Privacy
Short version: Habit has no accounts and sets no cookies. We store no identifier in your browser. We count page views and copy clicks without knowing who you are.
Who is responsible
Marco Patzelt, Max Ernst Str. 21, 40670 Meerbusch, Germany, marco@striq.de (see Impressum).
Hosting and server logs
gethabit.dev is served by Cloudflare, Inc. (Cloudflare Workers). To deliver the pages and protect them from attacks, Cloudflare processes technical data of each request: IP address, time, the address requested and the browser's user agent. Legal basis: Art. 6 (1) (f) GDPR, our interest in a secure, working website. Cloudflare acts as our processor under its Data Processing Addendum and is certified under the EU-U.S. Data Privacy Framework.
Page views and copy clicks
Each page tells our own server that it was opened, and any page tells it when you copy the setup prompt, a loop's install prompt or an install command. Each record holds the page, a random ID that exists only while the page is open, the referral code of the link you came from if it had one, and the time.
Our server adds a hash of your network address and one of your network address with your browser type. The key for these hashes changes every day and is deleted after two days, so the hashes cannot be traced back to you afterwards. A flag marks automated browsers. Your address and browser type themselves are not stored. No cookie and no stored identifier is used.
We keep these records for 13 months to see which pages and sources lead to a loop being installed. Legal basis: Art. 6 (1) (f) GDPR. Because nothing is stored on your device, no consent under § 25 TDDDG is needed.
When your agent reads a loop
When an agent fetches /LOOP.md or a loop's .md file, our server records the file, the time, the agent's user agent, the referral code in the link if there is one, and the same daily hashes as above. This tells us that a setup prompt was used. It does not tell us who you are or what your project is.
The Habit MCP server
If you connect your agent to https://gethabit.dev/mcp, or use the Habit plugin in ChatGPT or Codex (https://gethabit.dev/mcp/openai), we store:
- for each search: the task sentence your agent writes (up to 300 characters), optional keywords, and which skills and loops were shown and loaded;
- for each connection: a random session ID, the client's name and version (for example Claude Code 2.1), its protocol version and user agent, and the daily hash of the network address described above;
- ratings ("did it help?") and issue reports, when your agent sends them, with an optional short comment;
- a random install ID, if your client sends one.
File contents, file paths, repository names and your conversation are never sent. Before anything is stored, the server removes email addresses, links, file paths, keys and phone numbers it finds in the text. When load_skill loads a skill, our server fetches it from GitHub; GitHub does not see your address.
The ChatGPT and Codex plugin never sends loop files to us. If your agent builds a loop with make_habit through /mcp, it sends the finished loop file and the goal sentence to us as the last setup step, unless you tell it not to. Your agent is asked to remove names and confidential details first. We store them without your name and use them to build ready habits for others. Before storing, the server removes email addresses, keys, phone numbers and local file paths. Published loops never name who sent them.
We use this to suggest better skills and loops and to see which ones work. We keep it for 13 months. Legal basis: Art. 6 (1) (f) GDPR. To delete the records of your install or session, call the forget tool or write to the address above.
Fonts and images
Fonts and author images are stored on our own server. Your browser does not contact Google or GitHub when you open a page.
Copy buttons
When you press a copy button, the text goes to your own clipboard. The click is counted as described above.
If you write to us, we use your message only to answer it and delete it when it is no longer needed.
Your rights
You have the right to access, correction, deletion, restriction, data portability and objection (Art. 15 to 21 GDPR), and the right to complain to a data protection authority, for example the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.