MosaikDownload
Legal

Privacy Policy.

Plain language, because your habits are personal. This explains what Mosaik collects, why, and the control you keep over it.

Last updated: September 29, 2026Version 1.3

In short

  • Your habits live on your device by default. Sync is optional and only with Plus.
  • Apple Health access is read-only — we never write to Health.
  • We don't sell your data or track you across other apps and websites.
  • This website uses optional analytics cookies only if you accept them in the banner.
  • You can export or delete everything, including your account, anytime.

What we collect

Mosaik is designed to work with as little data as possible. Most of what you create never leaves your device unless you turn on sync.

DataWhy
Habits & check-insThe core of the app — your habits, goals, and daily completions.
Notes & moodOptional journal entries and 1–5 mood you attach to a day.
Account emailOnly if you create an account for sync — used to sign you in.
Sync dataAn encrypted copy of your habits, kept in step across your devices (Plus).

You can use Mosaik with no account at all. In that mode, nothing is sent to our servers.

Apple Health & HealthKit

If you enable auto-tracking, Mosaik reads a small set of metrics from Apple Health to mark relevant habits for you.

  • Read-only: steps, sleep, and mindful minutes — only the types you allow.
  • Mosaik never writes any data back to Apple Health.
  • Health data is processed on your device to set a habit's daily value; it is not sold, shared, or used for advertising.
  • You can revoke access at any time in iOS Settings → Health, or by turning auto-tracking off in the app.

Third-party services

We rely on a few trusted providers to run the parts of Mosaik that need a server. Each receives only the data necessary for its job.

ProviderPurpose & data
SupabaseAccount authentication and encrypted sync for Plus users. Stores your email and synced habit data.
RevenueCatManages subscriptions and purchases. Receives a pseudonymous purchase identifier — not your habits. It also reports subscription events (a started trial or a purchase) to Meta so we can measure our own ads, without your device's advertising identifier.
SentryCrash diagnostics in production, so we can fix bugs. Receives technical error reports, not habit content.
PostHogProduct analytics in production. Helps us understand feature usage, funnels, and retention — not your habit content or notes.
Meta (Facebook SDK)Measures whether an install or app open came from a Mosaik ad, using Apple's privacy-preserving measurement (Aggregated Event Measurement and SKAdNetwork). It never receives your habits, notes or health data, and Mosaik never collects your device's advertising identifier (IDFA).

The providers above power the Mosaik mobile app. Sentry, PostHog and the Meta SDK run only in production app builds. The Meta SDK only helps us see which of our ads lead to installs; it runs without the advertising identifier and is not used to track you across other companies' apps or websites, which is why Mosaik never shows the App Tracking Transparency prompt. Meta's privacy policy is at facebook.com/privacy/policy.

When you visit this website (themosaik.app), we use PostHog — but only if you accept analytics cookies. See Cookies & this website below.

Cookies & this website

This section applies to our marketing website only — not the Mosaik app on your phone. We ask for your consent before loading any analytics on this site.

TypeWhat & why
EssentialA preference cookie (stored in your browser) so we remember whether you accepted or declined analytics. Required to honor your choice.
Analytics (optional)PostHog, loaded only if you click “Accept analytics”. Helps us see aggregate traffic — pages visited, referrers, device type — so we can improve the site. We do not use PostHog to track app usage or habit data.

You can accept or decline analytics when the banner appears, or change your choice anytime via Cookie settings in the site footer. If you choose essential cookies only, PostHog is not loaded.

PostHog may process data in the EU or United States depending on project settings. Where required, we rely on appropriate safeguards for international transfers. PostHog's privacy policy is at posthog.com/privacy.

How we use your data

  • To provide the app: store your habits, show your grid, and sync across devices.
  • To deliver reminders you set up (processed locally on your device).
  • To process subscriptions and restore purchases.
  • To diagnose crashes and improve features through aggregated analytics (in the app, and on this website only with your cookie consent).
  • To measure how our own ads perform: app installs, app opens and subscription events are reported to Meta without your device's advertising identifier.

We do not sell your personal data, share your habits, notes or health data with advertisers, or use them to train models.

Data retention

On-device data stays until you delete it or uninstall the app. If you use sync, your encrypted data is retained on our infrastructure for as long as your account is active.

When you delete your account, synced data is removed from our active systems promptly and purged from encrypted backups within 30 days. Diagnostic and aggregated analytics records are kept for a limited period and are not linked to your identity. Website analytics collected by PostHog (only with your cookie consent) are kept according to our PostHog project's retention settings and are not linked to your habit data.

Your rights & deleting your account

You stay in control of your data at all times:

  • Cookie preferences: use Cookie settings in the site footer to withdraw analytics consent on this website.
  • Export:download your full history as CSV from Settings → Data & privacy.
  • Access & correct: all your habit data is visible and editable in the app.
  • Delete account: Settings → Delete account removes your data from our servers. You can also email us to request deletion.

Depending on where you live (for example the EU/EEA under GDPR, or California under CCPA), you may have additional rights to access, port, or object to processing. We honor these requests regardless of location.

Security

Synced data is encrypted in transit and at rest. Access to production systems is restricted and audited. No method of storage or transmission is perfectly secure, but we work to protect your information using current best practices.

Children

Mosaik is not directed at children under 13 (or the minimum age in your country), and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will remove it.

Changes to this policy

If we make material changes, we'll update the date at the top and, where appropriate, notify you in the app. Continued use after an update means you accept the revised policy.

Contact

Questions about privacy or your data? We're happy to help.

privacy@themosaik.app