Goalzen is operated by James Drummond trading as Goalzen, who is the data controller for the personal data described in this policy. This policy explains what we collect, why we collect it, who we share it with and what rights you have.

You can reach us about anything in this policy at [email protected].

• Account data - your first and last name, email address, timezone and a hashed version of your password. We never store your password in readable form.
• Content you create - the contexts, goals, sub-goals, tasks, notes, links, tags and file attachments you add to the Service.
• Subscription data - your plan, billing cycle, renewal date and subscription status, together with the Stripe customer and subscription identifiers. Card numbers are held by Stripe, not by us.
• Usage data - how you use the app, including AI request counts against your plan allowance, plus standard technical data such as IP address, browser and device type held in server logs.

• To provide the Service - creating your account, storing your goals and tasks, and generating AI analysis. Lawful basis: performance of our contract with you.
• To take payment - managing trials, subscriptions and renewals. Lawful basis: performance of our contract, and our legal obligations for tax and accounting.
• To send service emails - task reminders, password resets and important notices about your account. Lawful basis: performance of our contract.
• To keep the Service secure and improve it - analytics, diagnostics and abuse prevention. Lawful basis: our legitimate interest in running a reliable product.

We do not sell your personal data, and we do not use the content of your goals, tasks or notes for advertising.

When you ask Goalzen to analyse a goal, chat about it or suggest an action plan, the relevant text is sent to our AI provider so the response can be generated. Only what is needed for that request is sent. Please avoid putting sensitive personal information, credentials or confidential third party material into goals, tasks or notes.

We share personal data only with the service providers who help us run Goalzen, and only so far as they need it:

• Stripe - Payment and subscription processing. Stripe handles your card details directly; we never see them.
• OpenAI - Generating goal research, suggestions, action plans and chat responses from the goal text you submit.
• Amazon Web Services - Hosting, storage of files you attach to notes, and delivery of service emails such as task reminders and password resets.
• PostHog - Product analytics - understanding which features are used, so we can improve them.
• Google Analytics - Website analytics for our public marketing pages.

We may also disclose data where the law requires it, or to establish or defend legal claims. Some of these providers are based outside the UK and EEA; where that is the case, transfers are covered by the safeguards those providers offer, such as standard contractual clauses.

The app stores a login token in your browser's local storage so you stay signed in - it is essential to the Service and cannot be turned off while you are logged in. Our marketing pages use Google Analytics, and the app uses PostHog, to understand how the product is used.

You can block analytics cookies through your browser settings or a browser-level do-not-track / ad-blocking extension, and the Service will continue to work normally.

We keep your account and content for as long as your account is open. If you close your account we delete or anonymise your personal data within a reasonable period, except where we must keep records for longer - billing records, for instance, are retained to meet tax and accounting obligations. Backups are overwritten on a rolling basis.

Passwords are stored hashed, traffic is encrypted in transit, and access to production systems is restricted. No online service can promise perfect security, but we take reasonable technical and organisational measures to protect your data, and will notify you and the relevant authority if a breach affecting you occurs.

Depending on where you live, you have the right to access the personal data we hold about you, to have it corrected or deleted, to object to or restrict how we process it, to receive a copy in a portable format, and to withdraw consent where we rely on it. You can exercise most of these directly in the app, or by writing to [email protected].

If you are in the UK or the EEA and you are unhappy with how we have handled your data, you may complain to your data protection authority - in the UK, the Information Commissioner's Office.

Goalzen is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy as the Service evolves. The date at the top of this page shows when it last changed, and we will tell you through the Service or by email if a change materially affects you.

Privacy questions and requests should go to [email protected], addressed to James Drummond trading as Goalzen.