Inhabito Privacy Policy

Last updated: 20 September 2026

Inhabito is a personal work assistant: a notebook, a task list, timers, and features that learn from how you use them. This page explains what it stores, where that data goes, and what you can ask us to do with it.

Who is responsible

The controller for this service is Arash Gholami, Via Merano 30, 37135 Verona, Italy, contactable at admin@inhabito.de. Full details are on the Impressum.

What Inhabito stores

• Your account: the username you choose and your password, kept only as a salted scrypt hash — never in readable form. A signed session cookie keeps you logged in.
• Your email address, if you give one. It is optional. It is used for exactly one thing — sending you a link when you ask to reset a forgotten password — and never for newsletters, announcements or anything else. You can remove it under Settings → Account at any time. A reset link is kept only as a one-way hash, works once, and expires after an hour.
• What you write: notes, tasks, plans, wiki entries, boards, and any images you attach to a note.
• How you work: timers, focus and activity sessions, and what you completed and when. The routine features are derived from this.
• Notifications: if you turn them on, your device's push token.
• Anything you connect yourself: credentials and feed addresses you enter for optional integrations.
• The calendar you connect, if you connect one: the address of your calendar server, your username, and the app password you give it. That app password is the one thing stored here that opens an account somewhere else, so it is encrypted before it is written down, with a key kept outside the database — a copy of the database on its own does not reveal it. It is never shown back to you, and never sent anywhere except to the calendar server you chose. Clearing it, removing the connection or deleting your account removes it; nightly backups already taken still hold the encrypted value until they rotate out.

Everything is stored on the operator's own server. There is no third-party analytics service, no advertising, no tracking across other sites, and no profiling for anyone but you.

Where your data goes

Inhabito does not sell or rent your data, and shares it only where a feature you are using requires it:

• AI features (the assistant, note classification, the coach, wiki compilation, the inbox triage, "Ask"). When you use these, the relevant content — the note or task in question, plus a short summary of your current projects and workload for context — is sent to the AI provider configured for your account. That provider processes the text to produce the response. If you have not entered an AI key, nothing is sent anywhere: the request stops on this server before any network call, and the note parser that turns "Dentist on the 14th at 9" into an appointment runs here, not at a provider.
  Two things about the provider are worth knowing. The address a new account starts with is not Anthropic's or OpenAI's — it is a third-party reseller that speaks the same protocol, and a key you paste without changing the address goes to it. The address is shown and can be edited under Settings → AI; check it before entering a key. And if the operator has granted your account shared AI, your text is processed through the operator's own AI account instead, with no key of your own involved.
• Push notifications: delivered through Google Firebase Cloud Messaging, which processes your device token and the text of the notification.
• Dictation (the microphone beside the capture box). The speech recognition is your device's, not ours: Inhabito never receives the audio — only the text it produced, which you can edit or discard before you save it. Where that recognition happens is the device's decision, and we will not pretend otherwise. In the Android app we ask the system to prefer its on-device recogniser, so on a phone that has the language model installed the sound does not leave the handset; where no on-device model is available, Android falls back to Google's speech service, which then processes the audio under Google's terms. In the browser, dictation uses the browser's own speech recognition — in Chrome and Edge that sends the audio to Google, and in Safari to Apple — and in a browser with no support the microphone button is not shown at all. The microphone is live only while you are dictating, and the permission can be withdrawn in your device or browser settings at any time without affecting anything else in the app.
• Password-reset mail: sent to the address you gave, through Brevo (Sendinblue SAS, France), which delivers it on the operator's behalf. Inhabito puts only your display name and the link in the message. Brevo then adds its own delivery machinery to it, and you should know what that includes: an open-tracking pixel — a hidden image that tells Brevo when the message is opened — and an unsubscribe link. Neither is added by Inhabito and neither can be switched off on Brevo's relay; they are the cost of using it. Do not use that unsubscribe link: it is meant for marketing mail, and unsubscribing may stop future password-reset links reaching you.
• Webhooks: only if you set one up. When a note is added or a task is finished, its text is sent to the address you chose, signed so the receiver can check it came from here. You can remove the address at any time.
• API tokens: only if you create one. A token lets a tool you chose add a task or a note to your account; it cannot read anything. Only a one-way hash of it is stored.
• Telegram: only if you link the bot yourself. Messages then pass through Telegram's servers.
• Feeds you add: Inhabito fetches the addresses you configure. Those sites see a request from the server, not from you.
• Calendar feed: only if you create one. It is a secret address that lists your work window and timed plans for the next two weeks, with or without task titles as you choose; anyone you give the address to — for example Google Calendar — can read it. You can change or revoke the address at any time, and the old one stops working immediately.
• Two-way calendar: only if you set it up. Inhabito then sends your appointments for the next two weeks — their titles, dates and times — to the calendar server you chose, signing in with the username and app password you gave, so they appear in your own calendar. Appointments that came into Inhabito from a calendar you subscribe to are never sent back out. An appointment you delete in Inhabito is deleted there; one that has been changed in that calendar since is left alone. That server sees a request from this server, not from your device, and what it does with the data afterwards is governed by whoever runs it.
• Focus together: only if you turn it on. Friends you have accepted, and who have turned it on too, can see that you have a timer running and for how many minutes — never what you are working on.
• Finding people: any signed-in account can search for others by username or display name and see the matches, which is how a friend request is addressed. Your display name is visible to anyone with an account here, so do not put anything in it you would not show them. Nothing else about you is shown — no email address, no content.
• Handing work to someone: if you send a task or note to another member, its text goes into their account and stays there, with your name on it, until one of you removes it. You can only send to people you are connected to.

The operator can see, for every account on this server, on which days an account was active and which parts of the app it has used (for example: has captured a note, has run a timer), together with the username and the date the account was created. This is counted from the data above to see whether the app is useful; it never includes what you wrote — no note, task or message text appears in it, only counts and yes/no answers.

Why we are allowed to process it

We process your account data and content to provide the service you asked for (Art. 6(1)(b) GDPR — performance of a contract). Optional integrations, and sending your content to an AI provider, happen on your initiative when you enable and use them.

How long it is kept

Your content stays until you delete it or ask for your account to be removed. Some operational history is trimmed automatically so it cannot grow without limit — per-task timer detail is kept for about two weeks and focus history for about six months.

Deleting something is not instantly everywhere. Inhabito keeps a short version history of your documents so a bad edit or a sync conflict can be recovered — up to thirty previous versions — so a note you delete remains in those older versions until further edits push them out. Server backups are taken nightly and about thirty are kept, and a snapshot is taken before each update of the software; a deleted account or note disappears from these as they age out, which takes about a month. Asking for your account to be removed deletes it from the live service immediately, and the backups then age out as described.

Your rights

Under the GDPR you can ask for a copy of your data, correct it, have it deleted, restrict or object to its processing, and receive it in a portable form. Inhabito also has a built-in export: Settings → Backups & data transfer → Download all data. To exercise any of these, or to delete your account, write to admin@inhabito.de. Deletion permanently removes your content, sessions and push tokens.

If you believe your data is being handled improperly, you may complain to your national data protection supervisory authority.

Children

Inhabito is not intended for children under 16.

Changes

If this policy changes materially, the date at the top changes with it.