←

Privacy Policy

Effective from: 5 July 2026 · Last updated: 5 July 2026

Related: Terms of Use

This policy explains what information Ritual collects, why, and what we do with it, when you use the Ritual mobile application, NFC tiles, and website (together, the "Service"). We have tried to keep it short and readable, because we actually want you to read it.

Ritual is available in Australia, New Zealand, the United States, and South Africa. It is not offered in the European Union or the United Kingdom, and this policy does not provide EU/UK data-protection rights.

1. Who we are

Ritual is operated by Bekker Labs Pty Ltd (ACN 699 280 012, ABN 79 699 280 012) ("Bekker Labs," "we," "us," "our"), based in Melbourne, Victoria, Australia.

You can reach us about privacy at hello@ritualhabits.com.au.

2. The short version

• Ritual is a household habit tracker. A parent or other adult owns the account; the whole family's habits live in it.
• We collect the minimum needed to run it: your account email, your family name and PIN, the profiles you create (a first name, a colour, an adult/kid marker), your habits, and who completed what on which day.
• About children we store a first name and their habit ticks — no date of birth, no photos, no messages. A parent enters and controls all of it.
• No advertising, no tracking SDKs, no analytics services, no selling your information. Our website sets no tracking cookies.
• You can remove any family member's profile in the app, and you can have your whole account deleted by emailing us.

3. Information we collect, and from whom

From the account holder (an adult):

• Account details. An email address and password if you create an account, and your family name and a family PIN used to sign in to your family and switch between profiles.
• Family profiles. For each member of your household you add: a first name (or nickname — a nickname is fine), a colour you pick, and whether the profile is an adult or a kid. The profile's avatar is simply the first letter of the name. There is no field for a date of birth, and no way to add a photo.
• Habits and activity. The habits you create (name, icon, schedule, reminder time), which profile completed which habit on which day, points, streaks, and any rewards you set up.
• Push notification token. If you turn on reminders, Apple issues the app a push token for the device. We store that token so we can send the reminders you set. It identifies a device, not a person.
• NFC tiles. Each tile's unique identifier and which habit you've linked it to. Tiles themselves store no personal data — only an identifier and a link that opens the app.

From website visitors: if you join the waitlist we collect the email address you enter, and nothing else. Our website has no other forms, sets no tracking cookies, and uses no analytics.

What we do not collect: dates of birth, photos or images, location data, advertising identifiers, biometrics, contact lists, browsing history, or anything from your device beyond what is listed above. The app contains no analytics, crash-reporting, or tracking SDKs, and shows no ads.

4. How and why we use information

We use your information only to provide and operate Ritual:

• to create and manage your family account and let you sign in;
• to record and show your family's habits, completions, streaks, points, and rewards;
• to send the reminders and notifications you have asked for;
• to link your NFC tiles to your habits;
• to respond to you, provide support, and keep the service secure and working;
• to tell waitlist subscribers about Ritual's availability;
• to comply with our legal obligations.

We do not sell personal information. We do not use your information for advertising or cross-context behavioural advertising, we do not build profiles of you or your children, and Ritual has no AI features — none of your content is processed by or used to train any AI model.

5. Children's information

This is the part of Ritual that matters most, so we want to be precise about it.

• Ritual is a household tool that belongs to a parent. The account holder must be an adult. Children do not create accounts, do not sign in, and do not need their own phones or devices. A child's interaction with Ritual is a brief, supervised moment on their parent's device — tapping a tile or a button to mark a habit done.
• What we store about a child is exactly this: the first name (or nickname) their parent enters, an adult/kid marker, a colour their parent picks, an avatar that is the first letter of the name, points and streak counters, and which habits were completed on which days. Nothing else — no date of birth, no photos, no messages, no contact details, and no advertising or behavioural profiling of any kind.
• The parent provides and controls all of it. A child's information reaches us only because their parent or guardian enters it and records their activity. We rely on the parent's authority (and, where the law requires it, the parent's consent as the child's "competent person" or guardian) to handle that information. If you prefer, use a nickname or initial instead of your child's real name — the app works exactly the same.
• We do not knowingly collect personal information directly from children. Ritual is designed for and marketed to parents, and children cannot submit information to us on their own.
• You can remove a child's information at any time by removing their profile in the app — this permanently deletes the profile and its completion history — or by asking us to delete your whole account (Section 10).

6. Who we share information with

We don't sell your information and we don't share it for advertising. We use the following service providers ("processors") to run Ritual. Each may use your information only to provide its service to us and is bound by its data-processing terms:

We may also disclose information if the law requires it, to protect the safety of people or the security of the service, or as part of a business transfer (in which case we'll tell you).

7. International data transfers

Ritual is operated from Australia. Your information is stored with our database provider in Singapore, our backend and website are hosted in the United States, push notifications are delivered by Apple, and app updates are delivered from the European Union (device-level information only). Where we transfer information across borders, we do so under contractual protections with each provider. Country-specific detail is in Section 11.

8. How long we keep information

• Account and family information is kept while your account is active.
• Removing a family member's profile in the app permanently deletes that profile and its completion history straight away.
• When you ask us to delete your account, we delete your family's information within 30 days of verifying the request (this window covers ordinary processing time and the rotation of routine backups), except where the law requires us to keep something longer.
• Waitlist email addresses are kept until we've told you about the launch, or until you ask us to remove yours — whichever comes first.
• Operational logs are kept briefly (no more than about 30 days) and then deleted, unless we're required to keep them longer.

9. How we protect information

• Information is encrypted in transit using TLS.
• Information stored in our database is encrypted at rest by our database provider.
• Access to your family's data in the app is gated by your family's sign-in, and each family sees only its own data in the app.
• Access to production systems is restricted to us.

No system is perfectly secure, and we don't claim certifications we don't hold. If a data breach affects you, we will notify you and the relevant regulator where the law requires.

10. Your choices and how to contact us

You can review and update your family's profiles and habits in the app at any time, and remove a family member's profile (which permanently deletes it and its completion history). To delete your whole family account and all associated data, or for any other privacy request — access, correction, or deletion — email hello@ritualhabits.com.au. We action verified deletion requests within 30 days. You can turn off push notifications at any time in your device settings. Jurisdiction-specific rights are in Section 11.

11. Jurisdiction-specific rights and disclosures

11.1 Australia and New Zealand

Australia. We are not currently an "APP entity" under the Privacy Act 1988 (Cth) (we are a small business below the relevant turnover threshold). As a matter of practice, we handle your information consistently with the Australian Privacy Principles (APPs). You may ask us for access to the personal information we hold about you and ask us to correct it, by contacting hello@ritualhabits.com.au. If you have a privacy concern, you can contact us first; you may also contact the Office of the Australian Information Commissioner (oaic.gov.au).

New Zealand. We are subject to the Privacy Act 2020, and we handle personal information in accordance with the Information Privacy Principles (IPPs). This includes IPP 3A, which concerns telling people when we collect their information indirectly (from someone other than themselves). Information about children in Ritual is provided by their parent or guardian — the adult who owns the account and controls what is entered. We give notice through the parent rather than separately to each child, because the parent is the child's guardian, controls the child's use of the app, and is the person who decides what information to record; separate notice to young children would be neither practicable nor meaningful. You may ask us for access to your personal information and ask us to correct it. You can also contact the Office of the Privacy Commissioner (privacy.org.nz).

11.2 United States

Ritual is a household tool operated by parents. It is designed for and marketed to adults, and we do not knowingly collect personal information online from children under 13.

Children's privacy (COPPA). The Children's Online Privacy Protection Act applies to online services directed to children, and to general-audience services that knowingly collect personal information from children under 13. Ritual's account holder is an adult; children do not create accounts, sign in, or submit information to us. The information about children in Ritual — a first name and habit-completion records — is entered and controlled by their parents within the parent's own account, on the parent's own device. The device push token exists solely to deliver reminders the parent has requested and is not used for profiling, advertising, or tracking of any kind. If you believe a child has provided us personal information outside this model, contact us at hello@ritualhabits.com.au and we will delete it.

Your California privacy rights. If you are a California resident, you have the rights below. (We honour these regardless of whether we currently meet the thresholds that make a business formally subject to the California Consumer Privacy Act, because they reflect how we operate anyway.)

• Right to know what personal information we collect, why, and who we share it with — this policy is that disclosure.
• Right to delete the personal information we hold about you.
• Right to correct inaccurate personal information.
• Right to opt out of the "sale" or "sharing" of your personal information. Under California law, "sell" means disclosing personal information for money or other value, and "share" means disclosing it for cross-context behavioural advertising. We do not sell or share your personal information, so there is nothing to opt out of.
• Right to non-discrimination — we will not treat you differently for exercising any of these rights.

To exercise any of these rights, contact hello@ritualhabits.com.au. We will verify your request before acting on it.

Notice at collection. We collect the following categories of personal information, in each case only to provide and operate Ritual, and we retain it as described in Section 8:

• Identifiers (family name, member first names, account email, device push token) — to run your family account and deliver reminders.
• Customer records / contact information (email) — to communicate with you and provide support.
• Internet and electronic activity (which habits were completed on which days, within your account) — to provide the habit-tracking service itself.

We do not collect sensitive personal information, precise geolocation, or biometric information. We do not sell or share any of these categories, and we do not use personal information for cross-context behavioural advertising.

11.3 South Africa

This section uses the terms of the Protection of Personal Information Act, 2013 ("POPIA"). Under POPIA, we are the "responsible party" (the party that decides why and how your personal information is processed), the people whose information we process are "data subjects," and the providers in Section 6 that process information on our behalf are "operators."

Responsible party. Bekker Labs Pty Ltd (ACN 699 280 012, ABN 79 699 280 012). Contact: hello@ritualhabits.com.au.

Children's information. POPIA generally prohibits processing a child's personal information. We rely on the exception in section 35(1)(a): we process a child's personal information with the prior consent of a competent person — the child's parent or guardian, who is our account holder, enters the child's profile, and controls the child's supervised use of the app.

What we tell you when we collect information (section 18).

• Purpose: we collect your information to provide Ritual — to run your family account, record your family's habits and completions, and send the reminders you set.
• Recipients: we share information with the operators listed in Section 6 (Supabase, Vercel, Apple, and Capgo).
• Voluntary: providing your information is voluntary, but without it we cannot provide the service.
• Your rights and complaints: you may access and correct your information (below), and you may lodge a complaint with the Information Regulator (South Africa): POPIAComplaints@inforegulator.org.za, with formal complaints lodged via the eService portal at https://inforegulator.org.za.

Cross-border transfer (section 72). Our operators are all located outside South Africa: your information is stored in Singapore (Supabase) and processed in the United States (Vercel, which hosts and runs the service, and Apple, which delivers push notifications), and app updates are delivered from the European Union (Capgo, which receives only anonymous device-level information). We make these transfers on the basis that each of these operators is bound by contractual terms that provide a level of protection substantially similar to POPIA's conditions for lawful processing, including substantially similar restrictions on any further transfer of the information to others.

Your rights (sections 23–25). You may:

• access the personal information we hold about you;
• request correction of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained;
• request deletion of your information.

To exercise these rights, contact hello@ritualhabits.com.au.

12. Changes to this policy

We may update this policy as Ritual changes or as the law changes. If we make a material change, we'll update the "Last updated" date above and tell you in the app or on our website before the change takes effect for you.

13. Contact us