GoalGo

Legal

Privacy Policy

GoalGo has no accounts and no server of its own. This page explains, in plain words, what stays on your iPhone, what leaves it and why, and what the website collects.

Last updated:

Summary

  • Your goals, habits, checklists, notes, lists, to-dos and logs are stored in a database on your iPhone. They are never sent to us.
  • There is no account, no sign-up and no email address in the app.
  • If you turn on iCloud sync (Premium), a copy goes to your own private iCloud database. Apple hosts it; we cannot read it.
  • The app sends anonymous product analytics and crash diagnostics, tied to a random per-install identifier, to PostHog (EU) and Firebase Analytics (without the advertising identifier). No advertising, no cross-app tracking, no sale of data.
  • Purchases go through Apple. RevenueCat validates them for us using an anonymous ID. We never see your card.
  • The website uses privacy-friendly analytics that run without cookies until you accept them, and stores the email you give us on the Android waitlist for that one purpose.

Who we are

Palapa Sp. z o.o. ("we", "us"), Młynarska 42/115, 01-171 Warsaw, Poland, operates the GoalGo iPhone application (the "App") and the website at goalgo.app (the "Website"). We are the data controller for the processing described here. Contact: goalgo@palapa.tech.

Data that stays on your device

Everything you create in GoalGo is written to a local SQLite database inside the App's own storage on your iPhone: goals and their targets, progress logs, checklist steps, notes, habits and their schedules, completion logs, lists, to-dos, archive and Momentum events. The App has no backend; there is no copy of this data on any server we operate.

  • Backups you export. Settings → Export a backup writes a single file containing all of the above. You choose where it goes (Files, AirDrop, a cloud drive) and you are responsible for it from there. Importing a backup reads such a file back in.
  • Device backups. The App's database is included in your normal iPhone backups (iCloud Backup or a computer), which are governed by Apple's terms, not ours.
  • Widgets. A small snapshot of what the home screen widgets display (titles, counts and progress, about 1 KB) is shared between the App and its widget extension on the device. It never leaves the phone.
  • Deleting. Settings → iCloud sync → Delete all data removes every goal, habit, list, log and note from the device (and from your iCloud if sync is on). Deleting the App removes its local database.

iCloud sync (optional, Premium)

If you turn on Sync with iCloud, the App uses Apple's CloudKit to keep a private copy of your data in the private database of your own iCloud account, so your other iPhones signed into the same account stay in step. This data is encrypted and hosted by Apple, is subject to Apple's privacy policy, and is not accessible to us. Sync is additive: nothing is ever deleted to make devices match, except when you use Delete all data, which propagates the deletion. Silent push notifications from Apple wake the App to fetch changes; they carry no content. You can turn sync off at any time in Settings → iCloud sync.

Analytics and diagnostics

To understand which features are used and to find crashes, the App sends product analytics and diagnostics to two providers. Neither receives the content you write: goal titles, habit titles, notes, checklist steps, to-dos and list names never leave the device.

PostHog (EU)

  • What: around fifty named product events (for example "goal created", "habit completed", "paywall shown") with technical properties such as app version, build, iOS version, device model, language, whether Premium is active, and the type of goal or schedule involved; screen views; crash and error reports captured automatically; and, where enabled in our project settings, session replays of how the App's screens are used, with text content masked.
  • Identifier: a random identifier generated for your installation (Apple's identifierForVendor), used as the analytics distinct ID. It is not your name, email, phone number or advertising ID.
  • Where: PostHog's EU region (eu.i.posthog.com), operated by PostHog Inc. under its privacy policy.

Firebase Analytics (Google)

  • What: the same set of product events and standard app-lifecycle events (first open, session start, app update), plus device and OS information.
  • Identifier: the same per-install identifier as above and Firebase's own app-instance ID. We use the variant of the Firebase SDK that does not collect the advertising identifier (IDFA), and the App never shows Apple's App Tracking Transparency prompt because it does not track you across apps or websites.
  • Where: Google LLC, under the Google privacy policy and Firebase's data processing terms.

This data is used for product analytics and for keeping the App working. It is not used for advertising, not combined with data from other companies, and not sold.

Purchases

GoalGo Premium is sold through Apple's App Store. Apple processes the payment and holds your payment details; we never receive them. To know which features to unlock, the App uses RevenueCat, which receives your App Store receipt and an anonymous RevenueCat app-user ID (not your Apple ID or name) and returns your entitlement status. RevenueCat, Inc. processes this under its privacy policy. The in-app "Rate the app" prompt is Apple's standard review sheet.

Notifications

The App asks for permission to show notifications and, if granted, schedules them locally on your device: one reminder per habit at the time you choose, and an occasional evening nudge when your Momentum is cooling. No notification content is sent to a server. The only remote notifications the App receives are silent ones from Apple that trigger iCloud sync. Notifications is the only system permission the App requests: no camera, photos, location, contacts, calendar, microphone or health data.

Feedback you send

Settings → Give us feedback lets you type a message and send it. That message, together with the technical properties above, is delivered to us as an analytics event through PostHog. Please don't include personal or sensitive information in it. If you email us instead, we keep the email for as long as needed to answer and follow up.

What we do not collect

  • No account, name, email address, phone number or password (there is nothing to log into).
  • No location, contacts, calendar, photos, microphone or health data.
  • No advertising identifier and no App Tracking Transparency prompt; no ad networks in the App.
  • No content you write: goal and habit titles, notes, checklists, to-dos and lists stay on the device (and in your own iCloud if you sync).
  • No AI or machine-learning processing of your data, on device or off.
  • We do not sell personal data and do not share it with data brokers.
  • Performance of a contract (Art. 6(1)(b)): purchase validation and entitlements, iCloud sync you enable, notifications you set up, answering your support requests.
  • Legitimate interests (Art. 6(1)(f)): aggregated product analytics and crash diagnostics to keep the App working and decide what to build, pseudonymised with a per-install identifier and never used for advertising. You can object at any time (see Your rights).
  • Consent (Art. 6(1)(a)): Website analytics cookies and the Android waitlist email, both of which you opt into and can withdraw.

Retention

  • Data on your device: until you delete it or the App.
  • iCloud sync data: in your iCloud until you turn sync off and use Delete all data, or delete it via Apple.
  • PostHog analytics events: retained for up to 12 months, then deleted or aggregated.
  • Firebase Analytics: user-level data retained for 14 months by default, then deleted.
  • RevenueCat entitlement records: for the life of the subscription and as required for accounting.
  • Support emails and feedback messages: until the matter is closed, then up to 24 months.
  • Android waitlist emails: until the Android release notification is sent, or until you ask us to remove yours.

Your rights

Under the GDPR you may ask for access to, correction or erasure of personal data we hold, restriction of or objection to processing, and portability. Because your goals and habits live on your device, the fastest way to exercise most of these is inside the App: export a backup (portability) or use Delete all data (erasure). For analytics data tied to your installation identifier, or anything else, email goalgo@palapa.tech; we may ask for the identifier shown under Settings → About to find your records. You also have the right to lodge a complaint with your supervisory authority, in Poland the President of the Personal Data Protection Office (UODO).

International transfers

PostHog data is stored in the European Union. Google (Firebase) and RevenueCat process data in the United States and elsewhere under the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. Apple processes iCloud data under its own terms.

Children

GoalGo is not directed at children under 13 (or the age of digital consent in your country, up to 16 in parts of the EU) and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

The goalgo.app website

  • Analytics. The Website uses PostHog (EU) to count visits and see which pages help people. Until you accept the cookie banner, or if you decline it, PostHog runs in cookieless mode: no cookies, no local storage, no persistent identifier, and a server-side hash that rotates daily. If you accept, PostHog sets first-party cookies so return visits can be recognised. Change your choice any time via "Cookie settings" in the footer. Session replay is not used on the Website.
  • Consent cookie. Your accept/decline choice is stored in a first-party cookie (goalgo_consent) for 12 months so we don't ask again.
  • Android waitlist. If you enter your email on the download page, it is stored by our hosting provider (Netlify) and used to send one notification when GoalGo for Android is released. Email us to be removed earlier.
  • Hosting logs. The Website is hosted on Netlify, which keeps standard server logs (IP address, user agent, requested URL) for security and operations for a limited period under its privacy policy.
  • Links to the App Store. Following a link to Apple's App Store takes you to Apple's site, governed by Apple's privacy policy.

App Store privacy label

In Apple's privacy nutrition label GoalGo declares: Usage Data (product interaction) and Identifiers (a per-install device ID) for analytics; Diagnostics (crash data) for app functionality; and User Content(the feedback message you choose to send) for app functionality. All are linked to the installation identifier, none are used to track you.

Changes to this policy

We will post any changes on this page and update the date at the top. Material changes, such as a new category of data or a new provider, will also be announced in the App's release notes.

Contact

Palapa Sp. z o.o., Młynarska 42/115, 01-171 Warsaw, Poland. Email: goalgo@palapa.tech.