Website Privacy Policy
This notice covers the public Don't Break Two website and browser-based account-support pages. The Don't Break Two mobile app has a separate App Privacy Policy.
1. Controller
Tim Gabel, trading as HowtoHabit
Lerchenauer Straße 28
80809 München
Germany
Email: howtohabit.service@gmail.com
2. Website hosting and server logs
The website is hosted using Vercel. When you request a page or asset, technical request data such as IP address, date and time, requested URL, browser/device information, referrer information and security/diagnostic data may be processed to deliver and protect the website. The legal basis is our legitimate interest in providing a secure and reliable website (Art. 6(1)(f) GDPR).
3. Contact form and support
When you use the public contact form, we process the email address you provide, your optional name and your message in order to handle your inquiry. The form is received through a Supabase Edge Function and delivered to our support inbox using Resend. The website contact form does not write the message into the Don't Break Two app database.
Depending on the request, the legal basis is Art. 6(1)(b) GDPR for contractual or pre-contractual communication or Art. 6(1)(f) GDPR for our legitimate interest in handling support and general inquiries.
4. Account confirmation and password-reset pages
Browser-based account confirmation, authentication callback and password-reset pages may communicate with Supabase to complete the account action you initiated. Supabase processes authentication tokens, account/session metadata and technical request data required for that purpose. The legal basis is performance of the user relationship (Art. 6(1)(b) GDPR) and our legitimate interest in account security (Art. 6(1)(f) GDPR).
5. Analytics, advertising and browser storage
The public Don't Break Two website does not currently use advertising pixels or non-essential marketing tracking. If analytics, advertising or other non-essential device storage that requires consent is introduced later, this notice and the website's consent handling will be updated before that processing is enabled.
6. Service providers and international transfers
Depending on the feature used, website data may be processed by Vercel for hosting, Supabase for backend/authentication infrastructure and Resend for email delivery. Some providers or their subprocessors may process data outside Germany or the European Economic Area. Where the GDPR requires transfer safeguards, we rely on the provider's applicable contractual safeguards, Standard Contractual Clauses, an adequacy decision or another legally recognized transfer mechanism as applicable.
7. Retention
We retain personal data only for as long as necessary for the relevant purpose and applicable legal obligations. Contact/support correspondence is retained only as long as reasonably necessary to handle the request and related legal obligations. Hosting and security logs are retained according to operational and provider retention settings.
8. Your rights
Where the GDPR applies, you may have rights to access, rectification, erasure, restriction of processing, data portability and objection. Where processing is based on consent, you may withdraw consent at any time for the future. You also have the right to lodge a complaint with a competent data-protection supervisory authority.
For privacy requests, contact howtohabit.service@gmail.com.
9. Changes
This website privacy notice may be updated when website functionality, service providers or legal requirements change. Material changes are published on this page before or when the changed processing goes live.