Version 2026-08-09.1
Privacy Policy
Effective: August 9, 2026
Last updated: August 9, 2026
GoalSave helps students build budgeting and savings habits without connecting a bank account, moving money, or making their progress public.
Privacy at a glance
You choose what to enter
Financial-planning information is entered manually. GoalSave does not connect to a bank or receive complete payment-card numbers.
Your progress stays private
GoalSave has no public profiles, social feed, behavioral advertising, or sale of personal information.
Age and location come first
GoalSave currently accepts only people in the United States who are at least 13. Ineligible selections do not create an account or device session.
You have choices
You can update information, export records, reset app data, request account deletion, or submit a privacy request.
1. Who this policy covers
GoalSave is the operator responsible for the services described in this policy. This policy applies to the GoalSave browser website at https://college-save-student.cool-cool-man.chatgpt.site, including its account, budgeting, learning, billing, and privacy-request features. The current service is offered only in the United States.
Questions may be sent to goalsavesupport@gmail.com or through the GoalSave privacy-request form.
2. Information GoalSave processes
Eligibility information
Before creating an account, device session, analytics record, or GoalSave browser storage, GoalSave asks whether you are 13–17 or 18 or older and whether you are located in the United States. It does not ask for your exact birth date at this screen.
Account and authentication information
This may include a Supabase user ID, email address, verification status, authentication provider, optional first or display name, anonymous-session status, and session information. If you choose Google login, GoalSave receives the Google account identifier, verified email, and basic profile information allowed by the standard openid, email, and profile permissions. GoalSave does not request Google Drive, contacts, calendar, or financial-account access. Supabase processes password hashes; GoalSave does not receive your password itself.
Information you enter
This may include grade and graduation year; currency; estimated income, pay schedule, and balance; manually entered transactions and notes; monthly budgets; savings goals and contributions; tracked subscriptions; lesson progress and quiz responses; weekly check-ins; preferences; achievements, XP, streaks, challenges, and related progress. GoalSave’s calculations and suggestions are rule-based, not AI financial advice.
Pre-purchase planning information
A plan created before purchase may include a goal name or type, target, amount already saved, timing, income cadence, proposed contribution, selected access plan, and onboarding step. After the age screen, this draft may be stored in that browser until imported or cleared.
Billing and legal records
GoalSave may process the selected plan, entitlement and subscription status, an account key, Stripe customer, checkout-session and subscription identifiers, billing-period end, purchase-flow events, Stripe webhook event details, policy versions, recurring-billing consent, guardian purchase approval, and acceptance times. Stripe receives payment and billing details in its hosted checkout. GoalSave does not receive complete card numbers or store them.
Privacy requests and technical information
A privacy request may include your email, relationship to the account holder, request type, optional details, reference number, status, and submission time. GoalSave and its providers may also process IP address, request time, requested URL, referrer, browser or device information, security signals, cookie or session identifiers, logs, and IP-derived approximate location. GoalSave does not request precise GPS location.
3. Where information comes from
Information comes from you, your browser, Google or email authentication, Stripe, automatic website and security logs, and calculations based on information you entered. GoalSave does not buy personal information from data brokers or obtain it from advertising or social-media marketing partners.
4. How GoalSave uses information
- provide accounts, device sessions, dashboards, budgets, goals, subscription tracking, lessons, exports, and synchronization;
- calculate balances, progress, monthly plans, badges, and educational suggestions;
- authenticate users, recover accounts, link verified identities, and protect sessions;
- create Stripe checkout and billing-portal sessions, verify payment, preserve access, prevent duplicate fulfillment, and process billing changes;
- record policy acceptance, recurring-billing consent, and guardian purchase approval;
- measure the first-party onboarding and purchase flow without advertising trackers;
- prevent abuse, investigate errors, maintain security, enforce terms, respond to requests, and comply with law.
5. Cookies and browser storage
| Technology | Purpose | Type |
|---|---|---|
goalsave_age_gate | Stores the policy version, broad age range, and U.S. eligibility choice. | Strictly necessary, first party |
| Supabase authentication cookies | Support secure login, anonymous device sessions, and session refresh. | Strictly necessary |
goalsave_legal_pending | Carries policy versions and acceptance time through signup or verification for a short period. | Strictly necessary, first party |
| GoalSave local storage | Stores a pre-purchase plan, account-scoped app cache, and migration or synchronization markers. | Functional, first party |
| Cloudflare Turnstile | Processes security tokens and signals used to prevent bots and abuse. | Strictly necessary security |
The current release does not use advertising cookies, cross-site behavioral trackers, optional third-party analytics cookies, browser push subscriptions, or a service-worker cache. Because the current release uses only necessary and functional storage, it does not display a consent banner. GoalSave will reassess this before adding optional tracking or expanding outside the United States.
Clearing browser data may delete an unprotected plan or local cache, end a device session, and require a new login. It does not by itself delete account-linked server information or Stripe records.
6. First-party analytics, advertising, and Global Privacy Control
GoalSave records a limited set of onboarding and purchase-flow events using a one-way account identifier. Those events do not include card details, transaction amounts, budget amounts, savings balances, lesson answers, or notes. GoalSave does not use an external advertising or behavioral-analytics provider, sell personal information, or share personal information for cross-context behavioral or targeted advertising.
Because sale and targeted-advertising sharing are not performed, a Global Privacy Control signal does not need to change an advertising setting. If GoalSave introduces a covered sale or targeted-advertising practice, it will treat supported GPC signals as opt-out requests and update this policy first.
7. When information is disclosed
GoalSave discloses limited information to service providers that operate the service:
- Supabase provides authentication, anonymous sessions, email verification, password recovery, and Google identity brokerage.
- Google provides user-selected OAuth login and its own consent screen.
- Stripe provides hosted checkout, payment processing, subscriptions, invoices or receipts, fraud prevention, the customer portal, and billing webhooks.
- OpenAI Sites and Cloudflare infrastructure provide website delivery, edge processing, database storage, security, logs, and availability.
- Cloudflare Turnstile provides bot and abuse prevention.
- Supabase and its configured email-delivery providers send verification and password-reset messages.
GoalSave may also disclose information when reasonably necessary to comply with law, protect rights or safety, investigate fraud or abuse, complete a business transaction with appropriate safeguards, or follow your direction. GoalSave does not make individual purchases, goals, balances, notes, or lesson responses public.
8. Retention and deletion
| Category | How long it is kept |
|---|---|
| Account and app information | While your account is active and the information is needed to provide GoalSave, unless you delete it or ask GoalSave to delete it. |
| Anonymous sessions and browser information | Until the session expires, is cleared, is upgraded to a protected account, or is removed under provider and browser lifecycle rules. |
| Local plan and cache | Until imported, reset in GoalSave, cleared in browser settings, or removed by the browser. |
| Billing, consent, tax, fraud, and dispute records | For as long as reasonably necessary to provide or prove access, process billing, resolve disputes, prevent fraud, and meet accounting, tax, contractual, or legal obligations. |
| First-party analytics, privacy requests, logs, and backups | For the shortest period reasonably needed for reliability, security, request handling, legal compliance, and provider backup cycles, after which records are deleted, aggregated, or overwritten. |
Resetting budgeting data removes the account-linked app state and local cache but keeps the login, verified purchase, and records GoalSave must retain. Account deletion removes the GoalSave app state and authentication account when the deletion service is available, subject to limited records that must be retained. Neither action cancels Monthly Access; use Manage or cancel subscription separately before deleting an account.
9. Security
GoalSave uses safeguards appropriate to the service, including HTTPS, secure session controls, provider-managed password hashing, server-side purchase verification, signed and deduplicated Stripe webhooks, request validation, account-keyed storage, and restricted secrets. No online service can guarantee perfect security. If GoalSave confirms a security incident, it will investigate, contain the risk, work with relevant providers, and give notices required by applicable law.
10. Your privacy choices and rights
Depending on where you live and whether a privacy law applies to GoalSave, you may have rights to access, confirm, correct, delete, or obtain a portable copy of personal information; limit certain sensitive-data uses; use an authorized agent; and appeal a denied request. GoalSave will not discriminate against you for exercising a privacy right.
You can update profile information, export account information, reset budgeting data, or request account deletion from Profile. You may also use the privacy-request form or email goalsavesupport@gmail.com. GoalSave may verify your account, identity, relationship, or authority before acting. Do not send passwords, full payment-card numbers, or government IDs unless GoalSave specifically determines that additional verification is legally necessary.
11. Teens, parents, and children under 13
GoalSave is designed for students age 13 and older and uses private-by-default settings. GoalSave blocks account and device-session creation for children under 13 because it does not operate a verifiable parental-consent program under COPPA. If GoalSave learns that it collected personal information from a child under 13 without valid authorization, it will take reasonable steps to delete it.
A parent or guardian may submit a request on behalf of a minor, subject to verification of identity, relationship, authority, and any independent privacy rights the teen has. A parent’s purchase approval does not automatically provide access to the teen’s transactions, notes, check-ins, or lesson responses.
12. Schools and international users
GoalSave is not currently offered through schools and does not provide a teacher, counselor, or school-administrator dashboard. Schools should not require students to use this consumer release. GoalSave’s current age screen also blocks visitors who select a location outside the United States. GoalSave will review the additional legal, contractual, transfer, and youth-safety requirements before launching a school or international version.
13. Changes to this policy
GoalSave may update this policy when its services, providers, or legal obligations change. The version and date above will be updated, and GoalSave will provide additional notice or request renewed consent when required by law. GoalSave will not silently expand its use of students’ information beyond this policy.
14. Contact and complaints
For privacy questions, accessibility help, billing support, or an appeal, email goalsavesupport@gmail.com or submit the privacy-request form. Include the email connected to the account and enough detail to understand the request. You may also contact your state attorney general or another privacy regulator that has authority over your concern.