rights were violated. We'd appreciate the chance to fix it first: privacy@rlautomations.com.
We answer requests within 15 working days.
10. Security
Data is encrypted in transit (HTTPS) and at rest by our database provider. Row-level security rules in the database ensure each account can only read its own information, plus what others have deliberately shared with it. If a personal data breach occurs that is likely to put you at real risk, we will notify you and the National Privacy Commission within 72 hours of knowing about it, as the law requires.
Misuse and attacks on the service
If we find that an account, or a device signed in to it, is being used to break into, attack, overload or tamper with Habits and Wisdom, or to reach other people's information, we will block that account's access straight away, without warning, to protect everyone else. Where we can, we will also block the device or network it came from. We may keep the related records (for example times, IP addresses and the actions taken) as evidence, report the incident to the proper authorities, including the National Privacy Commission and law enforcement, and cooperate with any investigation, as the Data Privacy Act (RA 10173) and the Cybercrime Prevention Act (RA 10175) allow. If you believe your account was blocked by mistake, for example because someone else used your device, email support@rlautomations.com and we will review it.
Your part in keeping your data safe
Our protections cover our systems, not your device or network. Be careful on public Wi-Fi (cafés, malls, airports, hotels): don't sign in, change your password or pay over public or unsecured networks; use mobile data or a network you trust. Keep your device locked and updated. To the extent the law allows, we are not responsible for access to your information that happens through a lost, shared or compromised device or an unsecured network (see section 12 of the Terms).
Check every link before opening it, even one that seems to come from us or RLAutomations.com. Our emails come only from no-reply@mail.rlautomations.com; we never ask for your password, one-time code, or card or e-wallet details by email, text or chat. If something looks off, don't click; email support@rlautomations.com.
11. Children
Accounts are for people 18 and older. Accounts for teens (13–17), created and managed by a parent or guardian, are planned but not open yet. If you believe a child has created an account, contact us and we will delete it.
12. Changes
If we change this policy in a way that matters, we will tell you in the app and ask you to review it before you continue. The date at the top shows when it last changed.
13. Contact
Ryan Llonora, doing business as RLAutomations, Philippines. Email: privacy@rlautomations.com.