Skip to content
← Back to app
Legal

Privacy Policy

Last updated: November 2026

1. Who We Are

HabbitStew is operated by Castillo Capital LLC ("we", "us"), based in West Palm Beach, Florida. This policy explains what we collect when you use HabbitStew, including when you connect your social media accounts, and what we do with it.

2. Information We Collect

You give us your name, email address and password (stored hashed), your profile and workspace content, and any habit data you enter. We collect automatically how you use the app, through cookieless analytics, and a few essential cookies (see section 8).

When you connect a social account such as Instagram, Facebook, Threads, TikTok or YouTube, we receive and store:

  • the account's platform ID, username and profile details;
  • access tokens, encrypted at rest and never shown to other users;
  • posts, captions, media details and performance insights for that account;
  • for Instagram engagement features you turn on: comments on your posts, including the commenter's username and platform ID, and details of message conversations with your account.

We only request the permissions a feature needs, and you can disconnect an account at any time.

3. How We Use Your Information

We use your information to run HabbitStew: publishing and scheduling your content, showing your analytics, replying to comments or messages when you turn those features on, answering questions you ask the assistant, sending account email, processing payments, and keeping the service secure. We do not sell your personal information, we do not use data from your connected accounts for advertising, and we do not share it with data brokers.

4. Service Providers

We share data only as needed to run the service:

  • Stripe processes payments. We never store full card numbers.
  • Resend sends our account email.
  • Meta, TikTok, Google and the other platforms you connect receive what is needed to act on the accounts you connected.
  • AI model providers answer questions you ask the assistant. By default this is Google Gemini. If your workspace connects its own model, for example through OpenRouter, your questions go to that provider under its terms.
  • Hosting and infrastructure providers store and serve the service.

5. Session Replay

We don't record your sessions by default. If you ask us for help with a problem, we may, with your agreement, record your signed-in sessions so we can see and fix it. We stop when the problem is resolved or when you ask.

6. How Long We Keep Data

We keep your data while your account is active. When you delete your account, disconnect a social account, or ask us to delete data, we remove it from our systems, and it is gone from backups within 90 days.

7. Deleting Your Data

  • Disconnect an account in Studio settings, and we remove its access tokens immediately.
  • Remove HabbitStew from Instagram or Facebook, and we are notified and remove the access tokens.
  • Request deletion through Meta, and we delete the connection, its tokens, and the insights, media, comments and messages we hold for it. Meta gives you a confirmation code and a link to check the result.
  • Delete your HabbitStew account in your profile settings. This removes your account and disconnects every social account you connected.

Posts already published on a platform stay there until you remove them. A workspace may keep its own record of what it published, with the connected account's identity removed. You can also email us to access, correct or delete your data.

8. Cookies

We keep cookies to the essentials: a session cookie and a security token to keep you signed in and protect against forgery, plus a couple that remember display preferences such as theme and sidebar state. We don't use advertising or cross-site tracking cookies, and our traffic analytics are cookieless, which is why you won't see a cookie consent banner.

9. Security

Connections use encryption in transit, access tokens are encrypted at rest, and each workspace's data is separated at the database level. No system is perfectly secure, so please tell us if you suspect a problem.

10. Children

HabbitStew is not for children under 13, and we do not knowingly collect their data.

11. Changes and Contact

We update the date above when this policy changes and tell you about significant changes. Questions or requests go to privacy@habbitstew.com .