Privacy policy
What we collect, why we collect it, and what you can do about it.
Last updated: 25 August 2026 · Version 2.0
The short version
HabitQuest is used by children aged 6–12 and their parents. We designed it to collect as little as possible.
- Only an adult can create an account
- We never ask for or store your child's weight, height or BMI
- We never show a child any number about their body
- We don't collect location, contacts or photos
- We don't use advertising identifiers
- We never sell your data. We never share it with advertisers
- All data stays in the UK
- You can delete everything, at any time, in two taps
There is also a version of this written for children.
1. Who we are
HabitQuest Ltd
71–75 Shelton Street, London, England, WC2H 9JQ
Registered in England and Wales, company number 17349841
We are the data controller for the personal data described in this policy. We are registered with the Information Commissioner's Office (ICO) under registration number ZC218204.
Questions about this policy or your data: info@habitquest.uk
2. Children's data — our commitments
HabitQuest is designed for children aged 6–12. We have assessed the app against the ICO's Age Appropriate Design Code (the Children's Code) and completed a Data Protection Impact Assessment.
Only an adult can create an account
Accounts may only be created by a parent or carer aged 18 or over who holds parental responsibility for the child. That adult gives consent for all processing relating to their child, and can withdraw it at any time.
What we never do
- We never ask for or store a child's weight, height or BMI
- We never display any number relating to a child's body — no weight, no BMI, no calories
- We never use children's data for advertising, marketing or profiling for commercial purposes
- We never sell data to anyone, for any reason
- We never collect location data
- We never transmit advertising identifiers such as the Android Advertising ID
- We never allow children to message each other, or anyone else, through the app
- We never share identifiable data with schools, NHS organisations or any other partner
What children can see and control
Children are told, in language appropriate to their age, what HabitQuest records about them and what their parent can see. Some responses — for example answers about how they feel about food — are never shown to parents, so that children can answer honestly. We explain this to them clearly before they answer.
3. What we collect
| Category | What this includes | Why we need it |
|---|---|---|
| Account information | Parent's name, email address, encrypted password | To create and secure your account |
| Child profile | First name or nickname, age or age band | Age-appropriate content and personalisation |
| Household context | Cooking facilities, available space and equipment, number of children | To suggest meals and activities you can realistically do |
| Dietary information | Allergies, intolerances, religious or cultural dietary requirements, food preferences | Safety, and to suggest food your family will actually eat |
| Activity and wellbeing data | Activities completed, and responses to short validated questionnaires about physical activity, dietary quality and wellbeing | To personalise content, monitor safety, and evaluate whether HabitQuest works |
| Usage data | Logins, session length, features used, quests completed | To improve the app |
| Technical data | Device type, operating system, app version, and an app-scoped identifier | To operate the service and diagnose problems |
Special category data. Some of the above is special category data under UK GDPR — specifically health information and religious dietary requirements. We process it only with the explicit consent of the parent or carer, and only for the purposes described here.
What we do not collect
We do not collect: location data, your contacts, photos or camera access, microphone access, browsing history, advertising identifiers, biometric data, financial information, or your child's weight, height or BMI.
4. Our lawful basis
We process personal data on the basis of consent (Article 6(1)(a) UK GDPR), and special category data on the basis of explicit consent (Article 9(2)(a) UK GDPR). Consent is given by the parent or carer who creates the account.
You can withdraw consent at any time by deleting your account. Withdrawing consent does not affect processing that happened before you withdrew it.
5. Who we share data with
We do not sell your data. We do not share it with advertisers. We do not share identifiable data with schools, NHS organisations, or any commercial partner.
We use a small number of technical service providers who process data on our behalf under written contracts that comply with Article 28 UK GDPR — for example our cloud hosting provider. These providers act only on our instructions and cannot use your data for their own purposes. A current list is available on request from info@habitquest.uk.
Where HabitQuest is used as part of an NHS, school or community programme, those organisations receive only aggregated, anonymised reporting. They never receive data that identifies your family.
We may disclose data if required to do so by law, or to protect someone from serious harm.
6. Where your data is stored
All personal data is stored on servers in the United Kingdom. We do not transfer personal data outside the UK.
7. How long we keep it
- While your account is active: we keep your data for as long as you use HabitQuest
- If you delete your account: all personal data is permanently deleted within 30 days
- Anonymised data: data that cannot identify you or your child may be kept indefinitely for research and service evaluation
- Legal obligations: we may keep limited records where the law requires it, and we will tell you if that applies to you
8. Deleting your account
You can delete your account and all associated data at any time:
- In the app: Settings → Account → Delete my account
- On the web: habitquest.uk/delete-account
Deletion is permanent and cannot be undone.
9. Your rights
Under UK GDPR you have the right to:
- Access — ask what data we hold and get a copy
- Rectification — correct anything that's wrong
- Erasure — have your data deleted
- Restriction — ask us to stop processing but keep the data
- Portability — receive your data in a machine-readable format
- Objection — object to processing
- Withdraw consent — at any time, without giving a reason
Because the data concerns your child, you may exercise all of these rights on their behalf. Email info@habitquest.uk and we will respond within one month. There is no charge.
10. Security
Data is encrypted in transit and at rest. Access within HabitQuest Ltd is restricted to staff who need it for their role. We carry out security testing and maintain a documented breach response procedure, including notifying the ICO within 72 hours where required.
11. Cookies and tracking
The HabitQuest app does not use advertising cookies or tracking technologies. We use an app-scoped identifier to keep you signed in and to understand how the app is used. This identifier cannot be used to track you across other apps or websites, and it is reset if you delete the app or clear its data.
Our website uses only essential cookies necessary for it to function.
12. Changes to this policy
If we make significant changes we will tell you in the app and by email before they take effect. Where changes affect processing based on your consent, we will ask for your consent again.
13. Complaints
If you're unhappy with how we've handled your data, please contact us first at info@habitquest.uk — we would like the chance to put it right.
You also have the right to complain to the Information Commissioner's Office:
ico.org.uk · 0303 123 1113
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF