Privacy Policy

TCHR Labs ("we", "us", or "our") operates the Goaltree web app and mobile applications. This policy explains what data we collect, how we use it, and your rights regarding that data.

1. Information we collect

Account information

When you sign up we collect your email address and display name. You can sign in with Google, with Apple, with an email and password, or with a one-time magic link. If you set a password, it is stored only as a salted hash — never in plain text. If you use Google or Apple sign-in, we receive your email, name, and (where available) profile photo from that provider.

Goal and task data

We store the goals, milestones, targets, tasks, and habits you create, along with completion timestamps and progress data. This data is associated with your account and used to power the app experience.

Photos and generated media

If you upload a profile photo, or generate vision-board images and videos, those files are stored on our infrastructure and associated with your account.

Location (optional)

If you grant location permission, we store your approximate location to power location-aware coaching — for example, suggesting nearby places to make progress on a goal. Nearby-place lookups use OpenStreetMap's Overpass API. Location is never required; you can decline or revoke it at any time in your device or browser settings.

Usage and analytics

We collect standard server logs (IP address, browser type, pages visited, timestamps) and product-analytics events (features used, screens viewed), handled by PostHog, to operate, secure, and improve the service. This data is not sold or used for advertising.

Device and diagnostics

On the web and mobile apps we collect device/browser information and error reports for crash reporting and performance monitoring, via Sentry.

Payments

Web subscriptions are processed by Polar. Mobile subscriptions are processed as Apple or Google in-app purchases via RevenueCat. We never receive or store full card numbers — only a billing token and your subscription status.

2. How we use your information

• To provide, personalise, and improve the Goaltree service
• To generate AI goal breakdowns, coaching, daily task surfaces, and vision-board images/videos from your content
• To send transactional emails (magic links, password resets, subscription receipts)
• To detect and prevent abuse or security incidents
• To analyse aggregate usage trends

We do not sell your personal data. We do not use your goal content for advertising targeting.

3. AI processing

When you create or replan a goal, chat with the coach, use voice capture, or generate vision-board media, the relevant content (such as goal titles, categories, messages, and prompts) is sent to AI providers to produce a result. We use Groq and xAI for text generation (routed through Cloudflare's AI Gateway) and Cloudflare Workers AI for image and video generation. Voice input is transcribed on your device — only the resulting text is processed. We do not use your content to train AI models, and these providers process it only to return results to you.

4. Sharing with third parties

We share data only with the following categories of service providers, and only to the extent necessary to operate the service:

• Convex — database, real-time backend, and file storage
• Cloudflare — web hosting, content delivery, AI gateway, and image/video generation
• Groq, xAI — AI text processing
• PostHog — product analytics
• Sentry — error and crash reporting
• Polar — web subscription payments
• RevenueCat, Apple, Google — mobile in-app purchases
• Expo, Apple, Google — mobile app distribution and push notifications
• Google, Apple — sign-in, if you choose to use it
• OpenStreetMap — nearby-place lookups for location-aware coaching

We do not share your data with advertisers, data brokers, or ad-targeting platforms.

5. Goal sharing

When you share a goal via its public URL, the goal's title, milestones, targets, and tasks are visible to anyone who opens the link. Shared goals are read-only by default; you can explicitly grant editing access. You can revoke sharing at any time by making the goal private or deleting it.

6. Data retention

Your data is retained for as long as your account is active. If you delete your account, all associated goals and personal data are permanently deleted within 30 days. Anonymised, aggregated statistics may be retained indefinitely.

7. Security

All data is transmitted over HTTPS and encrypted at rest by our infrastructure providers. Passwords, when used, are stored only as salted hashes. Access to production systems is restricted to authorised personnel.

8. Children

Goaltree is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

9. Your rights

Depending on your jurisdiction, you may have the right to:

• Access a copy of the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Data portability

To exercise any of these rights, email privacy@goaltree.ai. We will respond within 30 days.

10. Cookies

We use a first-party cookie (goaltree_session) as a non-sensitive hint to detect whether you are signed in, and PostHog sets a first-party analytics cookie to measure product usage. We do not set third-party advertising cookies.

11. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or via an in-app notice. Continued use of the service after changes take effect constitutes your acceptance of the revised policy.

12. Contact

Questions about this policy? Email us at privacy@goaltree.ai.