PRIMAL Privacy Policy

Version 2.19 · Last updated: 2026-10-31

This Privacy Policy explains how PRIMAL (“we,” “us,” or “our”) collects, uses, stores, and protects your information when you use our mobile applications, websites, and related services (together, the “Services”).

1. What data we collect

Depending on the features you use, we may collect the following:

Account & identity

• Sign-in is with Apple Sign-In or Google Sign-In. An email-and-password sign-in exists only for App Review and internal testing accounts. No other accounts are offered. The app does not provide public email-and-password registration.
• Apple Sign-In requests your name and email. Google Sign-In provides your Google account information through Firebase Auth.
• Your email address is stored in Firebase Auth and is removed from the main user document. We also store your display name, an optional bio, your profile photo, your Firebase user ID, and which sign-in provider you used.

Habit & progress data

• Habits you create (name, category, goals, reminders, schedule), daily habit logs, sealed daily rosters, daily scores (0–100), streaks, weekly/monthly averages, lifetime PRIMAL Score (cumulative), and awards (achievement unlocks).
• Streak freezes: the dates on which a streak freeze was used (at most 500). They are stored on your device and in your private account record so the same freeze is not given twice across devices, and they are deleted with your account.
• So friends see your streak and today's habits stay current even when you have not opened the app, your public profile also includes your device's time zone name (for example, America/New_York), the dates of your 60 most recent streak freezes, and how many streak freezes you have left. Friends' devices use this to calculate your current streak.
• Friends-only habit details: while “Show Habits to Friends” is on, your last 7 days of habit rows (names, icons, targets, progress, completion) and your active habits' weekday schedule are stored in a separate record that only you and your confirmed friends can read — not other users who know your user identifier. Friends' devices use the schedule to show the habits planned for a day you have not logged yet. Turning “Show Habits to Friends” off deletes that record. Older copies of recent habit rows on your public profile are removed as everyone moves to the current app version.
• Optional habit notes you type when logging progress, up to 100 characters. Notes are stored in your private habit log records, synced to Firebase for cross-device use, and are not included in habit summaries shared with friends.
• Up to 365 entries of daily score history synced to your public profile.

Onboarding & body metrics

• Answers stored in your private account record during setup: primary goal, training days, training frequency, training split, whether you exercise, schedule type, wake time, bed time, peak focus time, study hours per day, activity level, whether you use your phone before bed, whether you have caffeine after 2 PM, whether your water intake is adequate, age, height, weight, BMI, gender, unit preference, and a daily calorie estimate (TDEE) the app calculates from those answers. Wake time is used to choose a default reminder time for individual habits.
• A profile bio you enter, stored in your private account data (Firebase) for sync across your devices. It is not shown on your public profile or shared with friends.

Onboarding answers, body metrics, the calorie estimate, bio, and gender are stored in your private account record and are readable only by you—not by friends or other users.

Apple Health (optional, read-only)

• If you connect Apple Health, PRIMAL can read your step count, Apple Exercise Time, sleep (time asleep), water, dietary protein, dietary energy (calories eaten), mindful minutes, and time in daylight. Each one is read only when you turn on that source in the app’s Apple Health settings (steps are on by default once Health is connected). It does not read Health data unless you connect it. The production app never writes to Apple Health. Synced values fill the matching habits and are stored with your account as part of those habit logs. A manual habit log always takes precedence over a synced value, and turning a source off returns that habit to manual logging. If you do not connect Apple Health, we do not read any Health data.
• We do not read height, weight, BMI, body fat, lean body mass, heart rate, resting heart rate, walking or running distance, active energy burned, date of birth, or biological sex via HealthKit.

Social & messaging

• Friend connections, friend requests (pending/accepted/declined), invite-link relationships (primal://invite?uid={FirebaseUID} and https://primal.app/invite?uid={uid} — both expose the inviter’s user identifier), and your list of friend user IDs (used for friend suggestions).
• Public profile fields: display name, photo (including a small inline copy), scores, streaks, Awards, lifetime PRIMAL Score, up to 365 entries of score history, friend UID list, the number of active habits you are tracking, an isPro subscription flag (used to show an optional PRO badge and for friend-limit tier), and (if enabled, while older app versions are still in use) last 7 days of habit names, subtitles, categories, icons, progress, completion status, and daily scores — at most 20 habits per day — plus your time zone name, recent streak-freeze dates and streak freezes left, as described above. Habit details are moving to a friends-only record. There is no username search, no public directory, and no browse UI. In normal use, profiles surface through friends, pending friend requests, friends-of-friends suggestions, and leaderboards. You can always read your own public profile. Any other signed-in user can read it when their sign-in token includes a verified email, they know your user identifier, and neither of you has blocked the other. Apple Sign-In and Google Sign-In set that verified-email flag. Friendship is not required.
• Chat messages (text up to 500 characters), preset “cheer” messages sent as normal chat messages (e.g. “Good job today 🎉!” — limited to once per friend per calendar day, tracked on your device), conversation metadata (participants, last message, read/unread state, typing indicators via typingByUser, per-user conversation hide timestamps). Messaging is strictly between users; PRIMAL does not send message content to generative AI services.
• Block list: blocked user ID, display name, optional photo URL, block timestamp (stored under your account). The list is not shown to anyone in the app, and the blocked user is not notified. You may block another user from their profile, Messages, or your friends list. Effects: the blocked user cannot send you messages or friend requests; pending friend requests between you are removed; if you were friends, the friendship is removed; the conversation is removed from your inbox. Either party blocking the other prevents messaging, friend requests, and public-profile reads in both directions. You can unblock users anytime from Settings → Blocked Users.
• User reports: the reporter’s user ID, the reported user’s user ID and display name, a reason, a context (profile or message), a timestamp, and an optional short note (up to 50 characters). For message reports, that optional note may include a short excerpt of the reported message text. Reports are kept for safety and moderation and are not deleted on request. Users cannot read, edit, or delete a submitted report.
• Push delivery: per device, the FCM registration token, the platform (ios), and a last-updated timestamp, keyed by a stable per-install device identifier. A maximum of 10 devices is kept per account, most recently active first. Tokens are deleted on sign-out, on account deletion, and automatically when Firebase reports them invalid. A master notification preference synced to your account gates all remote push.

Device & local app data

• Notification preferences, leaderboard display preferences, habit-sharing toggle, PRO badge visibility, dismissed friend suggestions, paywall presentation timestamps, Smart Insights scan quota counters (stored locally in UserDefaults per UID per calendar day), Plan Tomorrow roster state, and in-app notification inbox entries (Awards, delivered reminders, friend events, stored locally, pruned after 7 days, max 150 items).
• First-run app walkthrough completion flags (stored locally in UserDefaults only; not synced to servers).
• Stable device identifier for FCM registration (stored locally).
• Popup/walkthrough completion IDs (local only).
• Daily anti-abuse counters stored server-side and enforced by security rules: 500 messages per day (the Free tier limit of 50/day is enforced in the app), 50 friend requests per day, 8,000 habit log syncs per day, a minimum of 1 second between messages, and an escalating cooldown after repeated rate-limit hits (1 minute, then 5, 15, and 30 minutes after 5 hits within 24 hours).
• Habit data in on-device storage (SwiftData) for offline use and sync.
• A profile photo only, chosen through the system photo picker. The app does not access the camera. Where supported by your device, an on-device Apple sensitive-content check may run before upload. Photos are stored at a per-user path (limited to 5 MB) and a small inline copy is also embedded in your user record and public profile. Locally, the avatar is cached on disk in the app’s Application Support directory and is cleared on account deletion. After upload, profile photos are also scanned automatically by Google Cloud Vision (SafeSearch) for objectionable content. Photos that fail that check are removed, and matching photo URLs are cleared from your account and public profile. If the Vision check fails for technical reasons, the upload may remain until a new photo is uploaded and scanned again.

Purchases

• Subscription and purchase status, stored on our servers and tied to your account. PRIMAL Pro is sold as two auto-renewing subscriptions in a single subscription group — $4.99 USD per month or $39.99 USD per year (the prices shown on this website; the App Store charges the price on the confirmation screen for your storefront). Purchases are handled entirely through Apple’s StoreKit. The app and its backend never see or store card numbers, billing addresses, or full receipts. A deterministic token links a purchase to your account so subscription status can be verified. Apple’s subscription status is checked on our servers and is not stored beyond a Pro / not-Pro flag. After that check, PRIMAL publishes an isPro flag to your friend-visible public profile. No payment details, purchase history, or Apple account information is shared with friends — only the subscription state.

Support

• Information you send when you contact us at theprimalapp@gmail.com.

2. How we use your data

None of the information above is used for advertising, sold, or shared with data brokers. We do not use it for tracking as Apple defines tracking: we do not link it with third-party data for advertising, and we do not share it with data brokers. We use your data to:

• Power the core PRIMAL experience, including tracking, scoring, and streaks.
• Sync your account and data across your devices.
• Calculate your daily score based on the habits and inputs you log.
• Publish your public profile (scores, streaks, Awards, name, photo, active habit count, and optional PRO badge) so it can be shown through friends, pending friend requests, friends-of-friends suggestions, and leaderboards.
• Share your last 7 days of habit summaries (at most 20 habits per day) with friends when “Show Habits to Friends” is enabled (default on). Your active habit count is visible on your public profile and is not governed by that toggle.
• Operate friend invites, friend requests, accept/decline flows, unfriending, friend suggestions, one-on-one messaging, friend leaderboards, and preset “cheer” messages. Suggestions are friends-of-friends only, ranked by number of mutual connections, capped at 12, and require at least one existing friend. Dismissed users are remembered on your device. There is no suggestion from contacts, location, or any outside source.
• Filter outbound chat messages with a client-side blocklist before sending.
• Operate user blocking and unblock flows; enforce blocks on messaging and friend requests.
• Receive and review in-app user reports and, when necessary, related chat records to investigate abuse, enforce our Terms, and protect users.
• Deliver local notifications you enable (per-habit reminders, evening summary, weekly recap, streak-at-risk alerts, Award unlocked, and friend-score alerts) and mirror some to your in-app notification inbox.
• Deliver remote push notifications via FCM for new messages, new friend requests, and accepted friend requests when the master “Allow Notifications” switch is on and iOS permission is granted.
• Register and refresh FCM device tokens; remove stale tokens.
• Honor social preferences: hide the home friends leaderboard card, turn off habit sharing with friends, hide the PRO badge, remove friends, hide conversations on your side, and manage notification categories in Settings.
• Enforce plan limits (habits, friends, daily messages) for Free vs Pro tiers.
• Enforce Smart Insights scan quotas (1 per calendar day on Free; unlimited with 5-minute cooldown on Pro).
• Support Plan Tomorrow roster planning (full editing on PRIMAL Pro; free users see the tomorrow preview and an evening prompt) and sync lifetime PRIMAL Score to your public profile.
• Provide Home spans (Day, Week, and Month on Free; Year requires Pro) and Insights spans (Day and Week on Free; Month and Year require Pro); Smart Insights on-device habit scans; Trends and Personal Records; history access per plan (7-day daily drill-down and 90-day week/month browsing on Free; full 365-day history on Pro).
• Let you export habit log history as CSV from in-app Settings. The file contains one row per habit log with date, habit name, value, unit, and completion status, generated from the data on your device. CSV export is available to all users.
• Restrict certain features (messaging, purchases, profile photo upload, friend invites) on modified/jailbroken devices for security.
• Collect crash and diagnostic data with Firebase Crashlytics, which is on by default, to help identify and fix bugs. Those reports can include internal document IDs. You can turn crash reporting off in Settings → Privacy & Safety → Crash Reports. This data is not sold, not used for advertising, not used for data mining, and not used for tracking.
• Check your Apple subscription status on our servers with a deterministic token that links the purchase to your account, and store only a Pro / not-Pro flag.
• Improve reliability, prevent abuse, and respond to support requests.
• Process subscriptions and comply with legal obligations.

3. Third-party services

We use trusted third-party services to operate PRIMAL. Each provider processes data under its own privacy policy and only as needed to deliver the features you use:

• Firebase (Google): authentication, Cloud Firestore database, Firebase Storage (profile photos), and security rules. Stores account, habit, social, and messaging data as described in this policy. Product limits, scoring weights, and history caps are read from a Cloud Firestore document that is readable by any signed-in user and writable only by PRIMAL, with values bundled in the app as a fallback.
• Apple Sign-In: optional account sign-in.
• Google Sign-In: optional account sign-in.
• Firebase Cloud Messaging (FCM): delivers remote push notifications for new messages, friend requests, and accepted friend requests to devices that opted in.
• Firebase Cloud Functions: server-side triggers send message push, friend-request push, and acceptance push; they check Apple’s subscription status for your account and store only a Pro / not-Pro flag; and they run post-deletion cleanup, including replacing your name and photo with “Deleted User” on other people’s conversation previews and block lists. Push respects block lists and the master notification preference.
• Firebase App Check with Apple App Attest: PRIMAL verifies that requests come from a genuine, unmodified copy of the app. App Attest produces a cryptographic device attestation through Apple, which is sent to Google’s Firebase App Check service alongside app requests. It does not identify you, collects no personal data, and is not analytics or tracking.
• Apple HealthKit: optional read-only step count, Apple Exercise Time, sleep (time asleep), water, dietary protein, dietary energy (calories eaten), mindful minutes, and time in daylight, and only for the sources you turn on after connecting Apple Health. The production app never writes to Apple Health. Those values are stored with your habit data when Health is connected — see §9. Not used for advertising.
• Apple App Store / StoreKit: subscription purchase, renewal, billing, and refunds (handled by Apple). The app and its backend never receive your card number, billing address, or full receipt. A deterministic token links the purchase to your account. We check Apple’s subscription status on our servers and store only a Pro / not-Pro flag.
• TrustKit: TLS certificate pinning for secure connections to Google/Firebase services. Does not collect personal data.
• Google Cloud Vision: automatic SafeSearch scanning of uploaded profile photos for objectionable content, as described above.
• Firebase Crashlytics: crash and diagnostic data, on by default, used only to identify and fix bugs. Reports can include internal document IDs. This data is not sold, not used for advertising, not used for data mining, and not used for tracking.

We do not use RevenueCat, Firebase Analytics, advertising networks, the Identifier for Advertisers (IDFA), the AdSupport framework, App Tracking Transparency, or any other cross-app or cross-site tracking SDK in the PRIMAL mobile app. Crash reporting is limited to Firebase Crashlytics, as described above.

We are not responsible for the privacy practices of third-party services. We encourage you to review their policies directly.

4. Data storage and international transfers

Your data is stored using Google Firebase infrastructure and may be processed in the United States or other countries where our service providers operate. We use appropriate safeguards to protect personal data. If your data is transferred outside your country, we use additional safeguards where required by law, such as standard contractual clauses or equivalent protections.

5. Security measures

We use industry-standard safeguards to protect your information, including encryption in transit (HTTPS), authentication protections through Apple Sign-In and Google Sign-In, Firebase security rules, Firebase App Check with Apple App Attest to verify that requests come from a genuine, unmodified copy of the app, and access controls limited to people and systems that need access to operate the Services. App Attest produces a cryptographic device attestation through Apple, which is sent to Google’s Firebase App Check service alongside app requests. It does not identify you, collects no personal data, and is not analytics or tracking. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

6. Data retention

We keep personal data only as long as needed for the purposes described in this policy, unless a longer period is required by law. Typical retention periods include:

• Account information: kept while your account is active and deleted or anonymized after account deletion, subject to backup and legal exceptions below.
• Habit data, logs, scores, streaks, and Awards: kept while your account is active to provide tracking and history features. Optional habit notes are kept with the private log records they belong to.
• Friend data: kept while a friendship exists and removed when you or the other user removes the connection or deletes an account.
• Messages: kept while your account is active so both participants can view conversation history. When you hide a conversation, it is hidden only for you (soft delete). When you delete your account, messages you sent are not erased from the other participant’s copy. Your name and photo on that conversation, including the preview, are replaced with “Deleted User.” The other participant keeps messages they sent until they delete their account.
• Notification preferences: stored while your account is active to honor the notification and social settings you choose in the app or on your device.
• Public score history: up to 365 entries of daily scores in your public profile.
• Friend-visible habit history: up to 7 days and at most 20 habits per day when habit sharing is enabled.
• Profile photos: the Firebase Storage file and the small inline copy in your user record and public profile are kept while your account is active and removed on account deletion. The on-disk Application Support cache is cleared on account deletion.
• Hidden conversations: if you hide a chat, it stays hidden on your device until new messages arrive; the other participant retains their copy until one of you deletes their account.
• In-app notification inbox: stored locally on your device. Free accounts see the last 7 days and Pro accounts the last 365 days; items older than 365 days are deleted automatically (max 1,500 items).
• On-device HealthKit cache: retained locally until you revoke Health access or delete the app.
• Purchase and subscription data: only a Pro / not-Pro flag is stored on our servers, tied to your account with a deterministic purchase token, for as long as needed to provide Pro. We do not store card numbers, billing addresses, or full receipts. Apple keeps the payment record. Deleting your account does not cancel the App Store subscription.
• Block list: your own list is kept while your account is active and deleted when you unblock someone or delete your account. If someone else blocked you and you then delete your account, their block entry can remain so the block still applies, with your name and photo replaced by “Deleted User.”
• User reports: retained for safety and moderation, and not deleted on request. Not accessible to users in the app after submission.
• FCM device tokens: kept while signed in and push is enabled, up to 10 devices per account; deleted on sign-out, account deletion, or when tokens become invalid.
• Support communications: retained as long as needed to respond to your request and maintain a reasonable support history.

When you delete your account, your account, habit and achievement data, and public profile are permanently removed from our active systems, and your name and photo are replaced with “Deleted User” on other people’s conversation previews and block lists. Messages you already sent remain in the recipient’s copy of the conversation, as described in §14. Limited encrypted backup copies may remain temporarily for disaster recovery and legal obligations, but are not accessible in the app and are deleted on backup rotation.

7. Who can see your data

You (account owner) can see all of your habits, logs, settings, onboarding quiz answers, body metrics, and messages.

Public profiles. There is no username search, no public directory, and no browse UI in the app. In normal use, profiles surface only through friends, pending friend requests, friends-of-friends suggestions, and leaderboards. You can always read your own public profile. Any other signed-in user can read it when their sign-in token includes a verified email, they know your user identifier, and neither of you has blocked the other. Apple Sign-In and Google Sign-In set that verified-email flag. Friendship is not required. Blocking prevents this in both directions.

Anyone who can read your public profile can see:

• Your display name, profile photo, daily/weekly/monthly scores, current streak, Awards, lifetime PRIMAL Score, leaderboard ranking, and the number of active habits you are tracking. Active habit count is not governed by the “Show Habits to Friends” toggle.
• Up to 365 entries of your daily score history on your public profile.
• If you are a Pro subscriber, an isPro flag. Friends see a PRO badge on your profile. It is on by default, and Pro users can turn off “Show PRO badge” in Settings. Other users’ devices also read this flag to determine your friend-limit tier when adding you. No payment details, purchase history, or Apple account information is shared — only the subscription state.
• If “Show Habits to Friends” is enabled (default on): your last 7 days of habit names, subtitles, categories, icons, progress, completion status, and daily score per day, at most 20 habits per day. Optional habit notes are not included.
• They cannot see your onboarding quiz answers or body metrics (goals, sleep ratings, age, height, weight, BMI, bed time, focus time, and related setup answers), raw habit log values beyond shared windows, HealthKit data, email address, or full historical logs beyond the shared windows above.

Messaging participants can see messages in shared one-on-one conversations. Messages are not visible to non-participants.

Profile photos stored in Firebase Storage (limited to 5 MB) can be read by you and your confirmed friends (for display in the app). A small inline copy is also stored in your user record and public profile.

Controls available to you: You can block and unblock users; manage Blocked Users in Settings; remove/unfriend users; turn off “Show Habits to Friends” in Settings (default on); hide the PRO badge; hide the Friends Leaderboard card on Home (Settings → General); hide conversations on your side; and report users in-app (every report submits a fixed reason, a context of profile or message, and an optional short note of up to 50 characters; for message reports that note may include a short excerpt of the reported message text; reports are sent to PRIMAL for review). You may also email theprimalapp@gmail.com. Unfriending stops friend visibility but does not block invite links unless you block the user.

Block list visibility: The block list is stored under your account and is not shown to anyone in the app. The blocked user is not notified. Blocked users can detect they are blocked indirectly (for example, they cannot message or send requests).

Our team: the individual who operates PRIMAL has limited access only when needed for support, security, abuse prevention, legal compliance, or investigating user reports — including access to relevant chat message content in those cases.

8. Messaging privacy

Messages are one-on-one and are normally visible only to the two participants. They are stored in Firebase so both participants can send, receive, and view history. PRIMAL personnel may access message content only when needed to investigate a user report, prevent abuse or illegal activity, provide support you request, or comply with law. We do not use message content for advertising, and we do not send message content to generative AI services. Outbound messages are checked on your device against a list of roughly 430 prohibited terms bundled with the app. Messages containing them are not sent. Message content is not automatically scanned on our servers for prohibited terms. Moderation of message content relies on client-side filtering, user reports, blocking, and human review of reports and related conversation records when needed. Message text cannot be edited after sending. Daily send limits apply (50/day Free, 500/day Pro, with a server cap of 500/day). Typing indicators (typingByUser) and read/unread state are stored in Firebase. Sending a “cheer” posts a preset message as a normal chat message from you (e.g. “Good job today 🎉!” — limited to once per friend per calendar day, tracked on your device). You can hide a conversation on your side (soft delete); the other participant retains their copy. If you delete your account, messages you sent while the account was active remain in the other participant’s copy of the conversation, and your name and photo on that conversation — including the preview — are replaced with “Deleted User.” The message text in their copy is not deleted. Message push notifications include sender display name and message text preview (up to 500 characters) on the recipient’s device, and show the sender’s profile photo. A notification service extension downloads that photo over HTTPS on your device to display it. Friend-request and Award notifications do not include a profile photo. Push is not sent if either party has blocked the other or if the master “Allow Notifications” switch is off.

9. Apple HealthKit

If you connect Apple Health, PRIMAL can read your step count, Apple Exercise Time, sleep (time asleep), water, dietary protein, dietary energy (calories eaten), mindful minutes, and time in daylight, each only when you turn that source on. The production app never writes to Apple Health. We do not read height, weight, BMI, body fat, lean body mass, heart rate, resting heart rate, walking or running distance, active energy burned, date of birth, or biological sex via HealthKit. HealthKit data is:

• never sold;
• never used for advertising;
• never used for marketing;
• never used for data mining;
• only used to provide user-requested features inside the app.

Synced values fill the matching habits (Steps, Training, Sleep, Hydration, Protein, Calories, Stress Control and Morning Sunlight) and are stored with your account as part of those habit logs. They are not sold, not used for advertising, and not shared with friends as raw Health samples. A manual habit log always takes precedence over a synced value, and turning a source off returns that habit to manual logging. If you do not connect Apple Health, we do not read any Health data.

You can revoke HealthKit access at any time through Apple Health settings on your device.

10. Notifications

Local notifications (scheduled on device):

• Per-habit reminders you configure. The title includes the habit name (“Don’t skip {habit name}.”). Scheduled up to 14 occurrences ahead per habit. Wake time is used to choose a default reminder time for individual habits.
• Evening summary at 8:00 PM local — reports the count of habits remaining, not names.
• Weekly recap, Sundays at 10:00 AM local — includes your previous week’s score percentage and the name of your weakest habit.
• Streak-at-risk alert at your configured reminder time (default 8:00 AM), when you have an active streak and your score is below the threshold.
• Award unlocked, immediately when earned.
• A friend passed you — title “You just got passed.” / body “{name} is up {N} points…”. Setting: “Friend passed you”.
• Close the gap — title “You can still take this.” / body “Log {N} habits to pass {name}.” Setting: “Close the gap”.
• A friend hit 100 — “{name} just hit 100.” Setting: “Friend hit 100”.

The three friend-score notifications fire only between 07:00 and 20:00 local time and are capped at 3 per day in total. Each has its own toggle in Settings. They are mirrored into the in-app notification inbox. They reveal a friend’s display name and score difference on your device. The app keeps at most 50 pending scheduled notifications at a time.

Remote push notifications (FCM, server-triggered):

• New messages when the master “Allow Notifications” switch is on, iOS notification permission is granted, and a registered device token exists. Push includes sender display name and message preview. Message notifications show the sender’s profile photo: a notification service extension downloads it over HTTPS on your device. Push is not sent if either party has blocked the other.
• New friend request. Title “New friend request,” body “{display name} wants to connect on PRIMAL.” The data payload carries the request ID and both user IDs. No profile photo. Limited to one per request pair per 24 hours; PRIMAL stores a server-side timestamp per notification pair to enforce this. A matching entry is written to your in-app notification inbox. Suppressed if either party has blocked the other, or if the recipient has notifications off.
• Friend request accepted. Title “Request accepted,” body “{display name} is now on your team. Hold each other accountable.” Same payload shape, rate limit, inbox, and block/opt-out rules as a new friend request. No profile photo.

Settings include one master “Allow Notifications” switch plus eight category toggles: Habit Reminders, Streak Notifications, Streak at risk alerts, Weekly Recap, Award Unlocked, Friend passed you, Close the gap, and Friend hit 100. There is no separate toggle for message push or friend request push. The master switch is what syncs to PRIMAL’s servers, and that single flag gates all remote push — messages, friend requests, and acceptances. Turning off the master switch stops all remote push. The category toggles control the local notifications listed above. Disabling notifications in iOS Settings also prevents delivery.

Some delivered notifications are mirrored to your in-app notification inbox (local storage, pruned after 7 days, max 150 items). Disabling notifications does not delete your account or habit data.

11. Profiling and automated processing

PRIMAL automatically calculates scores, streaks, streak freezes, and leaderboard rankings based on the habits and activity you log. These are automated system outputs used to provide app functionality. They do not produce legal, financial, employment, insurance, housing, or similarly significant effects.

12. Analytics and diagnostics

Mobile app: PRIMAL does not collect third-party analytics or advertising data in the iOS app. We do not use the Identifier for Advertisers (IDFA), the AdSupport framework, or App Tracking Transparency, and we do not link your data across apps or websites for advertising. We do collect crash and diagnostic data with Firebase Crashlytics, on by default, to help identify and fix bugs. Those reports can include internal document IDs. This data is not sold, not used for advertising, not used for data mining, and not used for tracking. Insights and progress views in the app are computed on your device.

Website: Our marketing site uses Vercel Analytics and Vercel Speed Insights only after you accept non-essential cookies in our banner, as described on our Cookies page. Declining cookies means no analytics scripts load.

PRIMAL does not show ads or run an advertising system in the app.

13. Subscriptions (PRIMAL Pro)

PRIMAL Pro is an auto-renewing subscription sold in one subscription group: $4.99 USD per month, or $39.99 USD per year (one annual charge). Those are the prices shown on this website. The amount Apple charges is the price on the App Store confirmation screen for your storefront, which can differ by country. Payment is charged to your Apple ID at confirmation of purchase. The plan renews automatically unless you cancel at least 24 hours before the end of the current period. Your account is charged for renewal within 24 hours before that period ends. Purchase and subscription status is checked on our servers and stored only as a Pro / not-Pro flag. Purchases are handled entirely through Apple’s StoreKit. The app and its backend never see or store card numbers, billing addresses, or full receipts. A deterministic token links a purchase to your account so that status can be checked. After that check, PRIMAL publishes an isPro flag to your friend-visible public profile. Friends see a PRO badge on your profile. It is on by default, and Pro users can turn off “Show PRO badge” in Settings. Other users’ devices read this flag to determine your friend-limit tier when adding you. No payment details, purchase history, or Apple account information is shared with friends — only the subscription state. Pro unlocks higher limits and features compared to Free:

Free vs Pro limits (enforced in the app):

PRIMAL enforces additional per-account limits on all users regardless of plan — 50 friend requests per day, 8,000 habit log syncs per day, a minimum interval between messages, and a server cap of 500 messages per day. These protect against abuse and are subject to change.

Limits are delivered by server-side configuration and can be adjusted without an app update, with reasonable notice where required by law or platform rules.

Payment, renewal, cancellation, and refunds are handled by Apple under Apple’s terms. To cancel, go to Settings → Apple ID → Subscriptions on your iPhone at least 24 hours before the period ends. Deleting the app, or deleting your PRIMAL account, does not cancel billing. Restore purchases is available in the app paywall.

14. Account deletion process

You can delete your account in the app. Deletion takes effect when you confirm it in the app.

You can delete your account in the app (Profile → Delete Account). This is a complete in-app deletion, not a request that waits on email. Deleting your account requires re-authentication — signing in again with Google or Apple. When deletion is confirmed, we permanently remove:

• Your Firebase Auth account
• The Sign in with Apple token for this app, if that was how you signed in
• Your private user document and all subcollections: habits, habit logs, daily rosters, awards (achievements), habit inventory count, push device tokens, notification preferences, and daily usage counters
• Your public profile
• Your friend-graph entries on both sides, and all friend requests involving you, so you are removed from other people’s friend lists
• Your own block list
• Your profile photo in Firebase Storage
• All local on-device data

A Cloud Function runs server-side after your auth account is removed. It deletes anything remaining under your user record — for example the current day’s usage counters, which the app itself is not permitted to delete — and scrubs your identity elsewhere. On other users’ conversation previews and block lists, your name and photo are replaced with a “Deleted User” placeholder. Your old name and photo are not left on those surfaces.

What remains after deletion:

• Messages you already sent. Those messages stay in the other participant’s copy of the conversation. They are not deleted from that copy. Your name and photo on the conversation, including the preview, are replaced with “Deleted User.” The other participant also keeps the messages they sent until they delete their own account.
• Block entries other people created about you. The entry can remain so the block still applies, but your display name and photo on it are replaced with “Deleted User.”
• Reports (ones you submitted and ones filed about you), retained for safety and moderation. Reports are not deleted on request.
• Limited encrypted backup copies may remain temporarily for disaster recovery and legal obligations, but they are not accessible in the app and are deleted on backup rotation.

If the account is removed but server-side cleanup does not fully complete, the app tells you some data may remain. Contact us at theprimalapp@gmail.com so we can finish the cleanup.

Deleting your account does not cancel an active Apple subscription. Cancel that in Settings → Apple ID → Subscriptions. We may retain minimal records where required by law, such as billing or fraud-prevention records handled by Apple or required tax and accounting data. Sign-out alone does not delete cloud data. You may also contact us at theprimalapp@gmail.com if you need help deleting your account.

15. Viewing legal pages in the app

Privacy Policy and Terms links inside the PRIMAL app open theprimalapp.com in an in-app browser (Safari). That site may set cookies as described in our Cookies policy.

16. Children

PRIMAL is not intended for users under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us data, contact us and we will delete it.

17. Your privacy rights (GDPR / EEA / UK)

If you are in the European Economic Area, UK, or Switzerland, you may have the right to:

• access your personal data;
• rectify inaccurate data;
• erase your data;
• restrict processing in certain circumstances;
• receive a portable copy of your data;
• object to certain processing; and
• withdraw consent where processing is based on consent.

You can manage much of your information in the app, including CSV export of habit log history and account deletion in Settings. Contact us at theprimalapp@gmail.com to exercise these rights. We will respond within a reasonable time and as required by applicable law. You may also lodge a complaint with your local data protection authority.

Legal bases. Where GDPR (or UK GDPR) applies, we process personal data on the following bases, which describe processing already covered in this policy:

• Performance of a contract: creating and maintaining your account; syncing habits, logs, and related Service data; messaging and friends features you use; delivering Free or Pro features you subscribe to through Apple.
• Legitimate interests: security and abuse prevention (including rate limits, App Check, blocking, and investigating user reports); retaining reports for safety after an account-deletion request as described in this policy; and crash / diagnostic reporting via Firebase Crashlytics(on by default; you can turn it off in Settings → Privacy & Safety → Crash Reports) to keep the Services reliable. Those interests are balanced against your rights and expectations.
• Consent: optional Apple Health connection (via Apple’s Health permission when you connect it); body measurements and onboarding answers you choose to enter during setup, used only to personalize the Services you request; and non-essential website cookies / Vercel Analytics only after you accept via the cookie banner (as described in our Cookies policy).
• Legal obligation: processing required to comply with applicable law.

Body metrics and Health-derived values are used only to power in-app fitness and habit features you enable. They are not sold, not used for advertising, and are not shared with friends as raw HealthKit samples.

18. California privacy rights

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the right to:

• Know what categories and specific pieces of personal information we collect, use, and disclose, and the purposes for which we use it (as described in this policy, including §1);
• Delete personal information we hold about you, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of sale or sharing of personal information, including sharing for cross-context behavioral advertising; and
• Non-discrimination — we will not deny goods or services, charge a different price, or provide a different quality of service because you exercise these rights.

PRIMAL does not sell personal information as CCPA/CPRA define that term. PRIMAL does not share personal information for cross-context behavioral advertising as CCPA/CPRA define those terms. PRIMAL does not use tracking in the iOS app, and does not use IDFA, AdSupport, or App Tracking Transparency. Firebase Crashlytics is on by default and collects crash and diagnostic data that can include internal document IDs. That data is not sold, not used for advertising, not used for data mining, and not used for tracking. You can export habit log history as CSV and delete your account in Settings. To exercise California privacy rights, email theprimalapp@gmail.com (we do not operate a separate online request portal). We will verify your request as required by law and respond within the timeframes required by applicable California law.

19. Changes

We may update this Privacy Policy from time to time. We will post the updated version here and change the “Last updated” date. Material changes may also be communicated in-app or by other reasonable notice.

20. Contact

PRIMAL is operated by Mahmoud Alhabib, an individual doing business as PRIMAL (not a limited liability company). The data controller / operator is that same individual. Privacy questions: theprimalapp@gmail.com