Goal Progress Tracker Privacy Policy

Scope

This policy explains how Goal Progress Tracker collects, uses, protects, retains, and deletes information when a user creates an account or uses the Android app and its backend services.

Information We Collect

• Email address and username for account creation, identification, and access.
• Password authentication data. Raw passwords are not stored; the backend stores a salted password hash.
• Access tokens. Android stores the bearer token in platform-protected secure storage and sends it only with protected API requests.
• User-generated progress content, including goal details, values, units, deadlines, status, timestamps, and optional notes.
• Challenges, teams, memberships, and invitations needed for collaboration features.
• Internal identifiers that support access control and relationships between app records.
• Operational logs containing limited technical request, response, timestamp, status, and error information. Passwords and tokens must not be logged.

Why We Use Information

• Account creation and login
• Goal, milestone, measurement, challenge, team, and invitation features
• Protected user-owned resources and access control
• Security and abuse prevention
• Service operation, support, monitoring, and troubleshooting

Information We Do Not Collect

The current MVP does not collect location, contacts, photos, videos, audio, payment details, advertising identifiers, or device sensor data. The app does not use information for advertising or behavioral profiling.

Data Sharing

We do not sell user data, share it with advertising networks, or provide it to third parties for their independent use. Infrastructure providers may process information only as needed to operate hosting, managed database, logging, and support services. Information may also be disclosed when required by law or needed to protect users, investigate abuse, or respond to a security incident.

Security

The MVP uses HTTPS in non-local environments, salted password hashing, bearer tokens for protected requests, Android secure token storage, and server-side access control based on authenticated identity.

Retention

Account and app data is generally retained while an account exists unless deletion is requested. Operational logs may be retained temporarily for security, abuse prevention, and troubleshooting. Actual retention periods must be verified before production release.

Account And Data Deletion

Users may submit a request through the Account and Data Deletion Request page. Requests are handled manually and may require proof of control of the account email.

Data expected to be deleted includes the account record where applicable, goals, measurements, notes, and challenge, team, membership, and invitation data associated with the account.

Backend and in-app deletion are not automated yet. This remains a production blocker.

Children

Goal Progress Tracker is not intended for children. The app owner must complete the Google Play target-audience and applicable legal reviews before release.

Changes To This Policy

This policy may be updated when the app, infrastructure, service providers, legal obligations, or data practices change. The latest version will show an updated date.

Contact

Developer/app owner: Guychou urnel Mouangaloungou

Privacy and support email: mouangaloungouguychouurnel@gmail.com

Do not send passwords, access tokens, JWTs, database URLs, signing material, or other secrets by email.