Privacy

In case of discrepancy, the Italian version prevails.

Who we are

The data controller is [GoalMate company name], VAT no. [00000000000], registered at [address]. For any privacy question you can write to privacy@goalmate.it.

What data we collect

Account data: name, email, username, preferred language, date of birth (to verify you are an adult).
Usage data: check-ins, challenge and group participation, reactions and messages.
Health-related data: weight, height, wellbeing goals, only if you choose to enter them.
Technical data: IP address, device type, necessary cookies (see the Cookie policy).
Usage statistics (only with your consent): pages and screens viewed, actions in the site and the apps (for example “you published a post”, never its content), errors and loading times, how long and how often you use GoalMate, steps of sign-up and onboarding, which campaign you came from, with a random code and not your email or name. Never weight, measurements, health answers or goals.

Weight, height and health goals are special categories of data under Art. 9 GDPR. We process them only with your explicit, separate consent, collected in a dedicated step distinct from accepting the terms. You can withdraw it at any time from your privacy settings: your health data will be deleted.

Your weight is encrypted in our database and never visible to other users: groups only see the percentage change, if you choose to share it.
Health data is never sent to artificial intelligence systems in identifiable form.
Health data is not used for advertising or commercial profiling.

Why we use your data

Purpose	Legal basis
Providing the service and managing your account	Performance of contract
Processing health data	Explicit consent (Art. 9.2.a GDPR)
Newsletter and communications	Consent
Usage statistics and campaign origin	Consent
Push notifications on your phone	Consent (notification permission)
Reminders to finish signing up	Performance of the contract (email verification) · Consent (first steps)
Security and abuse prevention	Legitimate interest
Live broadcasts: broadcasting and watching	Performance of contract
Live broadcasts: real-time checking of images, voice and comments	Legitimate interest
Tax and legal obligations	Legal obligation

Usage statistics

If you accept, we measure how GoalMate is used to understand where to improve: the pages and screens you open, the actions you take in the site and in the iOS and Android apps, the errors you run into and how long things take to load, how long and how often you use GoalMate, where you stop in sign-up and onboarding, and which campaign you came from. The apps send these statistics to GoalMate's servers, which check them and forward them to PostHog. We do it with PostHog (PostHog Inc.), which acts as a processor with servers in the European Union (Frankfurt) and does not use this data for other purposes.

Legal basis: your consent, separate from the consent to health data. It is off until you give it: if you decline or do not choose, no measurement starts and GoalMate works exactly the same.
What we collect: events such as “sign-up completed” or “onboarding step completed” (only the name of the step, never your answer), the pages and screens you open, the kind of action taken (for example “reaction to a post”, without saying to whom or with what text), the kind of error, the length of loads and sessions in bands (never the exact value), your language and the origin (campaign or referring site). We identify you with a random internal code, not with your email or name.
What we never collect: weight, height, measurements, goals, answers about your health, text you write or search for, clicks or screen recordings, the advertising identifier of your phone. Screens and features about weight, health, steps and tracking are never measured, not even the fact that you open them. Your IP address is not kept.
Withdrawal: you can change your mind at any time from the cookie banner or from Settings → Privacy. From then on we stop collecting. Data already collected is kept for 12 months and, if you want, you can ask for its deletion.
Account deletion: when you delete your account we also ask PostHog to delete the statistics data about you.

Phone notifications and reminders

Push notifications. If you use the GoalMate app on your phone and allow notifications in the phone settings, we send you the messages you already see in the app (the check-in reminder, a kudos, a comment, a milestone). To deliver them we use Google's Firebase Cloud Messaging service, which acts as a processor: it receives your phone's device code and the text of the notification, which never contains weight, goals or other health data. Legal basis: your consent, that is, the notification permission you give on the phone. You can withdraw it at any time in the phone or app settings; when you sign out or delete your account we remove your phone from our list.

Reminders to finish signing up. If you sign up and do not confirm your email, we write to you at most twice to remind you (a service message tied to your request). If you confirmed your email, gave your consent to communications and stopped in the first steps, we write to you at most twice to help you pick up again, mentioning only the name of the step and never your answers. Every message has a link to stop receiving them; you can also change your mind in Settings → Notifications. If an address cannot be reached or marks the message as unwanted, we leave it out of the reminders (we keep only a fingerprint of it, not the address).

Content moderation

To keep the community safe we check the images you upload and, when several people report a behaviour, the reported messages and content. Image checks and the analysis of reported text are done by Claude (Anthropic), which acts as a processor and does not use your content to train its models. A person on our team can always review a decision: if you think it is wrong you can ask for a review from the link in your email. We keep the record of a sanction only as long as needed to protect the community and your rights, then delete it.

Live broadcasts

Live broadcasts are only for adults. Here we explain what happens to your data when you go live or watch a broadcast; the rules of use are in the Terms of use.

What is sent and who sees it. The video and voice of your broadcast reach our servers in the European Union and we show them only to the members of the circle or group you broadcast to, with a safety delay of a few seconds, because we check them first. There are no public broadcasts. We do not send or keep your location. We do not record who is watching: we count the people while the broadcast is on and keep only the highest number reached.
Real-time checking. While you are live we keep checking images and voice, before anyone else sees them. Two external artificial intelligence services do it, acting as processors: Claude (Anthropic) looks at an image every few seconds to recognise sexually explicit, graphic or illegal content and reads the text of the speech and of the comments; AssemblyAI turns the voice into text, using its European service. They receive only the image, the stretch of audio or the text to be checked, without your name and without your account, and they do not use them for other purposes or to train their models. If a supplier processes data outside the European Economic Area, we do so only with the safeguards required by the GDPR. The check is not perfect: it is made by sampling. A person on our team can always review a decision.
What we do not keep. The images, audio and transcribed text used for the check are not kept after the result: only the result and some summary numbers remain (how many checks were made and what the worst result was), never the content.
If the broadcast is interrupted. If we stop it because of sexually explicit or illegal content, we apply no sanction automatically: the case stays «to be reviewed» and a person on our team decides it. For that purpose alone we keep, in a private area that only administrators can open, the recording of the broadcast (it may also show other people) and the picture that set the check off, for 14 days at most. As soon as a person decides, the recording is deleted; if they decide there is no violation we delete the picture too, and if they confirm it the picture stays another 14 days so you can ask for a review, then it is deleted. The material is never published, never becomes a post and no viewer ever sees it. Every access of administrators to the material is logged. For any other interruption the recording is deleted.
The recording. While you broadcast, we record the whole broadcast on our server. If it ends normally (you end it, it reaches the maximum length or the connection drops), the recording is prepared and checked in full, with the same suppliers, and becomes a video among your posts; as soon as the video is ready and checked, we delete the original recording. If the broadcast is too short or is interrupted, the recording is deleted and no post is made. The video stays until you delete it or close your account.
Comments and reactions. Viewers can send short reactions and comments. The text of a comment is read by Claude (Anthropic), without the name of who wrote it, before it appears. We keep the comments and reactions of a broadcast for 24 hours after it ends, then we delete them.
Basic data of the broadcast. Title, circle or group, times, length, highest number of viewers, result of the check and reason for any interruption are kept while your account is active.
People who appear. Whoever broadcasts must have the right to do so and must not film anyone without their knowledge. If you appear in a broadcast and do not want to, you can report it from the app or write to privacy@goalmate.it: we will consider removing it.
Health data. Your weight, height and goals never enter a broadcast and do not go to the checks. What you say or show during a broadcast is still your own content, checked like any other: avoid showing or saying data about your health.
Notifications. When you go live, the members of the circle or group who turned notifications on receive a notice (see “Phone notifications and reminders”).
Your rights. When you delete your account we also delete your broadcasts, the recordings, the videos of your broadcasts among your posts, your comments and the material kept for review (only the minimum record described in “Content moderation” remains). You can ask for a review of any sanction.

Inviting friends

You can invite other people with a personal link or a code. The invitation message contains only your public name (or your pseudonym, if you use anonymous mode) and the link: it never contains weight, goals or other health data. When someone opens the link we keep, for a few hours, an anonymous record of the opening, meaning a code computed from the network address and not the address itself, to connect the invitation to the sign-up and to count results in aggregate form. If the person signs up, we record who invited them and through which channel; the person who invited sees only the public name chosen by the invited person. Whoever receives an unwanted invitation can report it from the link's page. You can also choose to use your address book to find who is already on GoalMate and to invite who is not: it is a separate consent that you can withdraw at any time. The names, numbers and emails of your contacts never leave your phone: we only send codes (hashes) of emails, which we compare with those of people who chose to be findable; the ones that do not match are not kept. In the privacy settings you can choose to be findable from other people's address books: it is off by default and uses only the hash of your email. If someone invites you by email, we use your address only to send that message; if you no longer want invitations, the message and the link's page show how to say so, and we keep only a code from which your address cannot be recovered. On the phone we may recognise the invitation after installation through the store's referrer (Android) or, only if switched on, through a few-hours match based on the network address (iOS).

No selling of data

We do not sell, rent or hand over your personal data to third parties. We only share it with providers that help us run the service (e.g. EU hosting) and, only with your consent, for usage statistics (PostHog, in the European Union), bound by GDPR-compliant processing agreements.

Where and how long we keep data

Data is stored on servers located in the European Union. We keep it while your account is active; when you delete your account it is erased within 30 days, unless the law requires otherwise. Usage statistics data is kept for 12 months.

Your rights

At any time you can:

export all your data in a readable format, from your privacy settings;
delete your account and all associated data;
access, correct, restrict or object to processing;
withdraw consent without affecting the lawfulness of earlier processing;
lodge a complaint with the Italian Data Protection Authority (Garante).

Minimum age

GoalMate is only for people aged 18 or over. We do not knowingly collect data from minors; if we find an account belongs to a minor, we delete it.

Changes

If we change this policy in a significant way we will let you know in the app or by email.