Privacy

Vincent Goette, Mauracherstraße 6, 5020 Salzburg, Austria. vincentgoette@gmail.com reaches a person about anything on this page.

All of it, always. Projects, tasks, checklists, tracked time, estimates, notes, templates, planned calendar blocks, the trash and the full history of changes live in this browser’s own database (IndexedDB). The app is usable with no account at all, and in that case nothing described below ever happens.

Light or dark, and which colour palette, are kept in this browser’s localStorage along with how you have chosen to sort lists. They are about this screen, so they stay on it.

Signing in is optional and switches on one thing: the same data is also kept on a server, so your other devices can have it. What travels is what you see in the app — the rows themselves, and the log of changes that produced them, which is what lets two devices merge rather than overwrite each other.

Your email address is held so you can sign in. If you sign in with Google, Google tells us your address and an account identifier, and nothing else; we never receive your Google password.

A device identifier is generated in your browser — a random value, not derived from your hardware — so that a change can be attributed to the device it came from when two of them disagree.

• Vercel — serves the app itself and runs the handful of server routes it has; Frankfurt (fra1). Data processing agreement
• Supabase — stores the synced data, handles sign-in, and holds the key to any calendar you connect; Frankfurt (eu-central-1). Data processing agreement
• Google — receives the blocks you have planned, as events in a calendar of its own; wherever Google keeps your calendar — only if you connect a Google account yourself. Data processing agreement

Both are in the EU, and specifically in Germany rather than a general “Europe” region, which can mean London or Zurich. The database enforces per-row access rules, so a signed-in browser can read and write exactly the workspaces that account belongs to and nothing else.

• No analytics, no tracking, no profiling, no advertising.
• No cookies. The sign-in session is kept in localStorage, which is not sent with requests and belongs to this site alone.
• No fonts, scripts or images fetched from anyone else while you use it. The two typefaces are built into the app, so no request reaches Google when a page loads.
• Your data is never sold, shared or used to train anything.

Optional, off unless you ask for it, and the only part of Goatlist that requires an account. What is sent to Google is the blocks you have planned: a task’s title, whether it is finished, which project it belongs to, any note on the block, its time and its length, and a link back into the app. Nothing else — not your tracked time, not your other tasks, not your notes.

They go into a calendar called Goatlist that this app creates inside your account, never your main one, so you can hide it with one checkbox or delete every event it ever made in one go. Blocks travel one way only: Goatlist writes, Google shows. Moving an event in Google does not move the block back.

Google’s permission to write there is a long-lived key. It is kept on the server, in a table that the app running in your browser cannot read at all, and it is never sent to your browser. Disconnecting hands the permission back to Google and deletes the key; so does deleting your account, which does it first of everything. The events already in your calendar are left where they are — they are your record of what you planned.

If you connect two accounts, you can give each one a tag, so work tagged one way reaches one calendar and nothing else does.

One integration is planned and is not built. When it is, what it sends will be named here before it is switched on, and it will be optional:

• An assistant using Claude (Anthropic), which would receive what you type to it plus the part of your lists needed to answer.

On the server: as long as the account exists. Deleting the account removes it, and the app tells you how many rows went. In your browser: until you clear it, which you can do from Settings and which no server is involved in.

Deleted projects, tasks and notes go to a trash you can restore from rather than disappearing; they are gone for good when you empty it.

The change log — the record of what happened — is trimmed on your device: it keeps at least the last six months, and for every project at least its last hundred entries, plus anything that has not yet reached the server, which is never thrown away. On the server the log is not trimmed; it goes when the account goes.

Most of it you can simply do, without asking anyone and without a server being involved:

• A copy of everything — Settings → Backup exports a readable JSON file with every row, including the trash and the history, plus tracked time as CSV. That is access and portability in one button.
• Correction — it is your editor; change anything.
• Erasure — Settings → Account → Delete account removes the account and everything the server holds of it, and asks separately whether this device should be wiped too.

Beyond that you have the right to restriction, to object, and to lodge a complaint with a supervisory authority — Österreichische Datenschutzbehörde, or the authority where you live.

Everything described here is processing needed to provide the thing you asked for: an app that keeps your lists, and — if you sign in — keeps them on more than one device (Art. 6(1)(b) GDPR). There is no other purpose, so there is nothing to opt out of except the account itself.