Goaler ("Goaler", "we", "us") is a goal-planning app that turns long-term goals into daily tasks and, optionally, syncs them with your Google Calendar. This policy explains what data we collect, why, how we store it, and the choices you have. Questions: bulbuk.andriy@gmail.com.
Data we collect
- Account data — your email address, display name, and a hashed password, or the basic profile (email, name) returned by Google when you sign in with Google. We never see or store your Google password.
- Content you create — goals, milestones, tasks, schedules, notes and completion history you enter in the app.
- Google Calendar data — only if you connect a calendar: the list of your calendars (name, id, color, access role) and the events in the calendars you choose to display (title, start and end time).
- Technical data — standard server logs (IP address, user agent, request path and time) kept for security and debugging.
We do not sell your data, we do not serve ads, and we do not use tracking or advertising cookies. The only cookie we set is the session cookie that keeps you signed in.
How we use it
- To run the product: store your goals and tasks, show your plan, and keep your progress in sync across devices.
- To display your Google Calendar events alongside your Goaler plan, if you turned that on.
- To create and manage events for your scheduled tasks in a dedicated "Goaler" calendar we create in your Google account, if you granted write access.
- To generate AI plan suggestions when you use the AI Builder (see "Third parties" below).
- To keep the service secure, prevent abuse, and fix problems.
Google user data and Limited Use
Goaler's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- Calendar data is used only to provide the calendar features you can see in the app — showing your events and writing your scheduled tasks to the Goaler calendar.
- We do not transfer Google user data to third parties except as needed to provide those features, for security purposes, or to comply with applicable law.
- We do not use Google user data for advertising, and we do not sell it.
- No human at Goaler reads your calendar data, except with your explicit permission for support, for security reasons, or where required by law.
- Your Google Calendar content is not sent to any AI model.
We request the narrowest scopes that make the features work: read-only access to your calendar list and events for display, and calendar.app.created for writing tasks — a scope that lets Goaler manage only the calendar it created itself and gives it no access to your other calendars. Read and write access are requested separately; you can grant one without the other.
Storage and security
- Data is stored in a managed PostgreSQL database hosted by our infrastructure provider, and is encrypted in transit (HTTPS/TLS).
- Google refresh tokens are encrypted at rest with AES-256-GCM before being written to the database.
- Passwords are stored only as salted scrypt hashes; they are never stored or logged in plain text.
- Access to production systems is limited to the operator of the service.
Third parties
We use a small number of processors, each only to run the service:
- Google (sign-in and Google Calendar API), when you choose to use them.
- Anthropic (Claude) — when you use the AI Builder, the goal description and plan details you submit are sent to Anthropic to generate the suggested plan. Do not put sensitive personal information into AI Builder prompts.
- Our hosting and database providers (Vercel, Railway), which process data on our behalf to run the app.
Retention and your choices
- Disconnecting Google Calendar in Settings deletes the stored tokens immediately and revokes Goaler’s access on Google’s side. You can also revoke access at any time at myaccount.google.com/permissions.
- You can request a copy of your data, or deletion of your account, by emailing us; we action deletion requests within 30 days, which removes your account, goals, tasks and calendar connection from our database.
- Server logs are retained for up to 30 days.
Children
Goaler is not directed at children under 13 (or under 16 where local law requires), and we do not knowingly collect their data.
Changes
If this policy changes materially we will update the date at the top of this page and, for significant changes, notify you in the app.