Privacy

Your account: a username, an email address, a password (never kept in clear text — only its scrypt hash is) and your display language.

Your content: your goals, your todos, your rituals, your retro notes and the hours you log. It is what you write, nothing more, and it stays until you delete it.

The technical minimum: your open sessions (when each was created, when it was last used) so you stay signed in, and server logs (IP address, page requested) kept a few days to diagnose failures.

No trackers, no advertising cookies, no third-party analytics. Two cookies exist and that is all: cap_session keeps you signed in (httpOnly, 90 days), cap_locale remembers your language (one year, nothing sensitive).

Nothing is sold, rented or handed to anyone for commercial purposes. There are no ads, and there will be none.

Your content is not used to train any artificial intelligence model.

The app and its database run on a private server rented in France, at OVH. The database is a single SQLite file on that machine. Your data does not leave it, apart from the backups described below.

Beyond the host, one company is involved: Resend, which delivers transactional email — invitation, welcome, password reset. It receives your email address and the text of those messages, never the contents of your goals. That is the whole list.

The database is backed up in full every night. The backup is encrypted, kept thirty days, then deleted.

One copy is pulled down each day to a private machine in Switzerland, in case the server is lost. So anything you delete is gone from the backups within thirty days at the most.

Export: from Settings you download your account details and all of your content, at any time, as one readable JSON file. No form to fill in, nobody to email.

Delete: from Settings you erase your account. It is permanent and it is real — account, goals, todos, hours, rituals, retro notes, all of it goes in a single transaction.

Correct: your email address and your language change from Settings. These rights come from Swiss data protection law and, if you live in the EU or the EEA, from the GDPR. You can also complain to your national supervisory authority, or to the Swiss FDPIC.

Simple Goals is published by Mehdi Moussouli, an independent developer based in Switzerland, who decides what is done with this data. For anything about your data, write to hello@simple-goals.app.