Privacy Policy

1. Scope

This policy applies to the GoalZen websites, web application, mobile applications, APIs, and related services operated by Amanix Labs.

2. Information we process

Account information

We process your email address, authentication identifiers, and any profile name or avatar you choose to provide. Authentication is currently provided through Supabase.

Learning and planning content

We store the information you add to GoalZen, including goals, tasks and when you complete them, habits, roadmaps, learning content, notes, answers, focus sessions (when you used the Focus timer, for how long, and on which task), progress, review history, reminders, and feedback.

Settings and integrations

We process preferences, notification settings, push-subscription details, and the identifiers or credentials needed for integrations you explicitly connect. Connected services receive only the information required for the action you request.

Location for sun times (optional)

If you set a routine, habit or reminder by sunrise or sunset, you choose a place: either a city you search for (the search runs against a city list on our own server) or your device’s approximate location, asked for once. We store only the coordinates rounded to two decimals (about 1 km) and the city’s name, to work out sunrise and sunset for you. We never store your exact position or track it over time; you can change or remove the place in Settings at any time.

Payments and communications

If paid plans are enabled, Paddle processes payment and billing details. GoalZen receives subscription and transaction status rather than full payment-card details. We also process email addresses submitted to a waitlist or support request.

Technical and usage information

Servers may record IP address, device or browser information, timestamps, requested routes, and error information for security and reliability. The public website may use PostHog for limited product analytics when configured; private learning content should not be intentionally included in analytics events.

3. Why we use information

• Provide authentication, synchronization, learning paths, reviews, progress, reminders, and connected features.
• Secure accounts, prevent abuse, diagnose failures, and maintain the service.
• Respond to support requests and communicate important service changes.
• Process subscriptions and enforce applicable plan limits.
• Understand whether core product flows work and improve them.
• Comply with law and protect the rights and safety of users and the service.

4. Service providers and sharing

Information is processed by the providers on the subprocessors page: Supabase for authentication and the database, Vercel for hosting, Resend for the emails we send, the browser vendors’ push services if you turn on notifications, Paddle for billing once paid plans go live, and PostHog for a few product events (such as “signed up”) tied to a pseudonymous account id, never to your goals or notes. Services you deliberately connect, such as NestMarks or a work tool like Jira, receive only what the action you request needs. We may also disclose information when required by law or during a business reorganization with appropriate safeguards.

We do not sell personal information. We do not use private learning content to build advertising audiences.

5. Cookies and browser storage

GoalZen sets no cookies of its own. The web app keeps you signed in with a Supabase session stored in your browser’s local storage, not a cookie, and it is removed when you sign out. Nothing on this site or in the app is used to track you across other websites.

This website keeps two small, local-only values if you use them: your light or dark appearance choice, and, when you arrive from a tagged launch link, the tag of that link for the rest of the tab session so a waitlist signup counts for the right post. Neither leaves your browser except as the one-word source on a waitlist signup.

Videos in our guides are click-to-load: until you press play, the page shows a button drawn by this site and makes no request to YouTube. When you press play, the video loads from YouTube in its privacy-enhanced mode (youtube-nocookie.com), and from then on Google’s privacy policy applies to that video. No YouTube cookies are set before you press play.

Analytics today runs on our servers, not in your browser: no tracking script loads and no page views are recorded. The website carries a dormant PostHog client that stays off until we set its key. If we turn it on, it is configured to run cookieless: it would record page views and a few button clicks against a random id held in memory for the tab, with no cookie, no local storage, no session recording and no capture of what you type. Any tracker that stores something in your browser would be switched on only after a consent banner is in place, with declining as easy as accepting, and this page would be updated first.

6. AI-assisted features

If an AI-assisted feature is enabled, the interface should identify the provider and the material being sent before it is submitted. AI suggestions are intended to be reviewable before they change authoritative data. Do not submit confidential or regulated information unless the displayed provider terms are acceptable to you.

7. Retention and security

We keep account data while your account is active and retain limited records afterward only when reasonably required for security, fraud prevention, dispute resolution, backups, or legal obligations. We use access controls and technical safeguards appropriate to the type of data, but no online service can guarantee absolute security.

8. Your choices

• Access and update profile information and product preferences.
• Disconnect integrations and revoke notification permission.
• Export supported data from available account tools.
• Request correction or deletion of your account and associated data.
• Analytics: there is no non-essential cookie or browser tracker to opt out of today, so no opt-out control is shown. If one is ever added it will be off until you accept it, and this policy will say so.

See the account deletion page or contact [email protected].

9. Children

GoalZen is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Local minimum-age rules may be higher.

10. International processing

Providers may process information in countries other than your own. Where required, we rely on appropriate contractual or legal safeguards for international transfers.

11. Changes and contact

We may update this policy as the product and its providers change. Material changes will be reflected by the updated date and, when appropriate, an in-product notice.

Privacy questions: [email protected]
Operator: Amanix Labs