Privacy Policy

This Privacy Policy explains how HomeGoal (“we”, “us”, “our”), operated by Andreas Heinzerling, processes personal data when you visit https://homegoal.app or use our application. It is intended to meet transparency requirements under the EU General Data Protection Regulation (GDPR), applicable German law (including the BDSG), and comparable international privacy principles.

Controller: Andreas Heinzerling, Schleiermacherstraße 16, 60316 Frankfurt am Main, Germany. Email: contact@homegoal.app.

1. Data we process

• Account data: email address, authentication credentials/tokens, and account metadata.
• Profile and planning inputs: information you enter such as income, expenses, savings, home budget, goals, missions, events, and related scores/history.
• Billing data: subscription status, plan selection, trial eligibility/redemption for your email, and payment-related identifiers processed via Stripe (we do not store full card numbers).
• Support communications: messages you send to us (for example by email).
• Technical data: IP address, device/browser information, timestamps, security logs, and basic usage telemetry required to operate and protect the service.

2. Purposes and legal bases (GDPR)

• Contract performance (Art. 6(1)(b) GDPR): creating accounts, providing coaching features, processing subscriptions, and customer support.
• Legitimate interests (Art. 6(1)(f) GDPR): securing the service, preventing abuse, improving reliability, and basic product analytics that do not require consent where permitted.
• Legal obligations (Art. 6(1)(c) GDPR): accounting, tax, and regulatory record-keeping where applicable.
• Consent (Art. 6(1)(a) GDPR): where we rely on consent (for example optional marketing emails, if offered). You may withdraw consent at any time.

3. AI processing

When you use coaching features, selected inputs you provide may be transmitted to our AI provider to generate educational insights. Do not submit special-category data or information you are not comfortable sharing for that purpose. AI outputs are informational only and are not financial advice.

4. Recipients / processors

We use carefully selected service providers that process data on our behalf or as independent controllers where required:

• Supabase — authentication and database hosting
• Vercel — website/application hosting
• Stripe — payment and subscription processing
• OpenAI — AI coaching responses
• Resend (or configured email provider) — transactional email

These providers may process data in the EU/EEA and/or third countries. Where data is transferred outside the EU/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses and provider compliance programs, where applicable.

5. Cookies and similar technologies

We use essential cookies/storage required for authentication, session security, and core service functionality. If we introduce non-essential cookies (for example analytics or marketing), we will obtain consent where required by the ePrivacy rules and GDPR.

6. Retention

We retain personal data only as long as needed for the purposes above: while your account is active, and thereafter as required for legal, tax, dispute, or security purposes. Billing records may be retained for statutory retention periods. You may request deletion subject to those obligations.

7. Your rights

Under the GDPR (and similar laws), you may have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase data (“right to be forgotten”)
• Restrict or object to certain processing
• Data portability
• Withdraw consent where processing is consent-based
• Lodge a complaint with a supervisory authority (in Germany, your local Landesdatenschutzbehörde or the BFDI)

To exercise these rights, contact contact@homegoal.app.

8. Security

We apply technical and organizational measures appropriate to the risk, including encrypted transport (HTTPS), access controls, and provider security features. No method of transmission or storage is completely secure.

9. Children

HomeGoal is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will take appropriate steps.

10. Changes

We may update this Privacy Policy from time to time. The “Last updated” date will change accordingly. Material changes may be communicated via the website or email where appropriate.

11. Contact

Privacy requests: contact@homegoal.app