Skip to content
JupiterGoals AI
Start free

Privacy Policy

Last Updated:

JupiterGoals AI helps you plan and keep many goals at once. This website and the JupiterGoals AI web application are operated by JUPITERGOALS LTD, a company registered in England and Wales under company number 17557880, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ ("JupiterGoals AI", "we", "us", or "our"). JUPITERGOALS LTD (Company No. 17557880) at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ acts as the Data Controller for personal data in the JupiterGoals application and on this website under the UK GDPR and the Data Protection Act 2018 (while Sold through Link, LLC acts as an independent data controller for Merchant of Record billing and tax records on paid purchases, as detailed below). For all privacy, data rights, customer support, billing, and legal inquiries, contact support@jupitergoals.com.

This policy explains what we collect, why, who processes it for us, and what your data never does. It covers this website and the JupiterGoals app, which is for people aged 18 and over.

1. What We Collect

  • Identity and authentication: Google sign-in through Firebase Authentication receives your name, email address, and profile picture. Our application database stores your sign-in identifier, the chosen first name you want us to call you (pre-filled from Google and changeable at any time), and your sign-in email address solely for reminder delivery, billing and Stripe synchronization, and founder support or feedback replies. Your email address is strictly quarantined, never entered into language model prompts or synthetic training sets, and permanently deleted when your account is deleted. Our database does not store your full name.
  • Updates list: An email address submitted on the marketing site is kept in Google Firebase until you unsubscribe, and its welcome email is sent through Resend.
  • Accountability and co-doing partners (optional): An invited email accountability partner provides their own first name alongside their email address, which is stored only once they confirm from the confirmation email; a removed partner's name and address are erased immediately, and a departed partner's details are erased once the weekly review reports the departure, keeping only a cryptographic hash of the address for suppression. On Guest Co-Doing goals, no shadow user account is created and the invite link page shows only your first name, shared goal name, stage and weekly counts, upcoming 7-day session times, generic personal-data-free session steps, and shared completion counts. On Peer Plan Pairing between two registered accounts, neither customer sees the other's private task text, task scratchpad notes, financial figures, obstacle notes, health data, or coach messages (only first name, shared goal name, same-day completion status, and weekly or joint session counts). Partner names, email addresses, and partner-side states are shown only to the paired customer, never to other partners. Short plain-text partner cheers (up to 140 characters, with links and email addresses rejected and shown only to the customer) and partner contact details are excluded from product telemetry, model training, account data exports, and AI model prompts (shared plans pass only an anonymized co-doing flag). Your account export includes only your own shared completion timestamps without partner personal data, and unlinking or account deletion cleanly severs pairings.
  • Goals and what you write or speak: Your goals, answers, spoken or typed coach messages, check-ins, task scratchpad notes, and private obstacle notes. These may include information about your physical or mental health, which is always optional to share. Task scratchpad notes are kept with your task, included in your 1-tap personal data export, and permanently erased when your account is deleted. Both task scratchpad notes and private obstacle notes are strictly quarantined so they never enter language model prompts, synthetic training generation, or any model fine-tuning sets.
  • Voice dictation and spoken audio (optional): Transient compressed microphone audio when you use microphone dictation or send a voice message to the coach (uploaded transiently to encrypted cloud storage in Western Europe solely to transcribe your words via our runtime AI model provider (currently Google's Gemini API), deleted immediately when the transcription or coach turn settles and pruned automatically within 1 day, never archived or used to train any models; offline dictation uses on-device browser speech recognition where supported), plus privately cached synthesized coach audio clips and morning briefing spoken audio (pruned automatically after 7 days) in encrypted cloud storage in Western Europe when server-synthesized speech is used (on-device browser speech synthesis stores zero server audio files).
  • Progress: What you tick off, the sizes you choose, pauses, and reviews.
  • Technical data: Your IP address and browser and device details, recorded in our technical server logs to keep the service secure and working, and retained for 30 days. On account creation, sign-in link campaign parameters, referring hostname, and coarse signup country and region (derived transiently in memory from edge geolocation headers, in-memory IP lookup without storing IP addresses, or account timezone, without tracking cookies or browser storage) are recorded to understand how customers found the service, and acquisition, product telemetry, and model-correction records are permanently deleted with the account.
  • Web Push notifications: If you turn on browser or mobile Web Push notifications, we store your browser's Web Push subscription endpoint and public encryption keys to send end-to-end encrypted notifications through your browser's push service (Google, Apple, or Mozilla), and unregister that endpoint when you sign out, turn reminders off, or revoke browser permission.
  • Progress snapshots (optional): Optional customer-captured progress snapshots are stored privately in encrypted cloud storage in Western Europe for your personal progress flipbook and deleted immediately upon snapshot, plan, or account deletion.
  • Local Weather (optional): When optional Local Weather is connected, hourly precipitation and temperature forecasts are requested server-side from MET Norway (api.met.no, CC BY 4.0, Norway / EEA) using only coarse coordinates rounded to 2 decimal places (roughly a 1.1 km city grid) with zero user identifiers, account tokens, task text, or client IP addresses sent. Weather data from MET Norway.

Payment, Subscriptions & Merchant of Record

  • Stripe & Sold through Link, LLC (Merchant of Record): Stripe processes payment cards and subscriptions. For paid subscriptions and Pledge top-ups, Sold through Link, LLC (Stripe's US Merchant of Record entity, formerly LemonSqueezy LLC) acts as an independent data controller in the United States for buyer billing details, indirect tax calculation and remittance, fraud prevention, and tax receipts under UK International Data Transfer Addendum (UK IDTA) and EU Standard Contractual Clauses (EU SCC) transfer safeguards and Link's privacy terms at link.com.
  • Separate Link and JupiterGoals account deletion: Deleting a Link account removes saved Link payment credentials without erasing your JupiterGoals account until you delete your JupiterGoals account on /account/profile.
  • Zero card numbers stored & trial card fingerprints: JupiterGoals never handles or stores payment card numbers, retaining only opaque Stripe customer and subscription identifiers (alongside non-monetary subscription consent audit records while your account is open). To enforce the one-trial-per-card lifetime ceiling without holding payment card data, one-way cryptographic card fingerprint hashes are stored and preserved across account deletion solely for trial reset prevention.

Google Calendar Integration & Calendar Feeds

  • Google Calendar integration (optional): JupiterGoals requests read-only https://www.googleapis.com/auth/calendar.freebusy (calendar.freebusy) on your primary calendar solely to detect busy time blocks so tasks are scheduled into open time slots (never accessing, parsing, or sending existing event titles, descriptions, attendee lists, links, or locations to language models), and optionally requests https://www.googleapis.com/auth/calendar.app.created (calendar.app.created) only when 7-day session sync is enabled, writing session blocks exclusively to one secondary "JupiterGoals" calendar that the app creates and deletes upon Disconnect when confirmed. When 7-day session sync is active on a shared or paired goal, outbound session block titles append (with [Partner]).
  • Read-only .ics calendar feeds (optional): Customers can subscribe in Apple Calendar, Outlook, or any compatible calendar application to token-authenticated, read-only .ics calendar feeds exporting active scheduled sessions without personal notes, revocable instantly upon feed reset or account erasure.

Google Health Integration

  • Google Health integration (optional): JupiterGoals requests only two read-only scopes after you grant explicit affirmative consent in-app: https://www.googleapis.com/auth/googlehealth.sleep.readonly (googlehealth.sleep.readonly, for sleep duration and wake time, used to align the morning briefing to your real wake-up and offer a lighter day after a short night under 5 hours) and https://www.googleapis.com/auth/googlehealth.activity_and_fitness.readonly (googlehealth.activity_and_fitness.readonly, for workout session type, start time, and duration, used to tick matching scheduled workouts and credit unplanned workouts).
    • Individually optional permissions: Each of the two Google Health permissions is individually optional on Google's consent screen: if you grant only one permission, JupiterGoals stores only that granted permission and runs only the feature it serves, and granting neither saves nothing.
    • Data never requested or accessed: Nutrition data is never requested from Google Health. Raw biometric feeds such as continuous heart rate, ECG, blood oxygen, GPS tracks, and step cadences are never accessed or stored.

    A night's sleep duration and wake time are ephemeral, kept only for the day they describe, and automatically deleted when that day ends (at the pre-wake local day rollover, 30 minutes before your next morning briefing or wake time in your local timezone). Workout session records are kept with your account to tick matching scheduled workouts and credit unplanned workouts until you disconnect Google Health or delete your account.

JupiterGoals' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2. How We Use It

We use your data only to run JupiterGoals for you:

  • Your plan and coach: What you write or speak about your goals (without your email address or full name) is sent to our runtime AI model provider (currently Google's Gemini API), which processes it on JupiterGoals' behalf to draft and adjust your plan and generate coaching replies, and screens goals and coach messages for safety risk. When you let a goal go or retry one, that plan's session counts, milestone titles, and any saved lesson note are also sent to our runtime AI model provider (currently Google's Gemini API) to draft your reflection or shape the retry. Prompts are kept by the provider only for abuse detection and are never used to train Google's or any public foundation models.
  • Voice dictation and voice messages: When you use microphone dictation or send a voice message to the coach, compressed microphone audio is uploaded transiently to encrypted cloud storage in Western Europe, sent to our runtime AI model provider (currently Google's Gemini API) solely to transcribe your words, and permanently deleted from storage immediately when the transcription or coach turn settles (whether it succeeds or fails, with automatic pruning within 1 day for any residual transient uploads). Voice recordings are never retained as an archive and are never used to train any models. When offline, dictation uses on-device browser speech recognition where supported.
  • Your safety: Goals and coach messages are screened automatically for safety risks so that, if they suggest you may be at risk, we show you support services instead of a plan.
  • Your day: Primary Google Calendar busy time blocks, each night's sleep duration and wake time (when granted), and connected Local Weather shape when your morning briefing aligns to your real wake-up, when tasks are scheduled into open time slots, when a lighter day is offered after a short night under 5 hours, and when optional indoor or dry-hour session swaps are offered on inclement days. When 7-day session sync is enabled, session blocks are written exclusively to one secondary "JupiterGoals" calendar created by the app. Recorded workout sessions (when granted) tick matching scheduled workouts and credit unplanned workouts, while nutrition data is never requested from Google Health.
  • In-app Pledges and commitment boosts: To track your non-monetary in-app Pledge credit balance and any credits allocated to a plan as an optional commitment boost until the plan cycle completes.
  • Emails: Service emails, such as reminders you turn on and weekly progress summaries to confirmed accountability partners, are sent through Resend. Product updates are sent only if you subscribe, and you can unsubscribe at any time.

3. Why the Law Lets Us Use It

Each use above rests on one of these lawful bases under UK GDPR:

  • Our contract with you: Running your account, building and adjusting your plan, answering the coach, sending the reminders and push notifications you turn on, and managing subscriptions and billing (including recording non-monetary subscription consent audit records).
  • Your explicit consent: Reading sleep duration and wake time and/or workout session type, start time, and duration from Google Health after you grant explicit affirmative consent in-app (where each of the two Google Health permissions is individually optional on Google's consent screen, storing and running only what you grant, saving nothing if you grant neither, and never requesting nutrition data), which you can withdraw at any time with one tap on Disconnect in Profile.
  • Your consent: Connecting Google Calendar or Local Weather, turning on Web Push notifications, receiving product update emails, and sending accountability partner emails, each of which you can withdraw or stop at any time.
  • Our legitimate interests: Keeping the service secure and free of abuse through 30-day technical server logs, enforcing the one-trial-per-card lifetime ceiling using one-way cryptographic card fingerprint hashes without holding payment card numbers, screening goals and coach messages for safety risks, evaluating and improving JupiterGoals' own planning quality offline from de-identified plan edits (excluding all quarantined data in Section 5), recording cookieless sign-up attribution on account creation to understand how customers found the service, and counting visits to this website with cookieless Cloudflare Web Analytics to improve it.
  • Legal obligation: Complying with statutory record-keeping requirements; for paid subscriptions and Pledge top-ups, Sold through Link, LLC (Stripe's US Merchant of Record entity) acts as an independent data controller to fulfill statutory indirect tax calculation, tax remittance, and invoicing obligations.

4. Decisions Made Automatically

AI writes and adjusts your plan and the coach's replies, and an automatic safety screen can decline high-risk goals and show you support services instead of building a plan. None of these automated decisions has a legal or similarly significant effect on you. You have the right to request human review of any automated decision: if you disagree with one, email us and a person will look at it.

5. What Your Data Never Does

  • Strict LLM and training data quarantine: Sign-in email addresses, accountability and co-doing partner details and cheers, Google Health data, Google Calendar free/busy slots, voice recordings, task scratchpad notes, and private obstacle notes are strictly quarantined and never entered into language model prompts, synthetic training generation, any model fine-tuning sets, advertising, or data sales. Only deliberate goal structures and facts you explicitly state are retained as personal context.
  • Never used to train public or third-party AI models, and never sold: Prompts sent to our runtime AI model provider (currently Google's Gemini API) are retained by the provider only for abuse detection and never used to train Google's or any public foundation models, voice recordings are never archived or used to train any models, and personal data is never sold or shared with advertisers or data brokers. Where de-identified plan edits and approvals are used offline to evaluate and improve JupiterGoals' own internal planning models, personal identifiers are scrubbed beforehand and you can object at any time under Section 7.
  • Google Limited Use: JupiterGoals' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Where It Is Kept and for How Long

Infrastructure & Data Sovereignty

Application data, media, and short-lived recovery backups are hosted with encrypted cloud database and storage providers in the United Kingdom and Western Europe, encrypted in transit and at rest. Deleted accounts are erased immediately from active systems and automatically purged from encrypted recovery backups within 72 hours, and wearable health records (sleep and workouts), product telemetry, and model corrections are excluded from recovery backups. Under UK GDPR and the Data Protection Act 2018, service processors named in this policy act only on our instructions, except Sold through Link, LLC when acting as an independent data controller as Merchant of Record for paid transactions.

Transfers Outside the UK

Transfers to providers in the United States cover Sold through Link, LLC (Stripe's US Merchant of Record entity, formerly LemonSqueezy LLC, acting as an independent data controller for buyer billing details, indirect tax calculation and remittance, fraud prevention, and tax receipts under Link's privacy terms at link.com), Stripe, Firebase Authentication (Google), our runtime AI model provider (currently Google's Gemini API) , and Resend, safeguarded under UK International Data Transfer Addendum (UK IDTA) and EU Standard Contractual Clauses (EU SCC) transfer safeguards (and the UK-US Data Bridge where certified). Prompts sent to our runtime AI model provider (currently Google's Gemini API) are retained by the provider only for abuse detection and are never used to train Google's or any public foundation models.

When optional Local Weather is connected, hourly precipitation and temperature forecasts are requested server-side from MET Norway (api.met.no, CC BY 4.0, Norway / EEA), which receives only coarse two-decimal weather coordinates (roughly a 1.1 km city grid) without user identifiers, account tokens, task text, or client IP addresses. Weather data from MET Norway.

Feature & Account Retention Windows

A night's sleep duration and wake time are ephemeral, kept only for the day they describe, and automatically deleted when that day ends (at the pre-wake local day rollover, 30 minutes before your next morning briefing or wake time in your local timezone). Workout session records are kept with your account to tick matching scheduled workouts and credit unplanned workouts until you disconnect Google Health or delete your account. Optional customer-captured progress snapshots are stored privately in encrypted cloud storage in Western Europe for your personal progress flipbook and deleted immediately upon snapshot, plan, or account deletion. Compressed microphone audio from dictation or voice messages to the coach is uploaded transiently to encrypted cloud storage in Western Europe solely for transcription, permanently deleted immediately when the transcription or coach turn settles (whether it succeeds or fails), and pruned automatically within 1 day. When server-synthesized coach speech is requested, synthesized coach audio clips are cached privately in encrypted cloud storage in Western Europe, bounded to the 10 most recent clips per coach thread with older clips pruned automatically, and permanently erased on plan deletion or self-serve account deletion. When server-synthesized briefing speech is used, synthesized morning briefing spoken audio is cached privately in encrypted cloud storage in Western Europe, pruned automatically after 7 days, and permanently erased on self-serve account deletion. Where on-device browser speech synthesis is used, speech runs locally in your browser with zero server audio files stored.

Technical server logs are kept for 30 days. An email address submitted on the marketing site updates list is kept in Google Firebase until you unsubscribe. Token-authenticated read-only .ics calendar feed credentials are revoked immediately upon feed reset or account erasure. A removed accountability partner's name and address are erased immediately; a departed partner's details are erased once the weekly review reports the departure, keeping only a cryptographic hash of the address for suppression, partner details are deleted when a goal ends, and unlinking or account deletion cleanly severs any Guest Co-Doing or Peer Plan Pairing links. We keep your remaining account data (including acquisition, product telemetry, model-correction, and non-monetary subscription consent audit records) while you have an account and permanently delete it immediately when you delete your account on /account/profile (and automatically purge it from encrypted recovery backups within 72 hours), except one-way cryptographic card fingerprint hashes, which hold no payment card data and are preserved across account deletion solely for trial reset prevention, while buyer tax records and any saved Link credentials held independently by Sold through Link, LLC remain governed by Link at link.com.

7. Your Rights

You hold a 1-tap JSON archive download of the personal data you gave JupiterGoals, alongside instant, irreversible self-serve account deletion without waiting periods or support tickets and one-tap disconnection to withdraw consent for connected services. You can also email support to exercise your UK GDPR rights of access, rectification, restriction, or objection (with a reply within one month), and you have the right to complain to the UK Information Commissioner's Office (ICO):

  • Withdraw consent (one-tap disconnection): Withdraw consent for connected services (Google Health, Google Calendar, or Local Weather) at any time with one tap on Disconnect in Profile, which immediately revokes OAuth tokens with Google, clears stored consent, purges cached sleep and workout records without penalty (tasks already marked completed stay completed), and deletes the secondary "JupiterGoals" calendar when confirmed; disconnecting Local Weather immediately clears your saved coarse weather coordinates, and resetting a read-only .ics calendar feed immediately revokes the prior feed token.
  • Export: Hold a 1-tap JSON archive download from Profile of the personal data you gave JupiterGoals.
  • Delete: Permanently and irreversibly delete your JupiterGoals account immediately through self-serve deletion on /account/profile without waiting periods or support tickets (deleting a Link account at link.com removes saved Link payment credentials without erasing your JupiterGoals account until deleted on /account/profile).
  • Access, rectification, restriction, or objection: Email us at support@jupitergoals.com to exercise your UK GDPR rights of access, rectification, restriction, or objection (including objecting to our use of your data on the grounds of legitimate interests or asking us to restrict processing while a question is settled), with a reply within one month.
  • Complain to the ICO: You have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies

Under the UK Privacy and Electronic Communications Regulations (PECR), the app stores only essential authentication and settings data to keep you signed in and remember your preferences, using no tracking or advertising cookies.

This marketing site counts visits with Cloudflare Web Analytics without cookies, passes sign-up link attribution in memory without cookies or browser storage, and does not track you across sites (Cloudflare may set a strictly necessary security cookie to protect the site from bots). Because the app stores only essential authentication and settings data and the marketing site counts visits with Cloudflare Web Analytics without cookies, no consent banner is required.

9. Contact Us

JUPITERGOALS LTD is a company registered in England and Wales (Company No. 17557880) with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. JupiterGoals™ is a trade mark of JUPITERGOALS LTD. JUPITERGOALS LTD (Company No. 17557880) at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ acts as the Data Controller for personal data in the JupiterGoals application and on this website under the UK GDPR and the Data Protection Act 2018 (while Sold through Link, LLC acts as an independent data controller for Merchant of Record buyer billing and tax records under Link's privacy terms at link.com). For all privacy and data rights requests, customer support, billing inquiries, and legal notices, contact support@jupitergoals.com.