Privacy Policy

Last updated: 2026-06-04

Who we are

nodegoals ("we", "us", "the Service") is operated by Node Goals LLC, a Hawaii limited liability company, at the address listed under Contact below. This Privacy Policy explains how we collect, use, and share personal data when you use the nodegoals web application.

What we collect

• Account data — email address, password hash, optional display name. Stored by our auth provider, Supabase.
• Content you create — projects, tasks, notes, comments, attached images, due dates, custom icons. Stored in our database.
• Mail thread metadata — when you attach a Gmail or Outlook thread to a task, we read the subject, sender, recipients, dates, message bodies, and attachment names of that conversation via Google's Gmail API or Microsoft Graph API. We only read messages you explicitly attach; we do not crawl, index, or store your entire inbox. Bodies are capped at 12,000 characters per message and stored alongside the related task.
• Usage data — basic logs (timestamps, IP address truncated to /24, browser user-agent) for security and abuse prevention, retained 30 days.
• Billing data — if you subscribe to a paid plan, our payment processor Stripe collects and stores your payment method. We receive only your customer ID, subscription status, and last 4 digits of your card; we never see or store full card numbers.

How we use it

• To operate the Service: render your projects/tasks, sync across devices, deliver notifications you've opted into.
• To provide AI features you invoke: we send the prompt and minimal task context to our AI provider (currently OpenAI and/or Anthropic) so they can generate the response. They process your input under their own privacy policies. We do not train AI models on your data and we contractually require our providers not to train on inputs sent through their API.
• To send transactional email (notifications, invites, daily digest) via our email provider, Resend. We honor your delivery preferences from Settings → Email Notifications.
• To process payments via Stripe.
• To detect abuse and protect the Service.

Who we share with

We share data only with sub-processors that help us run the Service:

• Supabase — database, authentication, file storage, realtime updates. Data hosted in their AWS regions.
• Vercel — application hosting, serverless functions, static asset delivery.
• OpenAI and/or Anthropic — AI inference for features like AI Import, Ask AI, and AI-suggested icons.
• Google (Gmail integration) and Microsoft (Outlook integration) — only when you explicitly attach a thread; only with the read-only scopes (gmail.readonly, Mail.Read).
• Resend — transactional email delivery.
• Stripe — payment processing (only for paying users).
• Meta Platforms (Facebook/Instagram) — advertising measurement via the Meta Pixel. It reports page views and account sign-ups so we can measure and optimize the ads we run. See Cookies, analytics & advertising below for what it collects and how to opt out.

We do not sell personal data to third parties. We do not use the content of your projects, tasks, notes, or AI prompts for advertising, and we never send that content to Meta. We do not share your data with any party not listed above except when required by law.

Gmail/Outlook API — Limited Use

nodegoals' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only request the gmail.readonly scope.
• We only access threads you explicitly attach to a task; we do not bulk read your inbox.
• We do not transfer Google user data to third parties except as needed to provide the integration (the data stays in your account on our database).
• We do not use Google user data to train AI models.
• You can disconnect Gmail at any time from Settings → Gmail integration → Disconnect, which clears the OAuth token from your browser.

Equivalent commitments apply to Outlook (Microsoft Graph) data accessed under the Mail.Read scope.

Regulated data — we don't accept it

nodegoals is not a HIPAA-, PCI-, or FERPA-compliant system. We have not signed Business Associate Agreements (BAAs) or equivalent data-processing agreements with our sub-processors covering those regulatory regimes. The Acceptable Use section of the Terms lists categories of data you must not store or process in the Service, including Protected Health Information (HIPAA), cardholder data (PCI-DSS), Social Security and other government IDs, financial-account credentials, FERPA-protected educational records, and export-controlled material. This applies to everything you put into the app: projects, tasks, comments, attached email threads, AI prompts — all of it.

If you accidentally entered prohibited data, you can remove it immediately by deleting the affected task / project / comment, or by using Settings → Account → Delete account to remove everything in one step.

Your rights

Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal data. To exercise any right, email support@nodegoals.com with the address tied to your account. We respond within 30 days.

You can also:

• Delete individual projects, tasks, comments, or images at any time from within the app.
• Delete your entire account by emailing us; we will remove all account-tied data from production systems within 30 days. Backups roll off within 90 days.
• Disconnect Gmail / Outlook / AI features without losing other data.

Data retention

• Account and content: kept while your account is active; deleted on account deletion (production within 30 days, backups within 90).
• Mail thread metadata: deleted when you remove the attachment from a task or delete the task.
• Server logs: 30 days.
• Stripe billing records: retained per Stripe's policy and applicable tax law.

Cookies, analytics & advertising

Most of what we store on your device is strictly necessary for the app to work:

• Supabase auth session (keeps you signed in until you sign out or it expires).
• Local cache of your projects and tasks so the app loads offline and survives reloads.
• Gmail OAuth token if you've connected Gmail, scoped to gmail.readonly, ~1 hour lifespan (auto-refreshed).
• MSAL cache if you've connected Outlook, scoped to Mail.Read.
• UI preferences — theme (dark/light), view mode (map/doc), legal acceptance timestamp, AI disclaimer dismissal.

Advertising measurement (Meta Pixel). Our site includes the Meta Pixel from Meta Platforms (Facebook/Instagram). It sets cookies and reports a small set of events — page views and account sign-ups, together with technical data such as your IP address, browser, and the page URL — to Meta so we can measure and optimize the ads we run. It does not send the contents of your projects, tasks, notes, attached email, or AI prompts. You can opt out by: using your browser's tracking protection or an ad/tracker blocker; adjusting your Meta ad preferences; or emailing support@nodegoals.com to request we exclude you. This pixel is the only non-essential technology we use.

Aggregate analytics (Vercel). We use Vercel Web Analytics, which counts page views and referrers in aggregate. It is cookieless and does not build a profile of you or follow you across other sites.

EU / UK / EEA visitors: the Meta Pixel is not strictly necessary, so it should run only with your consent. If you are in one of these regions and have not consented, contact us at the address above to opt out; we are working to add a regional consent control.

You can clear everything stored on your device by signing out and using your browser's "Clear site data" controls.

Security

We use TLS for all data in transit, Supabase Row-Level Security to isolate each user's data from others, and OAuth tokens are stored client-side in localStorage (Gmail) or MSAL cache (Outlook), never on our servers. No system is perfectly secure; if you believe your account has been compromised, email us immediately.

Children

nodegoals is not intended for users under 16. We do not knowingly collect data from children. If you believe a child has signed up, email us and we will delete the account.

International transfers

Our sub-processors operate in the United States and the European Union. Where required, we rely on Standard Contractual Clauses or equivalent transfer mechanisms.

Changes

We may update this policy. We will post the new version here with an updated "Last updated" date. Material changes will be announced in-app or by email.

Contact

Privacy-related questions, deletion/export requests, GDPR / CCPA rights: legal@nodegoals.com

General questions: support@nodegoals.com

Postal address (update this and legal/terms.html + the SENDER_POSTAL_ADDRESS Vercel env var if you change mailboxes):

Node Goals LLC
45-1116 Makamae St
Kaneohe, HI 96744
United States