Overview
GoalPosition ("we," "us," or "our") is a task management and social competition app. This Privacy Policy explains what information we collect when you use the GoalPosition mobile application and website (goalposition.app), how we use it, and the choices you have.
GoalPosition is designed to be immediately usable — no account or email address required. We collect the minimum data necessary to make the app work, sync your tasks across devices, and run competitions with your friends.
Information We Collect
Information you provide
- Display name. New users are automatically assigned a random "Adjective-Animal" display name (e.g., "Swift Falcon"). You may update this at any time. This name is visible to people you compete with.
- Email address and password. Only collected if you choose to create a full account. You can use GoalPosition indefinitely without providing these.
- Avatar image. Optional. If you upload a profile photo, it is stored in our cloud storage.
- Task content. The titles, descriptions, and completion status of the tasks you create. This is the core data of the app.
- List names and details. The names, colors, and icons you assign to your task lists.
- Competition activity. Who you invite to competitions, which list you associate with a competition, and competition results.
Information collected automatically
- Anonymous user identifier. When you first open the app, we create a random anonymous identifier via Supabase anonymous authentication. This lets your data persist on your device and sync to the cloud without requiring an account.
- Push notification token. If you grant notification permission, we store a device-level push token to send you competition updates (e.g., when a friend accepts your challenge or wins). You can revoke notification permission at any time in your device settings.
- Sync metadata. Timestamps and checksums used by our offline-sync engine (PowerSync) to keep your local data consistent with the server. No content from your tasks is used for analytics purposes.
Website analytics
The GoalPosition website (goalposition.app) uses PostHog to collect anonymized analytics about page visits and button clicks. This helps us understand which features visitors are interested in. We do not use advertising trackers or third-party ad networks on the website.
How We Use Your Information
We use the data we collect for the following purposes:
| Purpose | Data used |
|---|---|
| Sync your tasks across devices | Anonymous user ID, tasks, lists |
| Run competitions | Display name, tasks, competition records |
| Send competition notifications | Push notification token |
| Show your profile to competitors | Display name, avatar (if set) |
| Detect when a competition is won | Task completion status, competition records |
| Website analytics | Anonymized page events (website only) |
We do not use your task content for advertising, machine learning model training, or any purpose beyond providing the GoalPosition service.
Data Sharing
We do not sell your personal information. We share data in the following limited circumstances:
With other app users
When you participate in a competition, your display name, avatar, task list name, and task completion progress are visible to other participants for the duration of that competition. Individual task titles within a competition list are visible to all participants. You control which list you associate with each competition.
With service providers
We use the following sub-processors to operate GoalPosition. All are subject to data processing agreements:
- Supabase — cloud database and file storage (United States)
- PowerSync — offline-first data synchronization infrastructure
- Expo / EAS — mobile app build and push notification delivery
- PostHog — website analytics (United States)
For legal reasons
We may disclose information if required to do so by law or in the good-faith belief that such action is necessary to comply with a legal obligation, protect our rights, or prevent harm.
Third-Party Services
Supabase
GoalPosition uses Supabase as its database and authentication provider. Your tasks, lists, profile, and competition data are stored in Supabase's hosted PostgreSQL database. Supabase's privacy policy is available at supabase.com/privacy.
PowerSync
PowerSync powers GoalPosition's offline-first sync layer. It maintains a local SQLite database on your device and synchronizes changes with Supabase. PowerSync's privacy policy is available at powersync.com/privacy.
Expo Push Notifications
If you enable push notifications, your device's push token is sent to Expo's push notification service, which relays notifications from our servers to your device. Expo's privacy policy is available at expo.dev/privacy. You can disable push notifications at any time in your device settings — this will not affect your ability to use GoalPosition.
PostHog (website only)
The GoalPosition website uses PostHog for product analytics. PostHog collects anonymized event data about pages visited and buttons clicked. This data is not linked to your in-app identity. PostHog's privacy policy is available at posthog.com/privacy.
Anonymous Users
GoalPosition is fully functional without registration. When you first open the app, we create an anonymous session via Supabase's anonymous authentication. This means:
- No email address or personal information is required to use the app.
- Your tasks and lists are stored and synced under a random anonymous ID.
- If you uninstall the app and reinstall it without having created an account, your data may not be recoverable, since there is no email address to restore access with.
- If you later create a full account (with email and password or social login), your anonymous data is merged into your new account and preserved.
Data Retention
We retain your data for as long as your account or anonymous session is active. Specifically:
- Active accounts: Data is retained until you delete your account.
- Anonymous sessions: Inactive anonymous sessions (with no activity for 12 months) may be purged in scheduled database cleanup jobs.
- Deleted content: When you delete a task, list, or competition, it is removed from our database. It may persist in database backups for up to 30 days before being permanently deleted.
- Push tokens: Removed when you delete your account or revoke notification permission.
Security
We take reasonable measures to protect your information:
- All data transmitted between your device and our servers is encrypted over TLS.
- Row-level security (RLS) policies in our database ensure users can only read and write their own data, or data from competitions they are participating in.
- Passwords, if used, are hashed by Supabase's authentication system and never stored in plain text.
- Push notification tokens are stored only in your user profile row and are not accessible to other users.
No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.
Your Rights
Depending on your location, you may have the following rights regarding your personal information:
- Access: Request a copy of the data we hold about you.
- Correction: Update your display name, email, or avatar within the app at any time.
- Deletion: Request deletion of your account and associated data. You can initiate this from the app's profile settings or by contacting us.
- Portability: Request an export of your task and list data.
- Opt out of notifications: Disable push notifications in your device's system settings at any time.
To exercise any of these rights, contact us at privacy@select37.com. We will respond within 30 days.
Children's Privacy
GoalPosition is not directed to children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without verifiable parental consent, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at privacy@select37.com.
Policy Changes
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, if the changes are significant, notify you through the app or by email (if you have an account with an email address).
Your continued use of GoalPosition after any changes take effect constitutes your acceptance of the revised policy.
Contact Us
If you have questions, concerns, or requests related to this Privacy Policy or your data, please reach out: