Last updated 21 October 2026

Privacy policy

Gooals ("we") is a plan and goal tracker. This policy explains what we collect, why, and the choices you have. We follow UK GDPR, the Data (Use and Access) Act 2025 and the ICO Age Appropriate Design Code. Gooals is for people aged 16 and over.

What we collect

• Account: your email address or the identifier from Sign in with Apple or Google, and an age band (not your date of birth).
• Plans and progress: plans you import or create, their versions, scheduled items and what you log (done, partial, skipped with an optional reason, and values such as minutes or reps).
• Profile facts: answers you choose to save for reuse (for example equipment or subjects). Health-adjacent facts (weight, injuries, dietary needs, skin conditions) are special-category data: we ask for explicit consent at the point of asking, flag them as sensitive, and you can delete each one.
• Preferences: units, timezone, week start, reminder settings.
• Usage analytics: first-party events (for example "plan saved") to improve the product. No ad or attribution SDKs. You can opt out in Settings.

Assistants and the connector

If you connect ChatGPT, Claude or another assistant, it can read your plans and progress and create and update plans, only for plans marked Me and not hidden from AI. Sensitive profile facts are never shared with assistants. Assistants cannot change what you logged; plan changes arrive as suggestions you accept or reject. You can revoke each connection in Settings → Connections, and every connector write is logged there.

Why we process it

To provide the service (contract), to keep it secure and improve it (legitimate interests), and for special-category data, your explicit consent (Article 9(2)(a)). We do not sell data or use it for advertising. Health data is never used for advertising.

Where it's stored

Data is stored in the United States (US East) with Supabase (our processor) under a data processing agreement. Transfers of UK data to the US are covered by the UK International Data Transfer Addendum and Standard Contractual Clauses. Security includes row-level security on every table, encryption in transit and at rest, and per-connection OAuth tokens.

Your rights

Export everything as JSON in Settings → Privacy, delete individual facts, hide plans from AI, and delete your account in the app at any time. Deletion removes your plans, logs and connections. You can also contact us to exercise any UK GDPR right, or complain to the ICO.

Not medical advice

Gooals is not a medical device. Plans come from your AI assistant; check anything health-related with a professional.

Contact

privacy@gooals.ai