Privacy Policy – BigGoal

Last updated: August 21, 2026

1. Data Controller

The data controller is Angelo Marzocchi, reachable for any privacy-related request at: ososososato@gmail.com.

2. Personal Data Collected

BigGoal collects the following categories of personal data:

• Google account data – name, email address and unique Google user identifier, provided through the Google Sign-In authentication service. These data are used exclusively to identify the user's account within the app.
• User-generated content – goals, sub-goals (milestones), tasks, notes and any other organizational content created directly by the user inside the app.
• Diagnostic data – when the app crashes or hits an error, we collect the device model and version, the app version, an installation-generated identifier, and the technical detail of the error (for example, why a sign-in did not succeed). These data contain none of the content created by the user and are not used to identify them.

The app does not collect location data, biometric data, financial information or device contacts, and never asks for special category data.

User-generated content is free text, however: a goal may contain — because the person writing it chose to — information about health, personal beliefs, or other areas the GDPR treats as special categories of data (Art. 9). Such content is neither requested nor analysed for any purpose beyond operating the service, and section 4 describes the only case in which it is processed by an artificial-intelligence system.

3. Purposes and Legal Basis of Processing

Personal data are processed for the following purposes:

• Authentication – allowing the user to sign in to the app with their Google account.
• Service operation – saving, synchronising, and displaying user-generated content across all devices linked to the same account.
• Security and abuse prevention – maintaining the integrity and availability of the service.
• Artificial-intelligence features – generating plans, proposing a recovery after a missed day, and labelling goals. These are described in detail, with their respective legal bases, in section 4.
• Diagnostics and stability – finding and fixing crashes and errors in the app, including the sign-in problems users report.

The legal basis for processing is the performance of the contract/service requested by the user (Art. 6(1)(b) GDPR), except for diagnostic data, processed on the basis of our legitimate interest in keeping the app working and secure (Art. 6(1)(f) GDPR).

4. Artificial Intelligence

Some BigGoal features rely on a generative artificial-intelligence model. Processing is carried out through Google Cloud Vertex AI, inside a project controlled by the data controller and in a European region (europe-west4). The content sent is not used to train models.

The features involved, and the data each one sends, are:

• Plan generation – at the user's explicit request, when they choose to have a plan created by the AI. The goal title, its duration, the weekly commitment and the answers the user wrote to the clarifying questions are sent.
• Rescue – at the user's explicit request, to recover a missed day. The goal title, the titles of the tasks involved and any note about what got in the way are sent.
• Automatic tags – only with the user's explicit consent. Only the goal title is sent, truncated to 200 characters: never milestones, tasks, notes, or anything written by other members of a shared goal. The model does not generate text; it picks 1 to 3 labels from a fixed, predefined list.

Legal basis. For plan generation and rescue it is the performance of the service requested by the user (Art. 6(1)(b) GDPR): processing happens only when the user deliberately starts the feature. For automatic tags, which apply to every goal rather than to one request, the legal basis is consent (Art. 6(1)(a) GDPR and, where the content falls within special categories of data, Art. 9(2)(a) GDPR).

Withdrawal. Consent to automatic tagging can be withdrawn at any time under Settings → Automatic tags. Withdrawal applies across all devices and stops any new processing immediately. The same screen can also delete the labels already generated.

Refused content. The AI features refuse requests involving self-harm, harm to other people, or illegal activity. No plan is produced in those cases; a technical event is recorded containing only the category of the refusal and the account identifier — never the text the user wrote.

Automated decisions. None of these features produces legal effects or similarly significantly affects the user within the meaning of Art. 22 GDPR: generated content is a proposal the user can edit, and labels only serve to filter their own goals in the app.

5. Data Retention

Data are retained for as long as necessary to provide the service, or until the user requests deletion of their account and associated content. In the absence of an explicit deletion request, data are kept while the account remains active.

Diagnostic data follow a lifecycle of their own: Firebase Crashlytics retains them for at most 90 days after the report, after which they are deleted automatically.

6. Data Transfers and Sharing

Data are stored and managed through Google Firebase cloud services (Firebase Authentication and Cloud Firestore), acting as a data processor under the Google Cloud / Firebase Terms of Service.

The artificial-intelligence features described in section 4 rely on Google Cloud Vertex AI, also acting as a data processor, with processing carried out in a European region.

The diagnostic data described in section 2 are processed by Firebase Crashlytics, also a Google service acting as a data processor.

User data are never sold, shared, or disclosed to third parties for marketing or profiling purposes.

7. Security

We implement appropriate technical and organisational measures to protect personal data from unauthorised access, loss, alteration or disclosure, including encrypted transmission (HTTPS/TLS) and Firebase's built-in authentication controls.

8. User Rights

Users have the right to:

• access their personal data;
• request rectification of inaccurate data;
• request erasure of their data (right to be forgotten);
• object to or restrict processing in certain circumstances;
• request data portability;
• withdraw a consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
• lodge a complaint with the competent supervisory authority (e.g. Garante Privacy in Italy, or the relevant authority in your country of residence).

To exercise these rights, write to: ososososato@gmail.com.

9. Children

The app is intended for users aged 13 or older. If you become aware that a child under 13 has provided personal data through the app, please contact us so we can promptly remove it.

10. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. Any changes will be reflected in the "Last updated" date at the top of this page. Continued use of the app after changes are published constitutes acceptance of the revised policy.

11. Contact

For any questions or requests regarding this Privacy Policy: ososososato@gmail.com