Privacy Policy

This Privacy Policy explains how GoalChunks collects, uses, discloses, retains, and protects information when You use the GoalChunks website at https://goalchunks.com/en, the web application, the mobile applications for iOS and Android, and related support and services (collectively, the “Service”). It also explains Your privacy choices and rights.

GoalChunks is operated by the data controller identified in the “Contact Us” section at the end of this Privacy Policy (the “Company,” “We,” “Us,” or “Our”). We process Personal Data only for the purposes and on the legal bases described below.

Interpretation and Definitions

Interpretation

Capitalized words have the meanings defined below. The definitions apply whether the terms appear in singular or plural.

Definitions

For the purposes of this Privacy Policy:

Account means a unique account created for You to access the Service.
Application means the GoalChunks software application for web, iOS, or Android.
Company means the provider and data controller identified in the “Contact Us” section, operating the Service under the name GoalChunks.
Cookies means small files or similar technologies stored by a website on Your browser or device. The web version uses necessary cookies or local storage for functions such as authentication, security, session continuity, language, and time-zone preferences.
Country means Ukraine.
Device means a computer, phone, tablet, or other device that can access the Service.
Personal Data or Personal Information means information relating to an identified or reasonably identifiable individual.
Service means the GoalChunks website, web application, mobile applications, accounts, support, and related services.
Service Provider means a person or organization that processes data on the Company’s behalf, such as a hosting, database, security, backup, email-delivery, support, or payment provider.
Usage Data means technical and operational data collected automatically from use of the Service or its infrastructure.
User Content means private information You enter into the Service, including goal titles, units, target amounts, dates, recurring periods, progress entries, and related goal information.
Website means GoalChunks, accessible from https://goalchunks.com/en.
You means the individual using the Service or, where applicable, an organization on whose behalf that individual is authorized to act.

Collecting and Using Your Personal Information

Types of Data Collected

Personal Data

Depending on how You use the Service, We may collect the following categories:

Account and profile data: email address, display name, password hash, email-verification status, account plan, language, time zone, and account creation or update dates. A display name may be a nickname and does not need to be Your legal name.
Authentication and device-session data: access and refresh tokens or their protected hashes, session identifiers, device name, platform, sign-in and last-used dates, token expiration dates, IP address, and browser or user-agent information.
User Content: goal titles, icons, units, target amounts, recurring settings, start and end dates, status, progress entries, and history. Goals are private by default and are not published to other users.
Support and communications data: the contents of messages You send to support, Your email address, and information needed to respond or investigate a problem.
Email-delivery data: identifiers and delivery events for account-related email, such as delivery, bounce, or complaint status; recipient information may be stored as a protected fingerprint rather than a plain email address where appropriate.
Purchase and subscription data: if paid features are introduced, We may receive product and transaction identifiers, subscription status, entitlement and renewal dates, cancellation or refund information, and store-account region. Apple, Google, or an authorized website payment provider processes payment credentials under its own privacy notice. GoalChunks does not normally receive complete payment-card numbers.

You should not enter medical records or diagnoses, government identifiers, payment-card or financial-account credentials, passwords, biometric data, confidential enterprise information, or information about another person without authority into goal or other free-text fields.

Usage Data

Usage Data may include IP address, browser or application version, device type and platform, pages or endpoints requested, dates and times of access, session and diagnostic information, request identifiers, security events, and error or performance information.

We use this information to authenticate Users, maintain sessions, synchronize data, protect the Service, prevent abuse, troubleshoot errors, and understand whether core functionality operates correctly. We do not currently use third-party behavioral analytics SDKs in the mobile applications.

Data We Do Not Currently Request

The Service does not currently request access to precise location, contacts, photos, camera, microphone, health-platform data, or advertising identifiers. The mobile applications do not currently contain advertising networks, social sign-in, behavioral advertising, or active push-notification permissions.

The Service may add optional push notifications, email preferences, analytics, or advertising in the future. Before any new data processing begins, We will provide any notice, consent request, or choice required by applicable law and app-store rules. If the categories of data, purposes, or third parties materially change, We will update this Privacy Policy. A future-feature statement does not replace a legally required update when actual practices change.

Tracking Technologies and Cookies

The web version may use necessary session cookies, cross-site request-forgery protection, authentication cookies or tokens, and preference cookies for language or time zone. These technologies are used to provide the features You request, maintain security, and remember settings.

The mobile applications may store authentication credentials securely on Your Device so that You remain signed in. These credentials are transmitted to the Service when needed to authenticate requests.

We do not currently use advertising cookies, cross-context behavioral tracking, web beacons for advertising, or third-party behavioral analytics cookies. If We introduce non-essential analytics or advertising technologies, We will provide appropriate disclosure and consent or opt-out controls where required.

You can control browser cookies through Your browser or device settings. Blocking necessary cookies may prevent the web version from authenticating You or providing some requested features.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

To provide and maintain the Service: create and authenticate Accounts, synchronize private goals, calculate goal periods, display history, operate deletion and restoration features, and provide requested functionality.
To manage Your Account: maintain profile settings, language, time zone, plan, devices, and security sessions.
To communicate with You: send verification, password-reset, security, purchase, support, and material-service notices. Optional marketing email, if introduced, will include required consent and unsubscribe mechanisms.
To provide optional notifications: if reminders or push notifications are introduced and You grant device permission, send reminders You configure. Device permission may be withdrawn in application or system settings.
To process purchases: validate and maintain Premium entitlements, prevent duplicate or fraudulent transactions, and provide purchase support when paid features are introduced.
To protect the Service: detect, prevent, and investigate abuse, fraud, security incidents, and violations; enforce rate limits; maintain logs; and protect legal rights.
To support and improve the Service: respond to requests, troubleshoot technical issues, evaluate reliability, and improve features using aggregated or appropriately minimized information where possible.
For legal and business purposes: comply with legal obligations, resolve disputes, enforce agreements, exercise or defend legal claims, and evaluate a merger, financing, restructuring, or transfer of the Service.

Legal Bases for Processing

Where the General Data Protection Regulation, United Kingdom data-protection law, or another law requiring a legal basis applies, We rely on one or more of the following:

Contract: processing needed to create and operate Your Account, synchronize goals, provide support, and deliver purchased features.
Legitimate interests: securing and improving the Service, preventing abuse, maintaining necessary operational records, and communicating about material service matters, balanced against Your rights.
Consent: optional marketing, non-essential cookies, advertising personalization, push notifications, or other processing for which consent is required. You may withdraw consent at any time without affecting prior lawful processing.
Legal obligation: processing necessary to comply with tax, accounting, consumer, privacy, law-enforcement, or other legal duties.
Legal claims and vital interests: processing necessary to establish, exercise, or defend claims, or to protect a person’s vital interests where permitted by law.

Retention of Your Personal Data

We retain Personal Data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including provision of the Service, security, dispute resolution, and legal compliance. Retention depends on the category and context:

Account and User Content: retained while Your Account is active or until You delete the relevant goal or Account. Account deletion removes associated data from primary production systems, subject to limited legal retention and ordinary backup cycles.
Goals in the deletion queue: normally recoverable for 14 days and then permanently deleted with their history. If a plan-based deletion queue is full, a newly selected goal may be deleted immediately after a warning.
Authentication and device sessions: retained while valid and removed or pruned after revocation, expiration, or Account deletion.
Email-delivery events: operational delivery and complaint events are generally retained for up to 90 days, unless a longer period is reasonably necessary for security, abuse prevention, or legal compliance.
Security and operational logs: retained for a limited period appropriate to security, troubleshooting, and abuse prevention, then deleted or aggregated unless needed for an incident or legal obligation.
Support correspondence: retained while a request is handled and for a reasonable follow-up or legal-defense period.
Purchase and transaction records: retained as required to manage entitlements, resolve disputes, prevent fraud, and comply with tax, accounting, consumer, or payment laws.

Residual copies may remain temporarily in encrypted or access-controlled backups until the ordinary backup cycle expires. Backups are not restored for ordinary use after an Account deletion except where necessary for disaster recovery, security, or legal compliance; deleted Account data will be removed again from active systems after a restoration where reasonably feasible.

Anonymous or aggregated information that can no longer reasonably identify You may be retained for statistical and service-improvement purposes.

Transfer of Your Personal Data

The Company and its Service Providers may process information in Ukraine and in other countries where the relevant infrastructure or provider operates. Those countries may have data-protection rules different from the rules in Your jurisdiction.

Where applicable law requires safeguards for an international transfer, We will use an approved legal mechanism or other appropriate safeguards, such as contractual protections and security measures. You may contact Us for information about safeguards applicable to a particular transfer.

Delete or Correct Your Personal Data

You may review or update certain profile information in Account settings. You may delete individual goals, subject to the 14-day deletion-queue behavior described above, or permanently delete Your Account through the Account or profile settings.

If You cannot access Your Account, visit https://goalchunks.com/en/delete-account or contact [email protected]. We may request reasonable verification to prevent unauthorized deletion. Deleting the application from a Device does not delete Your Account.

If You have an App Store, Google Play, or website subscription, deleting Your Account does not automatically cancel it. Cancel the subscription separately through the applicable store or payment-provider method.

We may retain limited information where required by law or reasonably necessary for security, fraud prevention, dispute resolution, or legal claims. We will explain any applicable exception when required.

Your Privacy Rights

Depending on Your location and applicable law, You may have rights to:

know whether and how We process Your Personal Data;
request access to and a copy of Personal Data;
correct inaccurate or incomplete Personal Data;
request deletion or restriction of processing;
object to particular processing, including direct marketing;
withdraw consent where processing is based on consent;
receive certain data in a portable format;
lodge a complaint with a competent data-protection authority; and
not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, where applicable.

To exercise a right, contact [email protected]. We may verify Your identity and may decline or limit a request where permitted by law. You may also complain to the Ukrainian Parliament Commissioner for Human Rights or to the competent authority in Your place of residence.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition, financing, restructuring, or asset transfer, Personal Data may be transferred as part of that transaction. We will provide notice where required before the information becomes subject to a materially different privacy policy.

Law Enforcement

The Company may disclose Personal Data when required by law or in response to a valid request from a court, regulator, law-enforcement body, or other public authority.

Other Legal Requirements

The Company may disclose Personal Data in the good-faith belief that the action is reasonably necessary to:

comply with a legal obligation;
protect and defend the rights or property of the Company or another person;
prevent or investigate possible wrongdoing, fraud, abuse, or security incidents;
protect the safety of Users or the public; or
establish, exercise, or defend legal claims.

Security of Your Personal Data

We use reasonable administrative, technical, and organizational measures designed to protect Personal Data, including access controls, authentication protections, encrypted network transport, protected credential storage, rate limiting, and security monitoring where appropriate.

No transmission or storage method is completely secure. We cannot guarantee absolute security. You are responsible for using a strong unique password, protecting Your Devices, and notifying Us if You suspect unauthorized access.

Children's and Minors' Privacy

The Service is not directed to, and We do not knowingly collect Personal Data from, anyone under 16. If the law where a User lives requires a higher age for independent consent, parental or guardian authorization may be required.

If You are a parent or guardian and believe a child has provided Personal Data, contact Us. If We learn that We collected a child’s Personal Data without a lawful basis, We will take reasonable steps to delete it.

Links to Other Websites

The Service may contain links to third-party websites, app stores, or services that We do not operate. Their products, content, contracts, and privacy practices are governed by their own terms and notices. We recommend reviewing them before providing information or completing a transaction.

Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in the Service, providers, data practices, law, or security. We will post the updated Privacy Policy and revise the “Last updated” date.

For material changes, We will provide additional notice and request consent or renewed acceptance where required by law. Changes take effect when posted or on a later date stated in the notice.

Contact Us

Questions, requests, or complaints about this Privacy Policy or Personal Data may be sent to:

Data controller: Individual Entrepreneur Rybak Oleksandr.
Service and trade name: GoalChunks.
Country of registration: Ukraine.
Email: [email protected]; website: https://goalchunks.com/en.