Privacy Policy

Data we collect

• Account data, including your sign-in identifier, name, email address and profile photo when provided by your sign-in provider.
• Connected health and fitness data that you authorize, including activity, steps, sleep, heart-rate signals, body measurements, food, hydration and related provider metadata.
• Manual entries you create in GoalMetric, including workouts, planned sessions, goals, food logs, water, weight, behaviour check-ins, notes, reports, coach history and circle posts.
• Photos or label images you choose to upload for food logging or profile features.
• Device and app data needed to operate the service, such as push notification tokens, app version, diagnostics, crash information, IP address and basic request logs.

How we use data

• To show your dashboard, trends, goals, training plans, reports and activity log.
• To sync data from services you connect, such as Google Health, Health Connect, Withings and Strava.
• To generate coaching briefs, recommendations, reminders and notifications.
• To help you log food, exercise and health-related notes more quickly.
• To keep the service secure, debug issues, prevent abuse and improve reliability.

Sharing and processors

GoalMetric does not sell your personal data. Data is shared only where needed to operate features you use, comply with law, or protect the service. This can include hosting providers, database and backup services, Google services for sign-in, health sync, Play distribution, Firebase/push notifications, and AI providers when you use AI-assisted coaching or photo/label analysis.

Circle and coach features only share selected data with other users when you choose to share it or when you accept a coach/client relationship.

Health and sensitive data

Health and fitness data can be sensitive. GoalMetric uses it to provide wellness, fitness, nutrition and training context. GoalMetric is not medical advice, diagnosis or treatment.

Google Health data is used only for the features you enable in GoalMetric, such as dashboards, trends, training plans, reports and connection sync. We request read-only Google Health access and do not write data back to Google Health.

Data protection and security

• GoalMetric uses HTTPS/TLS to protect data sent between your device, browser and the GoalMetric service.
• OAuth tokens for connected providers are stored server-side and are not exposed to the Android app or browser after connection.
• Access to production systems, databases, backups and logs is restricted to authorized administration only.
• We use least-privilege access where practical, including read-only Google Health scopes for imported health and fitness data.
• We avoid intentionally logging OAuth tokens or full sensitive health payloads in diagnostics, and we use operational logs mainly for reliability, debugging and security.
• Provider connections can be disconnected in the app. Account and data deletion can be requested from the account deletion page.
• Backups and security logs are retained only for a limited period where needed for reliability, security, legal or abuse-prevention reasons.

Storage and retention

We keep account and health data while your account is active, unless you delete specific data, disconnect a provider, or request account deletion. Backups and security logs may remain for a limited period after deletion where needed for reliability, security, legal or abuse-prevention reasons.

Your choices

• You can disconnect providers from the app.
• You can delete selected imported provider data from the app where available.
• You can request account and data deletion at Account deletion.
• You can contact support@goalmetric.app for privacy questions.

Children

GoalMetric is intended for adults and is not directed at children.

Contact

Email support@goalmetric.app.