Privacy policy

Account data: email address, password stored as an irreversible hash, optionally a Google sign-in identifier, and the account creation date.

Content you enter: the wording of your goals, target dates, rest and reflection preferences, generated plans, task completion status and any notes.

Images you upload to a goal: stored on our server outside the database. We re-encode them on upload, which strips photo metadata including location data. Images are never sent to the AI provider or anyone else, and are shown only to you once signed in. Deleting the goal or your account deletes the files as well.

Payment data: subscription status and type, and an identifier at the payment provider. We do not store or have access to card numbers.

Technical data: what is necessary for operation and security, for example a hash of your IP address for abuse protection. We do not store IP addresses in readable form.

Performance of a contract (Art. 6(1)(b) GDPR): running your account, generating and storing plans, tracking progress, managing your subscription.

Legitimate interest (Art. 6(1)(f) GDPR): securing the service, protecting against abuse and fraud, resolving technical problems.

Consent (Art. 6(1)(a) GDPR): analytics and marketing cookies. They do not load without consent and you can withdraw it at any time.

Legal obligation (Art. 6(1)(c) GDPR): retention of accounting records.

Goals can be personal — financial, health-related, career-related. Please bear that in mind when deciding how much detail to write.

The text of your goals, plans and tasks is stored encrypted. Anyone who obtained the database or a backup without access to the server would read nothing from it. The key, however, lives on the server, so encryption does not protect you from the operator — and claiming otherwise would be dishonest.

What is meant to protect you: the application has no screen and no interface through which the operator could read the content of your goals. User administration shows only the email address, subscription status and counts, never the text. The source code is public, so anyone can verify this, not just us.

We do not ask for special categories of data under Art. 9 GDPR (such as health data) and recommend you do not include them in your goals.

Anthropic, PBC — AI plan generation. We send the goal text, deadline and preferences; we do not send your email address or account identifier.

Stripe — payments on the web. Under Managed Payments, Stripe is the merchant of record, and for the part of the data concerning payment, taxes, invoicing and fraud protection it acts as an independent controller rather than our processor: it processes that data under its own legal obligations, not on our instructions. How it handles the data is described in Stripe’s own privacy policy.

Apple and Google — processing in-app payments under the stores’ own rules.

Our hosting provider, where the application servers run.

We do not sell your data and do not share it for third-party marketing.

Account data and goal content: for as long as the account exists. After a subscription is cancelled we keep it for a further 90 days so you can resume without losing your data; after that it is irreversibly deleted.

If you delete your account yourself, we delete the data within 30 days, except records we must retain under accounting and tax law.

Demo goals entered without registration are kept for at most 30 days and are not linked to any account.

Technical records needed for security: at most 12 months.

You have the right of access to your data, and to rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest.

Account deletion is available directly in settings and means actual deletion of the data, not merely deactivation of the account.

You can withdraw consent to analytics cookies at any time in cookie settings.

If you believe we process your data unlawfully, you may lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz) or the supervisory authority in your country.

Strictly necessary cookies handle sign-in and basic site function; without them the service would not work, and they do not require consent.

Analytics cookies help us understand how the site is used. They load only after you consent, never before. Accepting and refusing are both one click away.

For any question about data protection, contact Dagmar Drbálková, IČO 22360999, se sídlem V Jezírku 544, 252 43 Průhonice.