Privacy Policy
Last updated: August 25, 2026
Onward is a personal habit tracker made by Smirnov Labs. This policy explains what information Onward collects, why, and the choices you have. It applies to the Onward website and web app at onward.smirnovlabs.com, our mobile apps, and the connections you make to Onward from other tools.
In short: Onward stores the account and habit data you give it so the app works. We don't sell your data, we don't show ads, and we don't use third-party advertising or analytics trackers. You can export or delete your data at any time.
Information we collect
Account information
When you create an account, we collect your email address. If you sign in with Google or Apple, we receive the basic profile information you approve them to share, such as your name and email address. If you sign in with an email and password, your password is stored only as a salted hash — never in plain text, and never visible to us.
Your habit data
This is the content you create in Onward: your habits and the names, colors, sections, and tags you use to organize them, each habit's start date, and your daily records of completed or skipped days. We also process your device's time zone so that completions are recorded on the correct day for you.
Share links
If you create a read-only share link, we store the name you give it, which habits it exposes, and any expiry you set. The link itself is a secret URL: anyone who has it can view the habits you chose to share, without signing in. You can revoke or regenerate a link at any time in Settings.
Connected apps (MCP)
Onward lets you connect AI assistants and other Model Context Protocol (MCP) clients so they can read or update your habits on your behalf. When you connect one, we store the client's registration details and issue access and refresh tokens. Those tokens are kept only in hashed form, and access tokens are short-lived. A connection can only do what you approved it to do, and Onward always ties data to your account from the token — never from a user identifier an app supplies.
Technical and security information
To keep your account secure and the service reliable, we process your IP address, a session cookie that keeps you signed in, a limited security audit log of sensitive actions, rate-limiting counters, standard server logs, and aggregate service metrics such as account, habit, completion, share-link, and valid share-view counts. These aggregate metrics do not include account or content identifiers. We use a small number of strictly necessary cookies for sign-in and sessions only — no advertising or tracking cookies.
How we use your information
- To provide, maintain, and improve Onward and its features.
- To authenticate you and keep you signed in.
- To protect the service — detecting and preventing abuse, fraud, and security incidents.
- To respond to your requests and support questions.
- To comply with legal obligations.
We do not sell your personal information, use it for advertising, or use third-party advertising trackers or client-side behavioral analytics tools.
Legal bases (EEA/UK)
If you are in the European Economic Area or the United Kingdom, we rely on these legal bases: performance of a contract to provide the service you sign up for; our legitimate interests in keeping Onward secure and preventing abuse; your consent where you choose optional features such as signing in with a third-party provider; and compliance with legal obligations where the law requires it.
How your information is shared
We share information only in these limited ways:
- Sign-in providers. If you choose to sign in with Google or Apple, you authenticate with them and they share basic profile information with us.
- Service providers. We use infrastructure providers — such as cloud hosting and content-delivery networks — that process data on our behalf to run the service, under confidentiality obligations.
- People you share with. If you create a share link or connect an app, the data you choose to expose is shared as you directed.
- Legal reasons. We may disclose information if required by law or to protect the rights, safety, or property of our users or the public.
We never sell your data or share it with advertising networks or data brokers.
How long we keep your information
- Account and habit data are kept for as long as your account is active. Archived habits keep their history until you delete them.
- Sign-in sessions expire after about seven days.
- Connected-app access tokens are short-lived (about 15 minutes).
- Security audit records are retained for about 180 days.
When you delete your account or specific data, we remove it from our active systems, and from routine backups in the ordinary course.
Your rights and choices
You can:
- Access, correct, and export your habit data.
- Delete individual habits, share links, and connected apps yourself in the app.
- Delete your account, which removes your personal data as described above.
Depending on where you live, you may also have the right to object to or restrict certain processing, and to lodge a complaint with your local data protection authority. To make a request, email us at [email protected]. We will respond within the time required by applicable law.
How we protect your information
Onward is served exclusively over encrypted HTTPS connections. Passwords and access tokens are stored as hashes, signing keys are encrypted at rest, and we apply same-origin and cross-site request protections along with rate limiting to guard against abuse. No method of transmission or storage is ever completely secure, but we work to protect your information using measures appropriate to its sensitivity.
Children's privacy
Onward is not directed to children under 13 (or under 16 in the EEA), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, please contact us and we will delete it.
International users
Onward is operated by Smirnov Labs, LLC in the United States. If you use Onward from outside the United States, your information will be processed in the United States and in other countries where our infrastructure providers operate, which may have different data protection laws. Where required, we take steps to ensure your information receives an appropriate level of protection when it is transferred.
Changes to this policy
We may update this policy from time to time. When we do, we will revise the "Last updated" date above, and for material changes we will provide a more prominent notice. Your continued use of Onward after an update means you accept the revised policy.
Contact us
If you have questions about this policy or how your information is handled, contact Smirnov Labs at [email protected].