CraveKit is designed to keep your private habit journal on your own device. The public craving-support tool requires no account; a local journal requires a passphrase, and neither your urge logs nor private notes are transmitted to the billing service.
Habits, craving logs, check-ins, triggers, notes and settings are stored in your browser. Before saving a personal entry, you must create a private passphrase; the journal is encrypted. Prior-version unencrypted entries remain on the device until the migration successfully encrypts them. After setup, the browser derives a key from your passphrase using PBKDF2-SHA256 and encrypts entries using AES-256-GCM. The key stays in memory while unlocked. We cannot recover a lost vault passphrase. A compromised device or unlocked browser can still expose entries; the implementation has not undergone an independent security audit.
When subscriptions are configured, registration and sign-in require an email address and a password. The billing server keeps the email, a salted password hash, session-token hashes, and Stripe customer/subscription identifiers and status. It does not receive your habit journal. Stripe hosts checkout and payment-method updates and processes payment information under its own privacy terms. We do not store card numbers. Billing may reveal your email and CraveKit subscription to the payment processor.
You can export an encrypted on-device backup. Backups exported by an older app version may be unencrypted; protect or delete any existing copies yourself. You can erase all local habit entries under More. This does not cancel a subscription or delete the billing account; use Manage billing for cancellation and contact the app operator to request billing-account deletion. Erasing browser data or switching devices can destroy unsynced entries. There is no cloud journal sync.
Optional quitlines or health resource links lead to external services with their own policies. This application is not medical treatment. A public launch must include the operator's legal business identity, contact information, final disclosures and any required jurisdiction-specific notices before accepting real payments.
Draft app privacy disclosure updated October 20, 2026. Complete business contact and legal review required before public commercial release.