DRAFT This document has been revised to reflect the current product surface, but it has not yet been reviewed by legal counsel. Do not rely on it for GDPR, ePrivacy, consumer-law, or other regulatory compliance until it has been legally reviewed and finalized.

Privacy Policy

Last updated: April 2, 2026

Mylestone ("we", "our", or "us") is a progress-tracking platform for individuals, professionals, and organizations. This Privacy Policy explains what personal data we collect, how we use it, when it becomes visible to other people, and the rights and choices available to you.

1. Scope

This Policy applies to the public website, account registration and sign-in flows, public profiles, public milestone pages, social and community features, organization workspaces, professional-client collaboration features, support communications, and the related APIs, tokens, and integrations we make available.

Some areas of the Service are public by design, while others are private, organization-only, or visible only to specific collaborators. Visibility depends on the feature and on the settings you choose.

2. Categories of Personal Data We Collect

Depending on how you use the Service, we may collect the following categories of data:

Account and authentication data: name, email address, username, login and security data, password-reset and verification events, two-factor settings, and profile identifiers. If you sign in through Google, Apple, Facebook, or X (Twitter), we may receive profile data made available by that provider.
Profile and preference data: display name, bio, avatar, locale, region, appearance preferences, privacy settings, professional profile information, specialties, disclaimers, pricing guidance, and availability notes that you choose to provide.
Milestone and content data: milestone titles, descriptions, categories, cover images, target dates, status, visibility settings, steps, notes, long-form text, links, uploaded assets, generated videos, templates, bookmarks, and related metadata.
Community and interaction data: follows, follow requests, saved items, comments, replies, reactions, mentions, feed activity, notifications, blocks, reports, and moderation-related submissions.
Professional and collaboration data: professional-client relationship records, proposals, revision history, accepted proposal terms, private comments, touchpoints, scheduling details, and outcome summaries created through professional or coaching workflows.
Organization and admin data: organization memberships, invitations, role or capability settings, auto-join or SSO-related data, admin actions, branding settings, forms, webhooks, audit-log data, and organization export requests.
Billing and subscription data: subscription status, package or plan data, invoice history, billing addresses or tax fields where provided, and payment-method data handled by Stripe. We do not store full card numbers.
Support and communication data: messages sent through the contact form, support emails, notification delivery events, bounced-email handling, and related correspondence.
Technical, device, and usage data: IP address, browser type, device information, server logs, route navigation, page views, request metadata, errors, performance data, and interaction data generated when you use the Service.
Push and token data: web-push subscription data, API tokens, and other credentials or identifiers used to enable authorized agent or integration access.

3. How We Use Personal Data

We use personal data to:

Create, secure, and manage user accounts, organization workspaces, and sign-in flows.
Host milestones, profiles, public pages, directories, feeds, and other user-visible experiences according to the visibility settings and collaboration model of the product.
Deliver social and collaboration features such as follows, comments, mentions, private professional-client workflows, organization mentorship, and touchpoint scheduling.
Provide AI-assisted milestone creation, step analysis, video generation, and related tools.
Process subscriptions, manage billing, and handle invoices or subscription lifecycle events.
Send transactional, service, safety, billing, collaboration, and notification-preference emails and, where enabled, web-push or in-app notifications.
Respond to contact requests, support issues, abuse reports, and moderation workflows.
Detect, prevent, and investigate abuse, fraud, policy violations, suspicious activity, or harmful content.
Generate data exports, support account deletion requests, maintain audit logs, and comply with legal obligations.
Operate, troubleshoot, measure, and improve the performance, reliability, and security of the Service.

4. Legal Bases

Where the GDPR or similar laws apply, we generally rely on contract performance, legitimate interests, compliance with legal obligations, and consent where required. The exact legal basis may vary by feature, data type, and jurisdiction. [Placeholder — confirm the final legal-basis mapping with legal counsel before publication.]

5. AI, Video, Moderation, and Similar Processing

The Service includes AI-assisted features such as milestone field suggestions, step analysis, and milestone recap video generation. To deliver those features, we may process text, images, videos, milestone metadata, and related content through third-party AI or safety providers.

We also use content-moderation and abuse-handling processes, including text moderation, image moderation, and user-generated reports. Reported content, including certain private collaboration content, may be reviewed by authorized admins or moderators when necessary to investigate a report, enforce policies, or protect users.

We do not intend to use your content to train third-party AI models for their own general purposes without your explicit consent, but this must be confirmed against the final terms and settings of each provider used in production. [Placeholder — verify final AI provider terms, retention, and training restrictions before publication.]

6. Visibility, Profiles, and User Sharing Choices

The Service includes both public and non-public spaces. The visibility of your data depends on the feature and on your settings.

Public content: your public profile, public professional profile, public milestones, public milestone steps, and public organization pages may be visible to anyone who can access the relevant URL or public directory.
Private-account and follow controls: if your account is private, follow requests and certain profile visibility rules may limit who can see your activity.
Organization workspaces: data inside organization workflows may be visible to organization admins, mentors, staff, or members according to the organization features, roles, and permissions in use.
Professional-client collaboration: proposal history, private comments, touchpoints, and related collaboration records are intended for the relevant participants and authorized staff, but reported content may be disclosed to authorized reviewers when needed for safety or policy enforcement.

7. Sharing and Disclosure

We do not sell your personal data. We may disclose data in the following situations:

To other users, organizations, or collaborators: where the product feature itself requires disclosure, for example public profiles, public milestones, social interactions, professional-client collaboration, or organization-managed workflows.
To service providers and processors: including providers for hosting, database and authentication services, payments, email delivery, web push, CAPTCHA, telemetry, moderation, AI processing, video generation, storage, background jobs, and similar operational services.
To organization admins and operators: when they manage an organization workspace, invitations, member access, compliance, audit trails, exports, or other organization-level functionality.
For safety, abuse, moderation, and legal reasons: including where needed to investigate reports, protect users, enforce policies, respond to lawful requests, or establish, exercise, or defend legal claims.
In connection with a business transaction: such as a merger, acquisition, financing, restructuring, or sale of assets.

Current or planned service-provider categories reflected in the product include Supabase, Stripe, Microsoft Azure Application Insights, OpenAI, Anthropic, Google AI or video services, Azure AI Content Safety, email-delivery providers such as Mailgun or SMTP2GO, and Cloudflare Turnstile. The exact providers used may vary by deployment and configuration.

8. Cookies, Local Storage, Telemetry, and Similar Technologies

We use cookies, local storage, and similar technologies for authentication, security, preferences, and service operation. These technologies may include the following:

Essential Technologies

Required for authentication, session management, security, rate limiting, and core site functionality. Without these technologies, important parts of the Service may not work.

Functional Technologies

Used to remember settings such as theme, language, and similar product preferences.

Analytics and Telemetry

If enabled for a deployment, we may use Azure Application Insights and related telemetry to collect route navigation, page views, time spent on pages, performance metrics, errors, unhandled promise rejections, and request-related metadata such as fetch or AJAX activity. This telemetry helps us monitor reliability, investigate failures, and improve the product.

The Service currently includes a cookie-preferences interface for analytics settings, but you should confirm the actual deployment-specific consent behavior before relying on any final consent wording. [Placeholder — align the final cookie and telemetry language with the actual production consent implementation before publication.]

Third-Party Technologies

Third parties may set or use their own cookies, storage, or similar technologies when they provide services such as payments, authentication, analytics, CAPTCHA, email-delivery, or other infrastructure and communication functions.

9. Data Retention

We retain personal data for as long as needed to provide the Service, maintain your account, operate organization or collaboration features, meet legal obligations, resolve disputes, and enforce our agreements.

Account and product data are generally retained while your account or relevant workspace remains active.
When you request account deletion through the product, live account data may be deleted or deactivated from our primary application systems, subject to backups, logs, queued jobs, safety records, and any retention required by law.
Personal data export archives are generated on request, delivered by email, and currently expire after a short period. The current implementation stores export files for roughly 48 hours and issues signed download links that are valid for roughly 1 hour.

[Placeholder — confirm and publish final retention schedules for backups, logs, moderation records, billing records, and deleted-account data.]

10. International Transfers

Our providers and collaborators may process data outside your country of residence. Where required, we intend to rely on appropriate safeguards such as contractual protections, adequacy decisions, or similar transfer mechanisms.

[Placeholder — confirm the final international-transfer mechanism and the provider list used in production before publication.]

11. Security

We use administrative, technical, and organizational measures intended to protect personal data, including encryption in transit, access controls, and service-level security safeguards. No system is completely secure, and we cannot guarantee absolute security. We recommend using strong credentials and enabling two-factor authentication in your account settings.

12. Your Rights

If you are located in the European Economic Area, the United Kingdom, Switzerland, or in another jurisdiction with similar rights, you may have the right to request access, correction, deletion, restriction, portability, or objection, and to withdraw consent where processing is based on consent.

You may also have self-service options within the product, including privacy settings, notification preferences, data export requests, and account-deletion functions. To exercise rights that are not available through the product, contact us at privacy@mylestone.app. You may also have the right to lodge a complaint with your local data-protection authority.

13. Children's Privacy

The Service is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If we learn that we have collected such data without a valid legal basis, we will take steps to delete it. If you believe a child has provided personal data to us, contact us at privacy@mylestone.app.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date. For material changes, we may also provide notice through the Service or by email where appropriate.

15. Contact and Controller Information

For privacy-related questions, requests, or complaints, contact us at privacy@mylestone.app.

Data Controller: Mylestone — privacy@mylestone.app [Placeholder — add the final legal entity name and registered address before publication.]