Powerful Progress is a goal-completion app. This policy explains what data we collect, why, and what we will never do with it. We have tried to write it so you can actually read it.
The data controller is:
Account data. Your email address and an encrypted password, managed through Firebase Authentication.
Your goals and progress. Goal titles, targets, deadlines, daily and weekly actions, completions, checkpoints, day ratings, and notes you write in the app.
Onboarding answers. What you answer during setup — the area you want to change, what has stopped you before, how you want to feel, your self-rated discipline — including anything you type in free-text fields.
Coach conversations. Messages you exchange with the AI coach.
Purchase status. Whether you have an active subscription or lifetime access. Payments themselves are processed by Apple (and RevenueCat as our subscription infrastructure) — we never see or store your card details.
Technical and usage data. Basic app events (for example which onboarding step you reached, that an account was created, or that a goal was written), timestamps, and anonymised AI-usage logs used for cost control and abuse prevention. These anonymised logs contain no user ID and no message content.
What our analytics collects. We use Google Analytics for Firebase to understand how people move through the app — in particular where in setup people stop, and whether the people who finish end up with an account and a goal. Alongside the events above it collects, automatically:
We never send it what you write. Your goal text, your notes, and your answers to the setup questions do not go to analytics. Where an event needs to record that you answered something, it records how many characters you typed and whether you wrote your own answer instead of picking one — never the words themselves. Your writing goes only where this policy says it goes: our own database, and the AI coach if you have permitted that.
We do not collect your precise location, contacts, photos, or advertising identifiers. There is no ad tracking in the app, and no App Tracking Transparency prompt, because there is nothing to ask about: the analytics component is built without the advertising-identifier module, and we have not enabled Google's cross-service advertising features.
A note on sensitive information. Goals are free text, so what you write is up to you. A goal or note could reveal something about your health, mental health, or personal circumstances — for example a fitness goal, or a note about how a day went. Where the information you choose to enter falls into a special category under Article 9 of the GDPR, we process it only on the basis of your explicit consent, given when you enter it, and only to run the service for you. You are never required to enter sensitive information, and you can delete anything you have written at any time.
If any of this were ever to change, we would ask for your explicit consent first — a policy update alone would not be enough.
We use a small number of service providers. Every one of them that processes personal data on our instructions does so under a data processing agreement:
| Provider | What they do | Where |
|---|---|---|
| Google Firebase | Database, authentication, server functions, app analytics | USA (EU–US Data Privacy Framework) |
| Anthropic | AI generation for plans and coaching | USA (Standard Contractual Clauses) |
| RevenueCat | Subscription management | USA |
| Apple | Payment processing | Per your App Store region |
| Kit | Waitlist and newsletter emails (website only) | USA |
| Cloudflare | Website DNS, CDN and network | USA/EU |
Where data is transferred outside the EEA, it is protected by the EU–US Data Privacy Framework or Standard Contractual Clauses.
Google specifically, because the analytics half runs on different paperwork from the rest. Firebase's database, authentication and server functions are covered by the Firebase data processing terms. Google Analytics for Firebase is a separate service under its own terms, and it is covered by the Google Ads Data Processing Terms rather than by the Firebase ones. Both are data processing agreements and both are in force, which is why the row above is one row and the sentence introducing this table is true of it — but they are not the same agreement, and anyone checking should know to look in two places.
Anthropic specifically, because your goals and coach messages are the most personal thing that leaves our systems: we have a data processing agreement with Anthropic, transfers are covered by Standard Contractual Clauses, and Anthropic does not train models on what we send. Nothing is sent until you have given the permission described above.
About the website, where two providers sit in front of each other. powerfulprogress.app is a set of static pages. The DNS, CDN and network layer is Cloudflare, which is in the table above: its data processing addendum is incorporated into the self-serve terms it operates under, so it applies to our plan with nothing to sign. The pages themselves are served from Vercel, on a free plan that does not include a data processing agreement — so Vercel is deliberately absent from the table and we make no such claim about it. What Vercel sees is ordinary request metadata: IP address, browser, timestamps. It never sees your account data, which exists only in the systems above, and it never sees your email address either — the waitlist form posts that straight from your browser to Kit.
If Powerful Progress is ever sold, merged, or transferred, your data may transfer with it. We would tell you in advance, and any new owner would be bound by this policy until you were asked to accept a new one. Your right to delete your account before that happens is unaffected.
Your data is kept for as long as you have an account.
When you delete your account (Profile → Delete account), all your data — goals, progress, notes, coach conversations, and account details — is deleted immediately from our systems. Copies may persist in our providers' technical backups for up to 30 days before being automatically erased.
Anonymised usage logs (which cannot be linked back to you) are kept for cost monitoring.
Under the GDPR you can:
To exercise any of these, email support@powerfulprogress.app. We respond within 30 days.
Your data is encrypted in transit (TLS) and at rest. Access is restricted by per-user security rules verified by automated tests, server functions run with least-privilege access, and our AI-usage logs are anonymised by design. No system is perfectly secure, but security has been reviewed and tested as part of building this app, and we treat it as an ongoing obligation.
Your daily and weekly actions and coach replies are generated automatically by an AI model based on what you enter. This automation exists to run the service you signed up for — it does not make legal decisions about you or decisions with similar significant effects. You can always disregard generated suggestions, edit your plan, or contact us with questions about how something was generated.
The app contains no advertising or tracking cookies. Our website (powerfulprogress.app) uses only what is technically necessary to function and to process waitlist signups through Kit; we do not run advertising pixels or cross-site tracking.
Powerful Progress is for users aged 17 and older. We do not knowingly collect data from anyone younger. If you believe a minor has created an account, contact us and we will delete it.
We may update this policy as the service evolves. For material changes we will notify you in the app or by email with reasonable notice before they take effect. For any new use of your personal data, we will ask for your consent — continued silence is not consent for new purposes.
Questions about your data: support@powerfulprogress.app