This policy explains what personal data Good Work collects, why, who helps process it, how long it is kept, and what you can do about it. It is written to be read, not skimmed past.
Who is responsible
Good Work (good-work.app) is run by Henrique Pacheco, an individual based in Portugal, who is the controller of your personal data under the EU General Data Protection Regulation (GDPR). For any privacy question or request, email goodworkfeedback@gmail.com.
What we collect
- Account details: your name, email address and password. Passwords are handled by our authentication provider and stored only as a secure hash.
- What you track: the metrics, life dimensions, targets, logged values and dates, and tasks you create.
- Family: your family's name, its members' names, email addresses and roles, and the email addresses of people you invite.
- Integrations, if you connect one: for Withings, the access tokens that let us sync (encrypted), your Withings user ID, the measurements we import (such as sleep, weight, activity and heart rate) and a log of each sync.
- Billing, if you subscribe: payments are processed by Stripe, which holds your card details. We only store your Stripe customer and subscription IDs, your plan and its status.
- Feedback: when you send feedback from the app, we receive your message, your email address and your account ID.
- Activity records: account and family events such as signing up, signing in and inviting a member, with the time they happened.
- Usage and performance: page views, referring pages, browser and device type, and page load times, collected with Vercel Web Analytics and Speed Insights. These tools don't use cookies and don't follow you across other websites.
Some of what you track may be health information, such as sleep or weight. That is a special category of data under the GDPR. We only process it because you choose to record it or connect a device, and only to show it back to you.
Why we use it
- To provide Good Work (performing our contract with you): running your account, storing and showing your data, syncing integrations, managing your family and your subscription.
- With your explicit consent: processing health information you record or sync. You can withdraw consent at any time by deleting that data, disconnecting the integration or deleting your account.
- For legitimate interests: keeping the service secure, fixing problems, understanding which pages are used in aggregate, and answering your feedback.
- To meet legal obligations: keeping billing records as tax law requires.
We don't show ads, we don't sell your data, and we don't use it to profile you for anyone else.
Who helps us process it
We use a small number of providers, each only for what they do for Good Work:
- Supabase: database and authentication.
- Vercel: hosting, analytics and performance monitoring.
- Stripe: payments and subscriptions.
- Withings: only if you connect it. Withings' own privacy policy covers your Withings account.
- Resend: delivering feedback messages to us by email.
- Google: the email inbox where we receive feedback and support requests.
Some of these providers may process data outside the European Economic Area. Where they do, they rely on safeguards recognised under the GDPR, such as the European Commission's Standard Contractual Clauses.
How long we keep it
- Your account and everything you track are kept for as long as you have an account.
- When you delete your account, your account and tracking data are deleted from our database straight away. Copies in our providers' backups are removed as those backups expire.
- Stripe keeps billing records for as long as tax and accounting law requires.
- Feedback emails are kept only as long as needed to handle them.
Your rights
Under the GDPR you can:
- Access and take your data with you: download it as CSV files from Settings → Account, or ask us for a copy.
- Correct it: edit your details and data in the app, or ask us.
- Delete it: delete your account from Settings → Account, or ask us.
- Restrict or object to how we process it, and withdraw consent at any time.
Email goodworkfeedback@gmail.com for any request. We'll reply within one month. If you're not happy with the answer, you can complain to a data protection authority. In Portugal that is the Comissão Nacional de Proteção de Dados (CNPD).
Cookies and local storage
Good Work only uses what it needs to work: a sign-in cookie that keeps you logged in, and your browser's local storage to remember your light or dark theme. There are no advertising or tracking cookies, which is why you don't see a cookie banner.
Security
Your data is encrypted in transit and at rest, and integration tokens are encrypted separately before they are stored. Access to your data is limited to your own account.
Children
Good Work is not intended for children under 16, and we don't knowingly collect their data.
Changes to this policy
When this policy changes, we update the date at the top. For significant changes, we'll tell account holders before they take effect.