Held Privacy Policy
Effective date: 5 November 2026
Held is made by Appodeal, Inc., 1640 Boro Place, 4th Floor, McLean, Virginia 22102, United States ("we", "us"). This policy explains what Held collects, why, who can see it, and how to delete it. We keep it short on purpose; if anything here is unclear, write to legal@appodeal.com.
What Held does
You pick a habit, a time and a place, and check in on each scheduled day for 28 days. Do 80% of them and the habit is kept. If you get a partner, they can see the display name you pick, your habit's title, your 28-day progress, your misses and the weekly times you are both free.
What we collect
An anonymous account, when you first open the app. You can use Held without signing in. We create an account with a random identifier and your time zone, and it holds your habits and check-ins. It has no name or email. If you later sign in with Google or Apple, it becomes that account, or its habits and check-ins move to your existing one.
From your Google or Apple account, when you sign in. Your account identifier at that provider, your email address and your name. If you sign in with Apple and choose Hide My Email, we receive and store the relay address Apple gives us instead of your real one. We use the provider's sign-in so we never see or store a password.
What you enter in the app. The habit's title, the action, the days of the week, the time of day, and the place, plus any note you add to a check-in.
How you use the app. The dates you check in and the dates you open the app. We also record the time zone your phone reports, so that "today" means your today.
Partner matching. If you look for a partner, we store the age band you choose, the age bands you are open to being matched with, the languages you speak (including any you type in yourself), and the weekly times you are free for a call, in your time zone. If you invite a partner and agree a call with them, we store the weekly times you give for it, in your time zone, and the call times you suggest. We store each match we propose to you and whether you accepted, declined, ended or blocked it, any invite codes you create or use, any report you make about a partner, and a record of the notifications we send you.
Video calls. Matched partners' weekly calls take place in a private room hosted by Daily (daily.co). You join it through the app, shown under your display name; we don't give Daily your email or your account's full name. If you add the call to your calendar, the app only adds that event and never reads your calendar.
Partner links. If you are linked to a partner, we store who watches whom, and, if you have a weekly accountability call, its day, time and the meeting link.
Reminders. If you allow notifications, we store the push token Expo (the notification service we use) assigns to your phone so we can send you habit and call reminders, and a record of which reminders were sent.
Sign-in sessions. A session token so you stay signed in. We store only a hashed form of it.
If you took part in the internal pilot. Your habit and check-in history from the pilot was carried over, and it is attached to your account the first time you sign in with the same email address.
We do not collect your location, contacts, photos or advertising identifiers, and the app contains no advertising or third-party analytics code.
Why we collect it
- To run the app: show your cycle, count misses, decide when a cycle is complete.
- To find you a partner of a similar age who shares a language with you and is free at the same time, and to let your partner see your progress, if you have one.
- To understand whether Held works. We look at aggregated numbers such as how many people who started in a given week are still checking in the weeks after. These figures do not identify you.
- To keep your account secure and to respond when you contact us.
We do not sell your data, and we do not use it for advertising.
Who can see it
Your partner, if you have one or are proposed one, sees your display name, your habit's title, your 28-day progress bar, your misses and how many you have left, and the weekly times you are both free, so you can agree a call. Your age band, the ages you are open to and your languages are used only to find you a match and are never shown to anyone. Nothing else: not your email, your account's full name, your notes, your other free times or anything about other habits. When we match you with a stranger, people under 18 are only ever matched with other people under 18. A partner you invite yourself is your choice: we do not ask either of you for an age. On the weekly call, Google Meet may show the name on the Google account you join with.
Google or Apple, when you sign in. Their handling of that sign-in is covered by Google's or Apple's own privacy policy.
Expo and Apple, to deliver reminders. A notification's text (your habit's title and action; or your partner's display name, the call time, and how many of their and your habit days were done that week) passes through Expo's push service and Apple's notification service on its way to your phone.
Daily, to host matched partners' video calls. It receives your display name when you join, and the call's audio and video while it runs.
Our hosting providers, Railway, which runs the API servers in California, United States, and Supabase, which hosts the database in North Virginia, United States. They process the data on our behalf and may not use it for their own purposes.
Our team, only as needed to operate the service (including pairing you with a partner and seeing whether you are still using the app), investigate a problem you report, or produce the aggregated figures above. The admin tools we use to run the service do not show the notes you add to check-ins.
We disclose data to others only when the law requires it.
How long we keep it
We keep your data for as long as you have an account. When you delete your account, your email address and names are removed immediately and you can no longer sign in. The rest of your data (habits, check-ins, partner links) is erased within 30 days. Aggregated figures that no longer identify anyone may be kept.
Deleting your account
Open Held, go to the Settings tab, and tap Delete Account. You can also email legal@appodeal.com from the address you signed in with and we will delete it for you.
Your rights
Depending on where you live, you may have the right to access the data we hold about you, correct it, receive a copy of it, object to or restrict how we use it, and delete it. To exercise any of these, email legal@appodeal.com. If you are in the European Economic Area or the United Kingdom, you can also complain to your local data protection authority. Our legal basis for processing is the performance of our contract with you (running the app) and our legitimate interest in understanding whether the product works.
Children
Held is not intended for anyone under 16. We do not knowingly collect data from children; if you believe a child has created an account, tell us at legal@appodeal.com and we will delete it.
Security
Data travels between the app and our servers over HTTPS. Session tokens are stored hashed. Access to the database is limited to the people who operate the service.
Changes to this policy
If we change this policy in a way that matters to you, we will tell you in the app before the change takes effect. The effective date at the top always shows the current version.
Contact
Appodeal, Inc. 1640 Boro Place, 4th Floor, McLean, Virginia 22102, United States legal@appodeal.com