Roots: Quit Bad Habits & Grow · Last updated: September 30, 2026
This Privacy Policy explains how FBBF Studio ("we", "us", "our"), the data controller, handles your information in the Roots mobile application ("the App"). By creating an account and using the App, you agree to this policy.
We do not collect your precise location, contacts, photos, microphone, or advertising identifiers, and we do not use third-party advertising, ad networks, or cross-app tracking. The only analytics we run are the product events described above, which exist so we can see which parts of the App people actually reach — not to build a profile of you, and never shared with advertisers.
Because Roots helps you quit habits, the habits you choose to track (for example smoking, alcohol or gambling) may reveal information about your health or behaviour. We treat this as sensitive information. You enter it yourself, and we process it only to provide the App's core features to you. If you choose to use the social features, you are explicitly choosing to share the limited garden view described above with friends you approve. You can stop sharing at any time by removing a friend or deleting your account.
| Purpose | Legal basis (GDPR Art. 6 / Art. 9) |
|---|---|
| Create and maintain your account, sign you in, sync your habits across devices, show your progress and savings. | Performance of a contract (Art. 6(1)(b)). |
| Process sensitive habit data and share a limited garden view through optional social features. | Your explicit consent (Art. 9(2)(a)), given by entering the data and choosing to use friends/challenges. |
| Manage your subscription and unlock Pro features. | Performance of a contract (Art. 6(1)(b)). |
| Keep the service secure and prevent abuse. | Our legitimate interests (Art. 6(1)(f)). |
Your account and habit data are stored using Supabase (Supabase, Inc.), our backend, authentication and database provider. Authentication is handled by Supabase Auth and, optionally, Google Sign-In. Subscriptions are handled by the app store's billing system.
Depending on the hosting region of our database, your data may be processed on servers located outside your country, including outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses with our provider.
We do not sell or rent your personal data, and we do not share it for advertising. We share data only with the service providers strictly needed to run the App:
We may also disclose information if required by law or to protect our rights or users.
You can permanently delete your account and all associated data at any time from Settings → Account → Delete Account inside the App. This removes your profile, habits, social connections and history from our servers and cannot be undone. To request deletion without using the App, email us at the address below and we will action it.
We keep your data for as long as your account exists. When you remove a plant inside the App it disappears from the App immediately and is held on our servers for up to 30 days, so it can be restored if it was lost by mistake; after that it is deleted. Deleting your account removes everything at once, including anything in that 30-day window. When you delete your account, your data is removed from our active database. Backups, if any, are overwritten on a rolling basis.
Data is encrypted in transit (HTTPS/TLS). Access to your data is restricted at the database level so that, in general, only you can read and change your own data, and friends can see only the limited garden view you approve. Session tokens are stored in your device's secure storage. No method of transmission or storage is 100% secure, but we take reasonable measures to protect your information.
Depending on where you live, you may have the right to access, correct, export, restrict or delete your personal data, to withdraw consent, and to object to certain processing. You can edit or delete most data directly in the App, or contact us to exercise any of these rights. You also have the right to lodge a complaint with your local data protection authority (in Romania, the ANSPDCP).
In the past 12 months we collect the categories: identifiers (email, username, display name), customer records, commercial information (subscription status) and internet/app activity (the content you create). We use them only for the purposes described above. We do not sell or share your personal information as those terms are defined under California law, and we do not use it for cross-context behavioural advertising. California residents have the right to know, delete, and correct their personal information, and to not be discriminated against for exercising these rights. Exercise them via Settings → Delete Account or by emailing us.
The App is not directed to children. You must be at least 16 years old (or the minimum digital-consent age in your country, if higher) to create an account. We do not knowingly collect data from children under this age; if you believe a child has provided us data, contact us and we will delete it.
We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by an in-app notice.
Data controller: FBBF Studio.
Questions or requests: rootsappsupport@gmail.com