1.Who this covers
This policy applies to everyone who uses Goodlist — the task and group-sharing app built by an independent developer, Jeric Realubit — whether on Android or on the web at goodlist.expo.app. Goodlist runs on Supabase (Postgres + authentication) as its backend infrastructure, and uses RevenueCat to manage the optional Premium subscription. We don’t run ads, and we don’t use analytics or tracking SDKs of any kind in the app today.
2.What we collect
Account information. Your email address, and either a password (if you sign up with email — stored securely and hashed by our authentication provider, so we never see it in plain text) or the Google or Facebook account you chose to sign in with. Also an optional display name.
Signing in with Google or Facebook. If you choose Continue with Google or Continue with Facebook, that company confirms who you are and sends Goodlist’s authentication provider your name, email address and profile picture link, plus an ID for your account there. We use the email to identify your account and the name as your starting display name, which you can change in Settings; we don’t show or use the picture. We never receive your Google or Facebook password, contacts, friends or posts, and Goodlist never posts anything for you. You can remove Goodlist’s access at any time in your Google or Facebook account settings — that stops future sign-ins but doesn’t delete your Goodlist account; see “Retention & deletion” for that.
Task & group content. Anything you enter to use the app: task titles, notes, due dates, completion status, group names, invite codes, and member roles. This is the content the app exists to store.
Task alarms. If you turn on the Alarm switch for a task, its title, note and due date/time are used to schedule a notification on your own device at that time — the same way a task shows on the calendar, just with a phone alert added. It keeps ringing until you stop, snooze or complete it: with Goodlist open, an alarm screen plays a sound and vibrates; with it closed, the alert repeats every 5 minutes until you answer it — for a couple of hours if Goodlist stays closed, up to 12 if you open it — as a single notification. Whether you stopped or snoozed an alarm is remembered on that device only. We don’t send it; nothing leaves your device to make it happen. Turning the alarm off, changing the due date, or completing or deleting the task cancels it.
Repeating tasks. If you make a Personal task repeat, we store how it repeats (every day, week, two weeks, or month — on a set date or a weekday such as the second Tuesday — or on the days you chose), the time it’s due, an optional last day, and the title and note new copies are made from. Each copy is an ordinary task of yours, so it’s covered by everything above. Only you can see or change a repeating task; it isn’t shared with a group.
Medicines. If you use the Meds tab: the name, dose and instructions you enter for each medicine, the times and days you take it, your time zone (so the times read correctly), and each dose you mark as taken or skipped. This is health information, so it is private to you by default. It is visible to a group only if you choose to share a specific medicine with it, and you can stop sharing, or delete a medicine and its whole dose record, at any time. Medicine reminders are scheduled on your own device; we don’t send them, and we never use this information for anything other than showing it back to you and anyone you shared it with. The first time you turn on a reminder or a task alarm, your device asks permission to show notifications — Goodlist uses that permission only for medicine reminders, task alarms and, during a free trial, a reminder before the trial ends. On Android, Goodlist also asks you to turn on “Alarms & reminders” for it (the exact-alarm permission), so that alarms and reminders ring at the exact minute rather than whenever the phone next wakes up. It’s off until you turn it on, alarms still ring without it (sometimes a few minutes late), and it gives Goodlist no access to any of your data.
Voice input. If you press the microphone button to speak a task, the microphone is live only while the listening panel is open — never in the background, and never before you press it. What you say is turned into text by your own device’s speech service (Google’s on Android and in Chrome, your browser’s built-in engine elsewhere), not by us. Goodlist never records, stores, or receives the audio — only the text that comes back, which becomes a task exactly as if you had typed it. On Android and in Chrome that transcription is done by Google and the audio may be sent to Google’s servers to do it, under Google’s own privacy policy.
Activity timestamp. While the app is open, it records a single “last seen” time on your profile, roughly once a minute. It is one timestamp, overwritten each time — not a history of when or how you use the app — and it exists so the app can show how many people are using Goodlist right now. Other users see that count, never your timestamp, your name, or anything you do. Goodlist’s developer can also see it when looking up an account to help someone (see Premium & purchases below).
Failure notes. When something fails in the background — an alarm that couldn’t be scheduled, say — the app keeps a short note of when, where and the error message, on your device only (the last 50). We never collect them. On Android, Settings → Share diagnostics puts them in your phone’s share sheet, so you can send them to us yourself when asking for help.
Country & time zone. Your device’s Region setting (a country, like “Philippines”) and its time zone (like “Asia/Manila”). These are read from your device’s own language and region settings — not from GPS, and not from your IP address. We use them only to count how many people use Goodlist in each country and time zone. Anyone signed in to Goodlist can see those counts under Settings → User distribution: a number for each country and time zone (with the city the time zone is named after), never a name or an account, though in a place where few people use Goodlist a count can be as small as one. You can turn this off at any time in Settings, which also clears the two values we’ve stored.
Premium & purchases. If you start the free trial or subscribe, we store when your trial started and ends, and when your paid subscription expires. Payments are handled entirely by Google Play (on Android) or by Stripe (on the web) — we never see or store your card or bank details. RevenueCat, our subscription provider, receives your Goodlist account ID (a random identifier, not your name or email) and the purchase records from Google Play or Stripe, so it can tell us whether your subscription is active. On the web, the checkout page may ask for your email address to send you a receipt. Goodlist’s developer can also give an account free Premium or Lifetime access as a promotion; we store that access and when it ends, separately from any purchase. To do this, the developer can look up an account by its email address or display name and see its email, display name, when it was last active, and its Premium status. This is used only to support people and give promotional access, and it isn’t shared with anyone beyond the service providers listed below.
Notifications when the app is closed. On Android, if you’ve allowed notifications, Goodlist sends a notification when someone requests a task from you, so you see it without opening the app. To do that, your phone gets a push token — an identifier for this install of Goodlist, not your name or email — which we store with your account and delete when you sign out or delete your account. A notification says who asked and nothing else: the task’s title and notes are never included. The token and that message pass through Expo’s push service, and then Google’s, on their way to your phone. Turn these off any time in your phone’s notification settings.
Asking you to rate the app. On Android, Goodlist may occasionally ask you to rate it on Google Play, after you’ve used it on several days and finished some tasks. To decide when, the app keeps a few counters on your phone — how many days you’ve opened it, how many tasks or doses you’ve completed, and when it last asked. They never leave your device and aren’t sent to us. The rating box itself is Google Play’s, and Google handles anything you enter in it. The Rate Goodlist link in Settings opens our Play Store page.
Counting visits to the Premium screen. To learn which Premium features people look for, Goodlist adds one to a daily total each time the Premium screen is opened (noting which button opened it), a free trial starts, or a purchase or restore goes through. Only the day, the kind of event and the running count are kept — no account, device or exact time — so the totals can’t be traced back to you. Only the developer can see them.
Your settings on this device. Your theme, language, snooze length, heads-up time, alarm sounds and silent mode are saved on your phone — or, on the web, in your browser — not in your account. They aren’t sent to us, so a new phone or browser starts with the defaults.
On the web. The website keeps your sign-in session and an offline copy of your tasks in your browser’s local storage, the same way the Android app keeps them on your phone. We don’t use advertising or tracking cookies.
We don’t collect your precise location, contacts, or advertising identifiers, and we don’t track you across other apps or websites. There’s nothing being collected in the background beyond what’s listed above — the microphone included. Goodlist has no wake word and never listens until you press the microphone button.
3.How we use it
- To create and authenticate your account, and keep you signed in.
- To sync your Personal tasks across your own devices.
- To share Requested tasks and group task lists with the members you’ve chosen to invite.
- To send notifications — in the app, and on your phone when it’s closed — for example, when someone requests a task from you.
- To schedule medicine reminders and task alarms on your own device, and to show a medicine’s schedule and dose record to a group you’ve chosen to share it with.
- To run the Premium free trial and subscription, and unlock Premium features while it’s active.
- To show community totals — how many accounts exist, how many are active right now, and how many people use Goodlist solo or in a group. These are counts only; no one is identifiable from them.
- To count, in aggregate, how many people use Goodlist in each country and time zone, and show those counts to signed-in users — never to locate an individual.
We don’t use your data to train models, sell it, or use it for advertising.
5.Retention & deletion
Your data is kept for as long as your account exists. You can permanently delete your account at any time from Settings — this immediately and permanently removes your profile and tasks.
You can also clear your completed/cancelled task history from the History screen at any time, independent of deleting your account.
Subscriptions. Deleting your account removes your trial, subscription and promotional-access status from our database, but it does not cancel a subscription — cancel it first in Google Play, or from Premium → Manage subscription on the web. Google Play, Stripe and RevenueCat keep their own records of past purchases for as long as tax and accounting rules require. Email us if you’d like us to ask RevenueCat to delete its record of your account too.
Google or Facebook sign-in. Deleting your account also deletes the name, email and picture link they sent us. To stop Goodlist appearing in your Google or Facebook account as a connected app, remove it there too.
6.Children’s privacy
Goodlist is not directed at children under 13, and we do not knowingly collect personal information from children under 13. Family-group member roles like “child” are currently descriptive labels only — Goodlist does not yet offer separate child accounts, logins, or parental-control features.
7.Security
Your data is protected with row-level database security, meaning the database itself enforces who can read or write each piece of data — a group’s tasks are only reachable by that group’s members, and personal tasks only by you. Passwords are hashed, never stored or transmitted in plain text. No method of storage or transmission is 100% secure, but we take reasonable, industry-standard steps to protect your information.
8.Your choices
- Access & correction — everything you’ve entered is visible and editable directly in the app.
- Deletion — delete your account anytime from Settings, or email us to request it.
- Questions or data requests — contact us using the email below.
9.Changes to this policy
If this policy changes in a meaningful way, we’ll update the effective date above. Continuing to use Goodlist after a change means you accept the updated policy.
10.Contact
Questions about this policy or your data? Reach out at jericrealubit@gmail.com.