What we do with what you trust us with.
People put things in they have not told anyone else. This page says plainly how that is handled — including the parts we have not done yet.
Server-side, every time.
Most of what protects your data is not cryptography — it is that the server refuses to hand it over. Every read and write is authorised on the backend against the goal's sharing settings.
The server is the boundary
Nothing is visible because the client did not render it. Permissions are checked on the server for every query and mutation, so a modified client gets the same answer: no.
Private until you say otherwise
Goals are private on creation. Publishing a goal and inviting someone to it are two separate deliberate acts, and both are reversible.
Revocation is immediate
Revoking access takes effect immediately, including for content already published to that person. Removing someone from a goal ends their access to it in the same moment.
Some things cannot be shared
Journal entries and AI coach conversations sit outside the sharing model entirely. There is no control that publishes them, because the capability does not exist.
Where it runs.
We build on managed platforms rather than running our own. That is a deliberate choice for a team this size: fewer places to get it wrong.
| Application and data | Convex, which holds goals, milestones, check-ins, journal entries, and sharing rules, and enforces authorisation on every function call. |
|---|---|
| Authentication | Clerk. never stores your password, and sign-in sessions are issued and validated as signed tokens. |
| Web hosting | Vercel, with HTTPS enforced on every route and HTTP redirected. |
| Transactional email | Resend, for invitations, check-in reminders, and account email. We do not sell or rent your address. |
| Encryption | In transit with TLS, and at rest by the managed platforms above. does not offer end-to-end encryption, and we would rather say so than imply otherwise. |
| Access by our team | Limited to the people who need it to operate or support the product, and used to answer a request or investigate a fault — not to browse. |
What you can do from settings.
Export everything
Export your goals, milestones, check-ins, and journal entries in a machine-readable format, sent to the address on your account.
Delete your account
Delete your account and its content. The Privacy Policy sets out exactly what is removed, what may persist in shared spaces, and for how long.
Change who sees what
Change or revoke any person's access to any goal, at any time, without ending the goal or telling the whole Goal Team.
Found a problem?
If you have found something, tell us before you tell anyone else and we will work with you. We do not run a paid bounty programme yet, and we will not threaten you for reporting in good faith.
Email support@trupath.me with the subject line “Security report”. Include what you found, how to reproduce it, and what you think the impact is. We aim to acknowledge within two working days.
Please do not access, modify, or delete data belonging to anyone other than an account you control, and please do not run denial-of-service or automated scanning against production. Give us a reasonable window to fix the issue before publishing.
