Privacy Policy · Goalloom

Your workspace stays on your device

Tasks, descriptions, goals, relationships, calendar settings and history are stored in a local SQLite workspace. Local backups, exports, preferences and caches can also remain on your computer. You can use the local board without a cloud account.

Goalloom does not send task content as product telemetry or use advertising trackers. Local databases, exports and backups are not made encrypted merely by enabling encrypted sync; protect your device and any copies you share.

Apple / Google sign-in and your account

Apple or Google and Supabase process account identifiers, email, basic profile information when provided, and sessions. Sign-in can identify you for optional AI as well as sync; it does not itself authorize upload, activate AI, start a trial or prove payment. We do not receive your Apple or Google password.

The current login requests basic identity, email and profile access, not Gmail, Google Drive or Google Calendar access. Google account data is not sold, used for advertising or used to train AI models. Its use and transfer follow the Google API Services User Data Policy, including the Limited Use requirements.

Optional encrypted sync

When you enable sync, your device encrypts workspace operation payloads before sending them to Supabase. The service stores encrypted payloads and the account, device, workspace, sequence, authorization, usage and timing metadata needed to synchronize them. End-to-end encryption protects payloads, not this operational metadata. Network infrastructure can also process IP addresses and request logs.

Authorized devices hold the keys needed to open your workspace. Supported synced preferences may include encrypted AI credentials; ordinary workspace exports and backups exclude those credential records. The service does not receive your sync password as plaintext or your device private keys. Losing required credentials can make encrypted data unrecoverable.

Optional AI features

BYOK requests use your configured OpenRouter or Vercel AI Gateway key. Where an explicitly enabled client supports Goalloom-hosted AI, sign-in and account-bound consent are required before relevant task input, goals, descriptions or bounded activity context is sent through Goalloom to OpenRouter: TypeSafe/Jev handles smart input, DeepInfra handles drafts and reviews, and DeepSeek runs DeepSeek V4.1 Flash 1017 for note rewrites. DeepSeek may retain submitted content and use it for model training. The macOS 1.11.0 client supports this hosted source when service eligibility and consent permit it; the older Windows client does not offer Plus billing. Providers process readable context; this is not sync end-to-end encryption.

Goalloom processes AI content within the original request without persistent server storage. Results are returned once and cannot be downloaded again; only necessary call, cost and security metadata is kept. Removal of the old encrypted cache does not prove immediate physical erasure from infrastructure logs, replicas or backups.

The device may keep unadopted AI drafts, review summaries and their fingerprints in bounded local caches, including after sign-out. Local copies and provider processing have separate retention boundaries. Provider retention and training practices follow their policies; Goalloom does not promise zero retention by every processor.

Website, previews and updates

The website uses Vercel hosting and does not install advertising or analytics scripts. It remembers your chosen theme in browser local storage. Hosting infrastructure may process IP addresses, requested URLs, browser information, timestamps and security logs to deliver and protect the site.

The desktop app can request public page metadata and images for link previews, and contact GitHub release infrastructure for update checks and downloads. Those destinations see normal network request information and, for previews, the requested URL. Following an external link subjects that visit to the destination’s policies.

Retention and deletion

Local data and copies remain under your control until you remove them. Hosted account information and encrypted workspace records are retained to provide sync until deleted. Security, support and infrastructure records are retained as needed for their purpose or legal obligations; deleted data may remain in routine backups until those copies expire. We do not promise immediate erasure of every backup.

Signing out, uninstalling the app or revoking Google access does not by itself delete hosted data. Deleting a task is not the same as deleting its sync history, backups or account. To request deletion of the hosted account and associated workspace data, contact us using the email below. Copies already on other devices or in your own backups need separate removal.

The finalized Plus launch policy provides 30 days from the end of all valid trial, paid and grace access. Retrieval closes at the deadline and online deletion finishes within 7 additional days; later purchases cannot restore the old copy. Explicit deletion instead stops access immediately and deletes online data within 7 days. After online deletion, restricted disaster-recovery copies may remain until they expire under the applicable infrastructure provider’s retention policy. Local copies and hosted-AI retention have separate boundaries. These Plus services are available through the supported macOS client; Windows Plus is deferred.

Your choices and requests

You can keep using the app locally, disable optional AI features, sign out of sync, export your workspace, manage local copies, and revoke Google access in your Google Account. Depending on applicable law, you may request access, correction, deletion, restriction, objection or a portable copy of personal information we hold, and contact your local data protection authority. Email us to make a request; encryption limits what we can inspect or recover.

Goalloom is not directed at children under 13. If you believe a child has provided personal information to the hosted service, contact us so we can investigate and handle deletion as appropriate.

Changes to this policy

We will update the date on this page when practices change. Material changes will be described on the website or through an appropriate product notice. A policy update does not automatically enable optional data sharing or grant new access permissions.

Payments and subscription information

macOS Goalloom starts web purchases through Stripe; RevenueCat aggregates verified payment facts. Windows Plus and iPhone purchases are deferred. These informational pages do not load payment SDKs or send payment requests.

For enabled purchase channels, providers may process payment method information, transaction/subscription identifiers, purchase source, amounts, currency, billing periods and account-binding metadata needed for billing, verification and support. Payment metadata must not contain task text, prompts, sync passwords or API keys. We do not claim that every form of payment information bypasses Goalloom.

Cloud data after access ends

Cloud copies are retained for 30 days after all valid trials, paid access and applicable grace periods end. Cancelling renewal alone does not start this period. New cloud uploads and built-in AI stop during retention. Restricted retrieval of existing cloud data requires account authorization and the necessary sync password or other decryption credentials. Goalloom cannot replace lost decryption credentials.

Renewing during retention can resume use of a cloud copy that has not been deleted. At the 30-day deadline, retrieval closes and online deletion begins. Online deletion completes within a further 7 days. Subscribing after the deadline cannot restore that copy, even if deletion is still in progress. Sync must be rebuilt from data you kept.

Ordinary expiry, refunds and payment disputes use the same 30-day cloud-retention period. Subscription expiry does not delete local tasks, local history or backups you keep yourself.

Restricted retrieval creates a separate local copy without resuming sync or uploading changes. Replacing your current workspace requires an explicit choice and a protective local backup. Account sign-in alone cannot decrypt the copy; the necessary decryption credentials stay on your device.

Account settings show service and retrieval deadlines and online-deletion status. Necessary reminders appear only inside Goalloom, without interrupting local editing. They do not extend a deadline. No email or system push notifications are sent.

Deleting an account or cloud data

An explicit deletion request does not receive the ordinary 30-day retention period. After a valid request is confirmed, the relevant cloud access stops immediately. The relevant online content and, when requested, the account are deleted within 7 days. Export anything you need first. Resubscribing cannot restore deleted content. You manage local data on your devices.

When you delete the entire account, we also process cancellation of web renewal. Apple subscriptions do not automatically cancel when a Goalloom account is deleted; turn off renewal in Apple's subscription settings. You can request immediate account deletion without waiting for a subscription to expire. Deleting only cloud data does not cancel your account or subscription. Deletion does not itself refund unused time, except where applicable law or purchase-platform rules require otherwise.

Limited records after deletion

Stripe or Apple processes payments for the relevant channel. RevenueCat helps verify subscriptions, and Goalloom uses those facts to manage account access. We process necessary account links, orders, amounts, currencies, taxes and subscription states. We do not send task content, AI inputs or sync passwords to payment or subscription-verification services, or store full card numbers or security codes.

Under the launch policy, restricted disaster-recovery copies may remain after online deletion until they expire under the applicable infrastructure provider’s retention policy. They are not an account-recovery or continuing-service feature. Infrastructure restores must reapply deletion records before access resumes so deleted content does not become accessible again. This does not mean underlying media are physically erased when a request is made.

Necessary orders, invoices and payment-processing records are retained for 7 years after the relevant transaction or accounting adjustment for accounting, tax, disputes and legal obligations, or longer where law requires. Pseudonymized trial-claim and account-abuse records are retained for up to 180 days after account deletion, without task content or device fingerprinting. Records specifically required for a dispute or legal obligation may remain until that matter and its applicable retention period end.

Keeping necessary billing or protection records does not justify keeping the full task account or all task content. The privacy policy separately explains AI requests and results; sync-copy retention does not replace those data rules.

Contact

For private billing, privacy, account or deletion requests, contact the support email below. Do not publish personal billing information in GitHub issues. The operator may verify account ownership; do not send passwords, sync secrets, API keys or full payment credentials.

hellojimmywong.ai@gmail.com