Privacy policy

The provider named in the imprint is responsible for data processing on gaapp.io. You can reach us about privacy at hello@gaapp.io.

The application is provided through the Lovable platform and delivered via the Cloudflare network. Accounts, goals and settings are stored in a Supabase database in a data centre in Ireland (EU). When you visit, these providers process technically necessary data such as IP address, time and requested page to deliver the site and protect it from abuse. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Data processing agreements are in place or being concluded with these providers.

For your account we store your email address, first and last name, an optional profile picture and your goals, areas and settings. This is required to provide the service (Art. 6(1)(b) GDPR). If you sign in with Google, we receive your name, email address and profile picture from Google; sign-in is brokered by Lovable's sign-in service.

Payments are handled by Stripe (Stripe Payments Europe Ltd., Ireland). You enter card and bank details directly with Stripe; we never receive them. We store plan, term and payment status to fulfil the contract (Art. 6(1)(b) GDPR) and invoice data because of statutory retention duties (Art. 6(1)(c) GDPR). Stripe may transfer data to the USA based on the EU-US Data Privacy Framework or standard contractual clauses.

We send service emails (e.g. confirmation, password, payments) to fulfil the contract. Getting-started tips and reminders are sent via Brevo (Sendinblue GmbH, Berlin) based on our legitimate interest or your consent; marketing emails only with consent. Every such email contains an unsubscribe link.

We use strictly necessary storage (sign-in, language, appearance, your cookie choice) without consent (Section 25(2) TDDDG). Analytics and external content load only after your consent in the cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can change your choice at any time via “Cookie settings” in the footer.

Only with your consent we use Google Analytics 4 (Google Ireland Limited) with truncated IP addresses to understand which pages and features are used. Data may be transferred to the USA (EU-US Data Privacy Framework). Without consent Google Analytics is not loaded.

We load the Trustpilot review widget (Trustpilot A/S, Copenhagen) only after consent under “Marketing”; without consent we only show a link. If you give a 9 or 10 in our satisfaction question, our thank-you email may trigger an invitation to review us on Trustpilot; for this we share your name and email address with Trustpilot. The legal basis is our legitimate interest in genuine customer reviews; you can object at any time.

The support chat and the Planner (AI goal planning) send your messages to the AI model Claude by Anthropic, routed through Lovable's AI gateway. The Planner only sees titles and progress of your current goals if you agree in the Planner; you can turn this off there at any time. Please do not enter health or other particularly sensitive data in the chat. The legal basis is performance of the contract, or your consent for the goal context. Anthropic also processes data in the USA based on standard contractual clauses. The data is not used to train AI models. Ratings of individual answers (thumbs up or down) are stored without reference to your account.

We measure load times (Core Web Vitals) without cookies or user identifiers; only the value, page path and device type are stored. Technical errors from browser and server go to our own error monitoring (GlitchTip) on a server of Hetzner Online GmbH in the EU, without cookies, headers or user data; error data is deleted after 30 days. The legal basis is our legitimate interest in a fast and error-free application (Art. 6(1)(f) GDPR).

Our blog articles show labelled ads from partners (currently Prosp and TubeBuddy). The ads are part of our page: no partner scripts, cookies or pixels are loaded. We count how often an ad was visible and clicked, per day, article, position and ad variant, without IP address, cookie or user identifier (legitimate interest in evaluating our ad spaces, Art. 6(1)(f) GDPR). With consent to analytics, a click is also recorded in Google Analytics. A click leads through our redirect to the partner's site; only there do the partner's privacy terms apply, and the affiliate link tells the partner that you came from us. If this leads to a purchase, we receive a commission; your price does not change.

Only when you turn it on, your name, picture and selected yearly goals are publicly visible. You can turn this off again at any time.

We keep account data and goals as long as your account exists. You can delete your account yourself at any time under Settings → Delete account, or write to hello@gaapp.io. Invoice and payment data are kept for up to ten years because of statutory duties, after account deletion without reference to your account. Error data is deleted after 30 days; load-time measurements contain no personal data.

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. You can withdraw consent at any time with effect for the future. Write to us at hello@gaapp.io. You can also lodge a complaint with a data protection supervisory authority.