Privacy
Last updated: October 23, 2026
Who is responsible
The data controller is EI Evgeny USACHEV, an individual entrepreneur registered in France under SIREN 990 161 861, 60 rue François Ier, 75008 Paris, France. Contact: support@habitterritory.app.
What is stored, and why
| Your email address | It is your account. It is also where the six-digit sign-in code is sent. There is no password. |
|---|---|
| A display name and a character | Chosen by you, shown to the other people in your rooms. |
| A device name per signed-in device | So you can see the list of your own sessions and end any of them. |
| The rooms you are in | Their name and settings, who is a member, the color you picked in that room, the detail you gave for that room, and when you joined. |
| Your collections | The titles you collected, with the optional second detail, when each was added and finished, and the room it came from. Turning a room's collection on collects what you already entered there; giving it a new name keeps what was collected, now under the new name. Shown to players who share an open room with you, unless you hide that collection from your profile; anyone who blocked you is not shown it either. Kept until you remove the item or delete your account. Hiding a collection hides only that collection's list and its badge in the room; the room's field and the progress you log there stay visible to the room as before. Which collections you have hidden is stored per collection and kept until you delete your account, even after every item in it is removed. |
| Who sees your trophies | Your choice on the profile page: only you; players who share an open room with you (the default); or every player who shares an open room with you, which adds your trophies from your other rooms, without the amount or unit for a room they are not in now (see below). Kept until you change it or delete your account. |
| The progress you enter | The amount, the unit, the date, the optional note, the optional message to the room, and the cells it earned. This is the content of the product; it is visible to the other members of that room. |
| Cells and round results | Which cells are painted in which color, and who won a round. |
| Throws | When you throw an item at another member of a room: who threw what at whom, and when. Seen by the members of that room, and deleted 24 hours after it was thrown. |
| Reports | When someone reports an entry or a player: who reported, who was reported, the room and the entry, the reason, the optional comment, and a copy of the reported note, message or name as it was at that moment — kept because the original can be deleted or changed before anyone reads the report. Only the operator sees a report. The stored report is deleted twelve months after it is made. Up to twenty reports a day are also mailed, with the same details, to the operator's mailbox and kept there until the report is handled, for at most twelve months. |
| Players you block | Who you blocked and when, so their notes, messages, throws and collections can be hidden from you, and their messages are not sent to you as notifications. Kept until you unblock them or either account is deleted. The player you block is not told. |
| Invitations a room owner sends | Who invited whom, into which room, when, and whether it was accepted, declined or expired. Kept until either account or the room is deleted. |
| A push token per signed-in device, if notifications are allowed | Once notifications are allowed for the app on your phone, Apple or Google gives the app an address for that phone, and the app sends it here, tied to that signed-in device. An iPhone, and Android 13 or later, ask you first; Android 12 and older allow notifications for every app unless you turn them off in the phone's settings, so there this happens when you sign in. It is used for one thing: to tell you when a room owner invites you, when someone overtakes you in a room (at most once in 24 hours per room), when someone plips something at you (at most once in 3 hours per room), and when someone in a room you share logs progress with a message ("Say something"), each time. The app on your phone says, when it sends the token, whether it can show message notifications; a version of the app from before them never receives one. It is deleted when you sign out on that device, when you end that device's session from your profile, with your account, and when Apple or Google say it no longer works. Signing out only deletes it if the phone can reach the server at that moment; a sign-out made offline leaves it, and that phone can still be notified, until you end that session from your profile on another device or delete your account. Nothing else deletes it: turning notifications off in the phone's own settings stops them showing on that phone, and the switches below stop them being sent, but in both cases the token stays here. |
| Your notification choices | Four switches on your profile: invitations, being overtaken, getting plipped, and messages from other players. All four start on. Turning one off stops that kind of notification being sent to any of your devices; it does not delete any push token. |
| A mark that a message notification was sent | The entry's id, your player id and the time it was sent, so that a retried send goes only to players whose earlier send failed. Deleted within an hour of being 24 hours old. |
What is deliberately not stored
- No password, because there is none. Sign-in codes are stored only as a hash, with an expiry and an attempt count, and are useless once used.
- No usable session token. Refresh tokens are stored as hashes; the copy that works exists only on your device.
- No sensors, no location, no fitness accounts. Nothing is read from your phone except, if notifications are allowed, the push token above. The only record of your progress is the one you typed.
- No advertising, no analytics service, no third-party trackers. These pages and the application load nothing from anyone else's servers; the content security policy the server sends would block it if they tried. The one exception is notifications, in the apps only: to get a push token, an iPhone asks Apple's push service, and the Android app contains Google's Firebase messaging library, which contacts Google itself. The app keeps that library from contacting Google until notifications are allowed (see the push token above); from then on it may also contact Google when the app starts. A push token reaches this server only once notifications are allowed (see "Who else sees your data").
Invitation links
An invitation link contains a token that is a credential: whoever holds
it can join that room. The token is encrypted where it is stored, and
the web server is configured so that requests to /join/ are
written to the access log without their path — enough to count how often
invitations are opened, not enough to reuse one from the log.
Who else sees your data
- The other members of a room see your display name, your character, your color in that room, the progress you log there, and the detail you gave for that room. Players who share an open room with you also see your collections, unless you hide one from your profile, and the rounds you won in the open rooms you share, as trophies on your page with each round's final map and, since they are members of that room, the amount you logged. On your profile you choose who sees your trophies: only you; the players of the open rooms you share (the default); or every player who shares an open room with you. The last also shows them your trophies from your other rooms: the room's name, each round's dates and length, and its final map with the other players' territory in grey. They see the amount you logged and the unit only for an open room they are in now, even one you have since left; for a closed room, or a room they are not in, they do not see the amount or the unit.
- The mail provider (Brevo) receives your email address in order to deliver the sign-in code, and carries each mailed report (up to the daily cap described above) to the operator — the report itself, including its copy of the reported text. Nothing else is sent to it.
- The hosting provider (OVH) operates the server the application runs on, in its Gravelines data center in France. Your account, rooms and progress are stored there.
- Apple and Google, only if notifications are allowed: each notification goes to Apple's push service (iPhone) or Google's Firebase Cloud Messaging (Android) with your phone's push token, and they deliver it. A notification carries its text — who invited you, overtook you, plipped something at you or wrote a message, what was plipped, the message itself as its author wrote it (at most 80 characters, and it has passed the content filter), and the room's name — its kind, and the id of that invitation or room. Nothing else is sent to them.
- Telegram carries a one-line notice to the operator for each report: its reason and the room's name. No reported text and no player's name go to it.
Nothing is sold, and nothing is shared for advertising.
Server logs
The web server writes an access log: the address the request came from,
the time, the method, the host, the response status and size, and the
browser's user-agent string. For everything except /join/
the requested path is part of that line. Logs are rotated daily and the
last fourteen days are kept.
Log shipping
Since 22 September 2026 the server's logs also leave it: the system journal (the application's three containers, sshd, sudo, fail2ban, the kernel and systemd), the web server's access and error logs, and the security audit log are sent, over an encrypted tunnel, to a computer the operator controls. The package manager's own logs — what was installed or upgraded, and the command that did it — are shipped the same way. An IP address is personal data, and these logs contain it. They leave the server for two reasons: so that someone who broke into it could not quietly erase them, and so the operator can see what the service actually did. The lines as received are kept on that computer for 30 days and never leave it. Separately, a redacted copy is kept for 14 days in which every IP address and every email address is replaced by a stable label and every invitation token by a placeholder — a label is still personal data for as long as the key that could turn it back into an address exists, which it currently does. Only the operator reads the redacted copy.
Backups
The database is backed up nightly, encrypted, with fourteen nights kept on the same server the application runs on. There is no off-site copy in place: a deletion disappears from the live system immediately and ages out of the backups within fourteen days, but a failure of that server would take the backups with it.
Deleting your account
From the profile screen in the application. Deletion removes your account and the records attached to it, your blocks included. The stored report stays until it expires: one you made stays without your name on it, and one about you — your note, your message, or, if you were reported as a player, your display name — keeps its copy, without your account attached. The mail already sent to the operator about a report is not touched by any of this: it keeps your account id, your comment if you wrote the report, the reported text — a note, a message or a name — the room's name if there was one, and, if you were reported, your display name, until the operator deletes it or twelve months pass. If you would rather ask than click, write to support@habitterritory.app.
Your rights
If you are in the EU or the UK, the GDPR gives you the right to see a copy of your data, to correct it, to have it erased, and to complain to your data protection authority. Write to the address above and say which of those you want.
Changes
When this page changes in a way that matters, the change will be announced in the application rather than made quietly.