Home Articles

Privacy Policy

Last updated: 4 September 2026

Goalie is built and run by me, Samuel Shingler, through my company Waitak Limited, registered in New Zealand. This page explains what data Goalie handles, where it lives, and what I can and can’t see.

The short version

  • Your goals, projects, timelines, and notes are stored on your own device, and a copy is synced to Goalie’s servers so your data follows you across devices.
  • If you turn on end-to-end encryption, the names, titles, and written content of your goals are encrypted before they leave your device, and so are files you upload. Neither I nor anyone else with server access can read them. Dates and how things are organised stay readable so sync can work; details below.
  • Payments are handled by Paddle. I never see your card number.
  • The site counts page views and captures errors, but never records your screen or your goal content. Details below.
  • You can export everything as JSON at any time, and delete your account and data on request.

Your goal data

Everything you create in Goalie (goals, projects, timelines, notes) is stored locally in your browser using IndexedDB. That’s what makes Goalie work offline: the copy on your device is the one you’re using, and it doesn’t need a connection.

When you’re online, your data also syncs to Goalie’s servers. This is how it follows you across devices and survives a lost laptop. Sync is always on; what’s optional is how readable that server copy is, and you choose that when you sign up (you can also turn it on later from Account settings):

With end-to-end encryption on, the names, titles, and written content of your goals, projects, timelines, and notes are encrypted on your device before they’re sent. The server stores them, but neither I nor anyone with access to the server can read them. Some things stay readable on the server because sync needs them to work: dates, completion status, and how items are organised, meaning which goals sit in which timeline and project and in what order. So someone with server access could see the shape and timing of your activity, but not what any of it says. If you lose your encryption key, I cannot recover your data.

With end-to-end encryption off, your data is encrypted in transit and at rest, but it is technically readable on the server. Turn on end-to-end encryption if you’d rather that not be the case.

Goalie’s servers are hosted on Fly.io. The application servers run in Sydney, Amsterdam, and Ashburn (Virginia, USA) so requests are handled close to wherever you are, but the database itself lives in Sydney, Australia. That’s where the server copy of your goal data is stored. Uploaded files are the exception, covered below.

Your account

To create an account, Goalie collects your name and email address, plus either a hash of your password or, if you sign in with Google, your Google account identifier. A password hash is a scrambled version of your password that can’t be turned back into the original, so I never hold your actual password.

This information is used to sign you in, sync your data, and contact you about your account, meaning things like payment receipts and important service changes.

Files you upload

At the moment, the only files you can upload to Goalie are image attachments.

Files are stored with Tigris, an object storage service provided through Fly.io. Tigris uses its default global distribution, which means it stores copies across its own network of regions worldwide and caches them close to whoever requests them, rather than keeping them in one place. So unlike your goal data, an uploaded file may be stored and cached well beyond Australia.

If you have end-to-end encryption on, files are encrypted on your device before upload, just as your goal content is. Tigris stores content that neither I nor Tigris can read. If you have end-to-end encryption off, files are encrypted in transit and at rest but are technically readable, on the same terms as everything else.

Deleting a file in Goalie removes it from storage after a short grace period that keeps undo possible. As with the database, copies may persist briefly in caches and backups before rolling off.

Payments

Payments are handled by Paddle, who act as the merchant of record. That means your purchase is technically made from Paddle, and Paddle handles billing details, card processing, and sales tax or VAT. When you start a trial or subscription, Goalie asks for your billing country and, in some countries, your postal code, and passes them to Paddle so it can work out the right sales tax. I receive confirmation that you’ve paid and your email address, but never your card number. Paddle’s own privacy policy is at paddle.com/legal/privacy.

Analytics and error monitoring

PostHog (analytics). The site uses PostHog to count page views and track a small number of specific events, like a signup or a first goal created. Autocapture is disabled, so it does not record your clicks, keystrokes, or anything visible on your screen. PostHog also receives technical details like your browser and device type, and your IP address as part of any web request. When you’re signed in, these events are linked to your account, meaning your name and email address.

Sentry (error monitoring). When something breaks, Sentry captures the error along with technical context so I can fix it. Sentry also receives performance data, which is used to spot slowness and help improve the service. Session replay is disabled, so Sentry never receives a recording of your screen.

Neither tool ever sees the content of your goals. If you use a tracker blocker that blocks them, Goalie keeps working.

Cookies and local storage

Goalie uses local storage and cookies for three things: keeping you signed in, storing your goal data locally (that’s the offline-first part), and analytics as described above. There are no advertising cookies and no third-party ad networks.

Who else touches your data

  • Fly.io hosts the servers.
  • Tigris stores uploaded files.
  • Paddle processes payments.
  • Resend delivers account emails, like verification and password reset messages.
  • PostHog processes analytics data.
  • Sentry processes error reports.

That’s the full list. I don’t sell your data, share it with advertisers, or use it to train AI models.

Export and deletion

You can export all of your data at any time from Account, then Export data. The export is a zip containing a complete backup in JSON, your uploaded files, and a readable copy of every project, goal, and note. It is saved unencrypted even if you have end-to-end encryption on, so keep it somewhere safe.

To delete your account, follow the steps on Delete your Goalie account. In short: email support@goalie.run from the address on the account. Your account and synced data are removed from the live servers within 48 hours of the request, except records I’m legally required to keep, such as payment records.

Server backups are kept for 5 days on a rolling basis, so a copy of your data can persist in those backups for up to 5 days after deletion before it rolls off. Backups are used only to restore the service after a failure.

Data stored locally on your device is yours; clearing it is done from your own browser.

Your rights

Waitak Limited is a New Zealand company, so Goalie operates under the New Zealand Privacy Act 2020. You have the right to ask what personal information I hold about you, ask for it to be corrected, and complain to the New Zealand Privacy Commissioner (privacy.org.nz) if you think I’ve handled it badly.

If you’re in the EU, UK, or another region with its own privacy law, you have equivalent rights of access, correction, deletion, and portability, and you can exercise all of them by emailing me.

Your goal data is stored in Australia, uploaded files are distributed globally by Tigris, and analytics and error reports are processed in the United States, so unless you’re in Australia, some of your data is held outside your own country. If that concerns you, end-to-end encryption keeps the names, titles, and written content of your goals, and the full contents of your files, unreadable to anyone but you.

Children

Goalie isn’t directed at children under 16, and I don’t knowingly collect data from them.

Changes to this policy

If I change this policy in a way that matters, I’ll note it here with a new date and, for significant changes, email account holders.

Contact

Questions, requests, complaints: support@goalie.run