Inosc
Inosc is a habit app for two people. This page explains exactly what it stores, who can see it, and how to get rid of it. It is written to be read, not to be survived.
The short version. We store your email, your name, your habits, the days you completed them, your profile picture, any photo you attach to a habit (deleted after 14 days), the nudges you send and receive, and your subscription status. The full list is below. Your partner sees your name, your tree, your habits, whether you did them each day since you paired, those photos, and whether your subscription is active, and nothing else. We don't track you, we don't show ads, and we don't sell anything to anyone. From version 1.0.4 of the app, the only analytics are about subscriptions: our server sends your purchases to a company called RevenueCat, described below. You can delete everything from inside the app, permanently, at any time.
What we collect
| Your email address | To create your account, sign you in, and send you the emails an account needs: confirming your address, resetting your password, confirming a change of address, and one welcome email. Nothing else: no newsletters, no marketing. If you sign in with Apple and choose Hide My Email, this is a private relay address that Apple forwards to you, and we never learn your real one. |
|---|---|
| Your password | If you sign up with an email address. It is stored only as a one-way scrambled form (a hash) by our database provider, so nobody, including us, can read it. |
| If you sign in with Apple or Google | Apple or Google tells us your email address (or Apple's private relay address), your name if you choose to share it, and an identifier for your account with them. We use these only to sign you in, and your name only if you haven't already given Inosc one. We never receive your Apple or Google password. Google also sends a link to your Google profile picture; we don't use it. If you sign in with Apple, we also keep a token Apple gives us, for one purpose only: when you delete your account, we use it to end Inosc's access to your Apple ID sign-in. Nobody can read that token but our server. |
| Your sign-in records | When your account was created and when you last signed in. For each signed-in session, our database provider also records the IP address it came from and the app and device version it reports, so sessions can be kept secure and signed out. We don't use these for anything else. |
| Your display name and your tree | So your partner sees a name instead of a stranger, and which kind of tree is yours. |
| Your profile picture | If you set one. Stored privately, and shown only to you. |
| Your habits | The name you gave each one, its icon, whether it's active, which one you marked as your priority, its place in your list, the day you started it, which preset it came from if you picked one, and when you last changed it. We also keep the history of when each habit was switched on and off, and the name it had at the time, so your past days still show the habits you had then. |
| Your completions | Which habit, which calendar day, the exact time you recorded it, and the timezone you were in. |
| Your habit photos | If you attach a photo when you complete a habit. Stored privately, kept against that habit and that day, and deleted automatically after 14 days. |
| Your day records | Once a day is over, whether it counted for you, fixed so it can't change afterwards. Your tree, your rings and your roots are worked out from these. |
| Your badges | Which badges you've earned, when, and the run of days that earned each one. Only you can see them. |
| Your nudges | When your partner nudges you, or you nudge them: who sent it, who it was for, the name of the habit it was about, when it was sent, when it was delivered to the phone, and when the person it was for saw it. Only the person a nudge was for can read it. The sender can't see whether, or when, you saw it. |
| Your root milestones | When your roots reach a milestone, the message we send you about it, when the milestone was reached, and when the message was delivered. Only you can read yours. |
| Your notification token | If you turn on notifications, an identifier Apple gives your device so a nudge from your partner, or news about your roots, can reach it, and whether it belongs to a test build or the App Store app. It identifies the device to Apple's push service, not you to anyone else. |
| Your pairing | Who you're paired with, when it started, when it ended if it has, and which of you ended it. When a pairing ends, we keep how many days you'd had together, so your own record still shows it. |
| Your invite codes | The code you share to pair with someone, when it was made, when it expires, and who used it and when. |
| Your setup | When you finished setting up the app, so it doesn't walk you through setup again. |
| Your agreement | That you confirmed you're old enough and accepted the terms: the date you did, which version of the terms it was, and the age you confirmed (16 or older). We keep this because we have to be able to show that you were asked. |
| Your rating card record | The app sometimes shows a small card asking whether you'd rate Inosc on the App Store. We keep which card you were shown and when, so the same card never appears twice. Only you can read it. Whether you rate the app, and what you write, stays between you and Apple. |
| Your safety records | If you report someone or block them, we keep that: who reported whom, the reason, any detail you wrote, and when. For a habit name or other text, we keep a copy of it as it was at the time. For a photo, we keep which photo was reported, its size and a fingerprint of it (not a copy), so if the owner has since changed or deleted it, we can tell, but the picture itself is gone. Reports are readable only by us: never by the person reported, and never by the person reporting. We also record what we did about a report. If you block someone, we keep the fact of it so they cannot pair with you again. |
| Abuse limits | The times you tried to use an invite code or change your email address, so nobody can guess codes or flood the system. |
| Your subscription | Whether it is active, which plan, when the current period started and ends, whether it is set to renew and to which plan, when a payment failed if one did, and Apple's transaction number that links the purchase to your account. If you earn the paired rate, when you earned it, the paired days it was earned over, and who you were paired with. Apple tells us all of this; we never see your card or payment details. See Subscriptions for the messages Apple sends us. |
| Free access | If we've given your account free access (for example, our own accounts), the fact of it, when, and a short note why. |
That's the whole list. We don't collect your location, your contacts, your photo library, or your advertising identifier. The camera is used only when you choose to take a photo. If you pick a photo from your library instead, Apple's photo picker hands the app only the one you chose, never access to the rest of your library. Only the photo you keep is uploaded. Apart from the sign-in records and the notification token above, we keep no identifier for your device. The records above are the only record we keep of how you use the app; we don't log what you tap, look at or how long you spend.
What your partner can see
This matters more than anything else on this page, so it's the complete list. For each habit of yours that has been active on any day since you paired, the person you're paired with can see:
- its name and its icon
- whether it's the one you marked as your priority
- where it sits in your list
- when you started it, and when you last changed it
- which preset it came from, if you picked one rather than writing your own
- whether you completed it, on each day since you paired
- any photo you attached when you completed it
They can also see your display name and your tree.
A habit you turn off doesn't disappear from the days it was part of. Your past days, and theirs, show the habits you each had on that day, so a day you both lived through still reads the way it happened. For those days they can see when each habit started and stopped being one of yours, the name it had at the time if you renamed it, whether that record was kept as it happened or reconstructed afterwards, and when it was last changed. They already saw that habit every day it was active; this only stops turning it off from rewriting the past.
Behind that, the app exchanges internal identifiers (a random ID for you and for each habit) so that two devices can talk about the same thing. They aren't shown anywhere and they aren't linked to anything outside Inosc.
What they cannot see, ever:
- your email address
- a habit whose life ended before you paired: if you'd already turned it off by then, they never see it at all
- your profile picture: you can see it, nobody else can, and the server refuses the request
- the exact time you completed something, or the timezone you were in
- your badges, your day records, or your root milestone messages
- whether, or when, you saw a nudge they sent
- your subscription details: only whether it's active
- anything from before you paired
- anything at all once a pairing ends: the moment it does, both sides go dark
They can only ever read this. Nothing your partner does can change your record.
Nobody who isn't your partner can see any of it.
Photos
If you attach a photo to a habit, it is stored privately and your partner can see it. That is what it is for: it is the picture of you having done the thing.
Nobody else can. Not other people using Inosc, not anyone with a link, not us in the ordinary course of running the service. Access is checked on every request against who you are paired with right now, so if a pairing ends, that access ends with it.
Your partner can see a photo only when they can already see the habit it belongs to, and only for days since you paired. A photo from before you paired stays yours alone.
Every habit photo is kept for 14 days. After that it is deleted from our storage automatically, and cleared from your phone too. The record that you did the habit that day stays; only the photo goes. A photo you delete yourself is deleted from the server straight away, not just from your phone, and deleting your account deletes every one of them.
If that ever changes, this page will change first.
Reminders
Habit reminders you set for yourself are scheduled by your phone, on your phone. We don't know when they fire.
Nudges from your partner, and the news that your roots have reached a milestone, are different, because they have to travel. When you turn on notifications we store a token that Apple's push service uses to reach your device, so that a nudge your partner sends, or a message about your roots, actually arrives. The notification itself (your partner's name and the habit, or the milestone message) passes through Apple's push service on its way to your phone. Nobody sees the token but us and Apple, and deleting your account deletes it.
If notifications are off, a nudge still reaches you: it waits on your Habits screen until you open the app.
Subscriptions
Inosc is a subscription, bought through the App Store as an in-app purchase. Apple takes the payment. We never see your card, your bank, or your Apple ID's payment details, and we do not want to.
What we do keep is listed under Your subscription above. Apple sends us a message whenever your subscription changes (when you subscribe, renew, cancel, change plan, or a payment fails), and we use it to keep that record up to date so the app knows what it should show you.
We also keep each of those messages exactly as Apple sent them, as our record of App Store sales. Apple's message includes the plan, the dates, the price and currency you were charged, the App Store country, and Apple's transaction numbers. It does not include your card, your bank, your name or your Apple ID. Because it is our sales record, it is kept even if you delete your account; after that it is no longer linked to any account, only to the random ID your account used to have.
Your partner is told one thing about it, and only while it matters to them: whether your subscription is active. The paired rate is earned by paired days alone: days you both show up while paired to each other. Your record of earning it notes who you earned it with; if that person later deletes their account, what stays on your record is only their old random ID, which no longer points to anyone.
Subscriptions auto-renew until you cancel. Cancel in your Apple ID settings or through the App Store; we cannot cancel it for you, and deleting your Inosc account does not cancel it either. Apple has to hear it from you.
Subscription analytics
From version 1.0.4, Inosc uses a service called RevenueCat, run by RevenueCat, Inc. in the United States, to understand how subscriptions are doing, such as how many people subscribe, renew, change plan, cancel or ask for a refund. It is used for subscription analytics only, and it never decides whether you have access to Inosc.
The app itself sends RevenueCat nothing. Once the app has told you about RevenueCat, or you signed up on version 1.0.4 or later, our server sends it your purchases of Inosc: the random ID of your Inosc account, which plan, the price, the currency, the App Store country, the dates, and Apple's signed record of each purchase, renewal, cancellation or refund. That is the same information Apple sends us, described under Subscriptions.
RevenueCat does not get your name, your email address, your habits, your photos, who your partner is, anything about your device, or anything else from the list above. It is not used for tracking or advertising. Nothing is sent for accounts we have given free access, or for test purchases.
When you delete your Inosc account, we tell RevenueCat to delete everything it holds about that account, and we send it nothing more.
What we don't do
- No usage analytics: nothing records what you tap, what you look at, or how long you spend in the app. The only analytics are the subscription analytics described above, which cover your purchases and nothing else. No usage tracking. No crash reporting services. (If you've allowed your iPhone to share analytics with app developers, Apple may pass us anonymous crash reports. That is Apple's setting, in iPhone Settings → Privacy & Security → Analytics & Improvements, not something inside Inosc.)
- No advertising, and no advertising identifiers.
- No third-party trackers of any kind. RevenueCat is not a tracker and is never used for advertising.
- We do not sell or rent your data, and we share it only with the companies named on this page, for the purposes given there.
Where it's stored
Your account and habit data are stored with Supabase, which hosts it on Amazon Web Services infrastructure in Sydney, Australia. Account emails and the welcome email are sent through Resend, which receives your email address and the message. Those two companies process data on our behalf and are not permitted to use it for anything else. From version 1.0.4, our server sends your purchases to RevenueCat, as described under Subscription analytics.
Apple delivers notifications and handles payments, as described above. This website is hosted by Netlify, which, like any web host, sees the IP address of anyone who visits it.
If you choose to sign in with Apple or Google, they confirm who you are to us, and they learn that you signed in to Inosc. Their own privacy policies cover what they do with that.
Like any online service, our servers see the IP address each request comes from, and our database provider keeps short-lived technical logs of requests and errors for security and fixing problems; they are deleted automatically. We don't use them to work out where you are. Everything travels over an encrypted connection, and the database enforces, row by row, that you can only read your own data and your current partner's visible habits. Pictures are held in private storage that is never publicly addressable, and the same check is applied to every single request for one.
How long we keep it
Until you delete it, with three exceptions: habit photos are deleted automatically after 14 days; technical logs are deleted automatically after a short time; and Apple's subscription messages are kept as our sales record, as described under Subscriptions. We don't expire accounts or quietly clear any other records.
Deleting everything
In the app: Profile → Settings → Delete account.
That permanently removes your account, your sign-in records, your habits and their history, your completions, your day records, your badges, your profile, your profile picture, every photo you attached to a habit, your invite codes, the nudges you sent and received, your root milestones, your pairings and your days-together records, your notification tokens, your agreement and rating card records, your paired rate record, your subscription record with us, and any reports or blocks involving you, and ends any active pairing. If you signed in with Apple, we also tell Apple to end Inosc's access to your Apple ID sign-in. We also tell RevenueCat to delete everything it holds about your account. It cannot be undone and we cannot recover it for you. It does not cancel the subscription itself; that is done with Apple. Your former partner keeps their own tree and their own record, including how many days you had together; nothing of theirs is affected. The only things that stay are Apple's subscription messages (see Subscriptions), and, if a former partner earned the paired rate with you, your old random ID on their record, which no longer points to anyone. Copies in our database provider's automatic backups expire on their own as the backups roll over.
If you'd rather we did it, email support@inosc.app from the address on the account.
Your rights
Depending on where you live you may have the right to see a copy of your data, correct it, or have it erased. The delete button covers erasure completely. For anything else, email support@inosc.app and we'll respond within 30 days.
Age
Inosc is not for children. You must be at least 16 to use it, or older if the minimum age of digital consent in your country is higher. We don't knowingly collect data from anyone below that age; if we learn that we have, we'll delete it.
Changes
If this policy changes we'll update the date at the top. If a change materially affects what we collect or who can see it, we'll tell you in the app before it takes effect.