Privacy Policy

1. Information We Collect

Information you provide

• Account details — email address, display name, and username when you create an account.
• Password — stored as a salted hash by our authentication provider (Supabase Auth). We never store or access your plaintext password.
• Goals, tasks, and plans — the content you create inside the App, including goal titles, task descriptions, notes, deadlines, and scheduling preferences.
• Onboarding responses — answers you provide during the onboarding flow that help tailor your experience (e.g. work style, motivation preferences).

Information collected automatically

• Device identifiers — Identifier for Advertisers (IDFA, with your consent via App Tracking Transparency) and Identifier for Vendors (IDFV).
• Usage data — app events such as goals created, tasks completed, streaks, and paywall interactions. These are used for analytics and to improve the App.
• Purchase data — subscription status, transaction identifiers, and pricing information processed through Apple's App Store and our subscription management provider (RevenueCat).
• AI generation metadata — timestamps, token usage, and model identifiers for AI-generated plans. We do not store the AI prompts or responses beyond what is saved as your goal plan content.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the App and its features.
• Generate AI-powered goal plans and task recommendations personalised to your input.
• Manage your account, authenticate sessions, and process subscription purchases.
• Track your progress — stars, streaks, levels, badges, and leaderboards.
• Send reminders and notifications you have opted into (e.g. daily task reminders).
• Analyse aggregate usage patterns to improve the product (we do not sell individual data).
• Measure advertising effectiveness and optimise ad campaigns (with your consent where required).
• Respond to support requests.

3. Third-Party Services

Goalstar uses the following third-party services that may process your data in accordance with their own privacy policies:

4. Advertising & Attribution

Goalstar uses the Meta (Facebook) SDK and Apple's SKAdNetwork framework to measure the effectiveness of advertising campaigns.

On iOS, we request your permission through Apple's App Tracking Transparency (ATT) prompt before accessing your IDFA for ad attribution. If you decline, we respect your choice — the App continues to function normally, and we do not track you across other apps or websites.

Even without ATT consent, the Meta SDK may send limited, non-tracking events (installs, sessions) that Apple permits without consent. Revenue events (trials, subscriptions, renewals) are sent server-side by RevenueCat through Meta's Conversions API and do not originate from your device.

We do not serve ads within the App. Attribution data is used solely to understand which ads led to installs and subscriptions.

5. Data Storage & Security

Your account and content data is stored in Supabase (hosted on AWS infrastructure). All data is transmitted over HTTPS/TLS. Your authentication session token is stored locally using encrypted device storage (iOS Keychain via Expo SecureStore).

We enforce Row Level Security (RLS) on all database tables, ensuring that each user can only access their own data. Sensitive operations like task completion scoring and gamification updates run through server-side functions that validate permissions before executing.

While we take reasonable measures to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your account data and content for as long as your account is active. If you delete your account (Settings → Delete my account), we permanently delete your profile, goals, tasks, completions, achievements, and all associated data from our servers. Some data may persist in encrypted backups for up to 30 days before being purged.

Aggregated, anonymised analytics data that cannot identify you may be retained indefinitely for product improvement purposes.

Data held by third parties (RevenueCat, Meta, Apple) is subject to their respective retention policies.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data (you can edit your profile in the App at any time).
• Delete your account and all associated data (Settings → Delete my account).
• Withdraw consent for ad tracking (iOS Settings → Privacy & Security → Tracking, or re-prompt via the App).
• Export your data — contact us and we will provide your data in a portable format.
• Object to processing or request restriction of certain data uses.

If you are in the European Economic Area (EEA) or United Kingdom, you have additional rights under the GDPR/UK GDPR. To exercise any of these rights, contact us at hello@macheme.com.

If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority.

8. Children\u2019s Privacy

Goalstar is not directed at children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you through the App. Your continued use of Goalstar after changes are posted constitutes acceptance of the revised policy.

10. Contact Us

If you have questions about this Privacy Policy or your data, reach out to us: