Privacy Policy

1. Overview

Goals.Garden is built on the AT Protocol, a decentralized protocol where your data lives in your own repository (PDS). Here's how we handle your information:

• Your goal data and completions are stored both in your AT Protocol repository AND on our backend servers (for indexing and providing the Service)
• Photos and media are stored ONLY in your AT Protocol repository—we do not store copies of your uploaded media
• We collect analytics data through PostHog and Cloudflare to operate and improve the Service

2. Information We Store and Access

Goal Data and Completions (Stored on Our Servers)

We store and index the following data on our backend servers:

• Your AT Protocol identity (DID and handle)
• Your goals and goal metadata
• Your completion records and notes
• Timestamps and completion statistics

This data is stored to provide the Service, enable features like statistics and history, and ensure reliable access.

Photos and Media (NOT Stored on Our Servers)

When you upload photos or other media to goal completions, this Content is written directly to your AT Protocol repository. We do not store, copy, or index your uploaded media on our servers.

Important: Depending on your PDS configuration and sharing settings, uploaded media may be publicly accessible on the AT Protocol network.

AT Protocol Access

We also access your AT Protocol repository to:

• Read and write goals and completions
• Sync data between your repository and our service
• Display your public profile information

3. Information We Collect

Analytics Data

We use PostHog and Cloudflare analytics to understand how the Service is used and to improve it. This may include:

• Page views and feature usage
• User interactions and navigation patterns
• General performance metrics
• Error logs and diagnostics

PostHog may collect additional behavioral analytics data. You can learn more about PostHog's data practices at posthog.com/privacy.

Technical Data

When you access Goals.Garden, we automatically collect:

• IP address (which may indicate general location)
• Browser type and version
• Device information
• Access times

This information is used for security, troubleshooting, and Service improvement.

Authentication Data

We use AT Protocol OAuth for authentication. We receive:

• Your AT Protocol identity (DID)
• Your handle
• Authentication tokens necessary to access your repository on your behalf

We do not receive or store your password.

4. How We Use Information

We use the information we access and collect to:

• Provide and operate Goals.Garden
• Display your goals and track your progress
• Write new goals and completions to your repository
• Improve and develop the Service
• Ensure security and prevent abuse
• Comply with legal obligations

5. How We Share Information

We Do Not Sell Your Data

We do not sell, rent, or trade your personal information.

Service Providers

We use third-party services to operate Goals.Garden:

• Cloudflare: Hosting, CDN, and security services
• PostHog: Product analytics
• AT Protocol infrastructure: Your PDS provider stores your repository data

These providers may process data as necessary to provide their services.

AT Protocol Network

When you share goals publicly, that Content is published to the AT Protocol network and may be accessed by other applications and services on the network. This is inherent to how the AT Protocol works—public content is public across the network.

Legal Requirements

We may disclose information if required by law, legal process, or government request, or to protect the rights, property, or safety of ourselves or others.

6. Data Retention

Goal Data and Completions

We retain your goal data and completion records on our servers for as long as you use the Service. If you delete a goal or completion through Goals.Garden, we delete it from our servers and send a deletion request to your AT Protocol repository.

Photos and Media

We do not store photos or media—these exist only in your AT Protocol repository. Deletion of media depends on your PDS provider's handling of repository updates.

Decentralized Network Considerations

Due to the decentralized nature of the AT Protocol, copies of previously public Content may persist on other services and applications even after deletion from our servers and your repository.

Analytics and Technical Data

We retain analytics and technical data for a reasonable period necessary for the purposes described in this Policy, typically no longer than 12 months for detailed logs, though aggregated statistics may be retained longer.

7. Your Rights and Choices

Access and Control

• You can view and manage your Content directly in Goals.Garden
• You can delete goals and completions through the app
• Your Content lives in your repository, which you control

Account Deletion

You may request deletion of your data from our servers by contacting us. This will remove your goal data and completions from our backend.

Note that:

• Your data in your AT Protocol repository is controlled by you and your PDS provider
• Photos/media exist only in your repository (we have no copies to delete)
• To delete your AT Protocol identity entirely, contact your PDS provider

Analytics Opt-Out

Most browsers allow you to block analytics through settings or extensions. You may also use browser "Do Not Track" features, though note that industry-wide DNT standards are not universally implemented.

8. Security

We implement reasonable security measures to protect the Service and any data we process. However, no internet transmission or storage system is completely secure. We cannot guarantee absolute security.

Your AT Protocol credentials and repository security depend on your PDS provider's practices.

9. Children's Privacy

Goals.Garden is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us.

10. International Users

Goals.Garden is operated from the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated Policy on the Service with a new "Last Updated" date. Material changes will be communicated through the Service.

Your continued use of Goals.Garden after changes are posted constitutes acceptance of the updated Privacy Policy.

12. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us at: hello@goals.garden

13. Additional Information for Specific Jurisdictions

California Residents

Under the California Consumer Privacy Act (CCPA), California residents have specific rights regarding their personal information. Because your Content is stored in your AT Protocol repository (not our servers) and we primarily collect aggregated analytics data, the data we directly hold about you is limited.

You may contact us to request information about our data practices.

European Economic Area / UK Residents

If you are in the EEA or UK, you may have rights under GDPR including access, correction, deletion, and data portability. Much of your data lives in your AT Protocol repository, controlled by your PDS provider.

For data we process, our legal basis includes:

• Contract: Processing necessary to provide the Service
• Legitimate interests: Analytics and Service improvement
• Legal obligation: Compliance with applicable laws

Contact us to exercise your rights regarding data we process.