Privacy Policy

Last updated 2026-10-05

This policy explains what the hosted GoalNexa service collects, why, and what you can do about it. Nguyen Xuan Binh is responsible for this data. We don't sell it, and we don't use it for advertising.

What we collect

  • Account: your name, email address and password (stored only as a one-way hash).
  • Sign in with Google: if you use it, Google tells us your name, your email address, whether Google has verified that address, and an ID that stays the same for your Google account. We use these only to sign you in, create your account the first time and keep it linked to your Google account. We don't receive your Google password, and we don't access your Gmail, Drive, contacts, calendar or anything else in your Google account.
  • Your content: goals, metrics, check-ins, notes, organizations, memberships and invitations (including the email addresses you invite).
  • Access: personal access tokens and connected apps you create for AI assistants (stored hashed), and your roles and permissions.
  • Billing: when you subscribe, Paddle sends us your customer and subscription ids, the plan, and the subscription's status and dates. We never see or store your card details - Paddle handles payment.
  • Technical: IP address and request details in server logs, used for security and rate limiting, kept for a limited time.

Cookies and local storage

One essential cookie keeps you signed in (an HTTP-only refresh token). The browser's local storage remembers a few display preferences (e.g. the organization picked on the dashboard, the sidebar's state). No analytics or advertising cookies.

Why we use it

To provide the Service you signed up for (contract), keep it secure and prevent abuse (legitimate interest), handle billing and meet legal and tax obligations, and answer you when you contact us.

Who else processes it

  • DigitalOcean - hosting and database.
  • Paddle - our reseller and Merchant of Record: checkout, payments, tax and invoices for paid plans, under Paddle's privacy policy.
  • Google - only if you choose "Sign in with Google": Google confirms who you are, under Google's privacy policy.
  • Google Fonts and jsDelivr - the site's font and style files are loaded from these CDNs, which see your IP address.
  • AI assistants you connect - only if you connect one, it reads and changes your data on your behalf, under that provider's own terms.

These providers may process data outside your country, with the safeguards the law requires.

GoalNexa's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We never sell it, use it for advertising, or let anyone read it except to run the Service, for security, or where the law requires. You can disconnect GoalNexa from your Google account at any time on your Google account's connections page; deleting your GoalNexa account removes the link from our side too.

Who in GoalNexa sees it

Personal goals are yours. Organization goals are visible to the organization's members, or only to the people you choose for a private goal. Members of your organizations see your name and email.

How long we keep it

While your account exists. When you ask us to delete your account we delete your content within 30 days (backups roll off after that), except billing records we must keep for tax law.

Your rights

You can see and export your data through the app and its API, correct it in the app, and ask us to delete your account or object to a use of your data. Email xuanbinh91@gmail.com. You can also complain to your local data-protection authority.

Changes

We'll update the date above when this policy changes and tell account holders about material changes. See also the terms of service.