Privacy Policy

Last updated: October 7, 2026

Aros is a habit and reminder app for iPhone and Android. This policy explains what data the app collects, what it is used for and what you can do about it. The idea is simple: we collect the minimum needed for the app to work and to sync across your devices, we don't sell your data and we don't show ads.

1. Who is responsible

The data controller is Pablo Chaves, developer of Aros, based in Bogotá (Colombia). For any privacy matter you can write to aros.habitapp@gmail.com.

2. What data we collect

Account data

• Your email address and, if you sign in with Google or Apple, the identifier and name that provider gives you.
• If you sign in with email, your password, which is handled by Firebase Authentication and never seen by us.

Profile data

• Your first and last name, to address you inside the app.
• Your date of birth, which we ask for when you create your account to check that you meet the minimum age (see "Children"). We do not show it to anyone and we do not use it for anything else.
• Your gender, if you choose to give it (you can pick "prefer not to say"). It is kept only in your profile: it is not used for statistics and never appears in crash reports.
• Your profile photo, if you choose to add one. You pick it from your gallery and Aros only receives that photo, not the rest. Before it is uploaded it is cropped, resized and stripped of its metadata, such as where it was taken. Only you can see it.
• Your settings: language, first day of the week and the time your day starts.

What you create in the app

• Your habits and tasks (titles, notes, icons, colors, schedules, pauses and dates) and the records of when you complete them.
• Reminders are scheduled on your own device as local notifications.

Titles and notes are free text. We recommend not including especially sensitive information, such as health data.

Usage and diagnostic data

• Usage statistics through Firebase Analytics: events such as "habit created" or "task completed", without any text you write and not linked to your name or email.
• Crash reports through Firebase Crashlytics: what failed, the device model and the OS version. Emails and tokens are removed from them before they are sent.
• An installation identifier generated by those Firebase services.

Aros does not collect your location, your contacts or the rest of your photos, does not use the microphone or camera, and does not use your device's advertising identifier.

3. What we use it for

• To provide the service: creating your account, storing your habits and syncing them across your devices. This is based on providing the service you ask for when you sign up.
• To improve the app and fix bugs: usage statistics and crash reports, based on our legitimate interest in the app working well, always with data not linked to your identity.
• To protect the service: we check that requests come from the genuine app (Firebase App Check with Play Integrity and App Attest).

We don't use your data for advertising, we don't build commercial profiles and we don't sell your data to anyone.

4. Who we share it with

We store and process data with Google Firebase (Google LLC), which acts as a processor following our instructions: Authentication, Cloud Firestore, Cloud Storage (your profile photo), Cloud Functions, Analytics, Crashlytics, App Check and Remote Config. If you sign in with Google or Apple, those providers also take part in signing you in under their own policies.

We send your account emails (the one to confirm your address and the one to reset your password) with Amazon Simple Email Service (Amazon Web Services, Inc.), which also acts as a processor. It only receives your email address and the content of that message, in order to deliver it. These emails don't track opens or clicks.

If you join a pact (a habit you share with other people), they see your name and your progress on that habit, as explained in the Terms and Conditions. They don't see your other habits, your tasks or your notes. Apart from that, we don't share your data with other users or third parties, unless required by law.

5. International transfers

Google's and Amazon Web Services' servers may be outside your country, including the United States. Both apply the Standard Contractual Clauses approved by the European Commission and other equivalent safeguards to protect those transfers.

6. How long we keep it

• Your account, profile and habit data, for as long as you have an account. When you delete it, it is removed from our servers and from your device. In any pacts you were part of, your name is replaced with “Deleted participant” and the other people keep their own history.
• Usage statistics are kept for up to 14 months, and crash reports for 90 days.
• To stop anyone from requesting emails in a loop in your name, we keep a record of the account emails we just sent you for one hour, identified by a fingerprint (hash) of your address rather than the address itself. After that hour it is deleted automatically.

7. Deleting your account

You can delete your account at any time from the app, in Profile → Delete account. If you no longer have the app, follow the steps on the page Delete your Aros account.

8. Your rights

You can access, correct or delete your data, ask for a copy in a commonly used format, object to processing or ask us to restrict it. Write to aros.habitapp@gmail.com and we'll reply within 30 days. You can change or delete much of this data yourself from the app.

If you're not satisfied with our answer, you can complain to the data protection authority in your country: in Colombia, the Superintendencia de Industria y Comercio; in Spain, the Agencia Española de Protección de Datos; in other European Union countries, the relevant supervisory authority.

9. Children

Aros is for people aged 13 or over. In the European Union, the European Economic Area and the United Kingdom the minimum age is 16, because that is the age those countries set for consenting to online services on your own.

That is why we ask for your date of birth when you create your account: it is the only way we have to check. If you are below the minimum age for your country, Aros will not let you continue. And if we learn that we hold data from someone below that age, we will delete it.

10. Security

All data travels encrypted (HTTPS/TLS) and is stored on Google's infrastructure, encrypted at rest. Access to each account's data is restricted to that account by server-side security rules.

11. Changes to this policy

If we change this policy, we'll update the date above. If the change is significant, we'll let you know in the app before it takes effect.

12. Contact

For any question about this policy or your data: aros.habitapp@gmail.com.