How we handle your data.

Who we are

GoodOff is a product of Nexobe, Inc. ("we", "us"). Nexobe, Inc. is the controller of the personal data described in this policy. It covers goodoff.co, the GoodOff web app at app.goodoff.co, and the GoodOff apps for iOS and Android.

• Controller: Nexobe, Inc., 1839 Heather St, Bolingbrook, IL 60490, United States
• Privacy and data protection contact: privacy@goodoff.co. Write to this address with any question about this policy or your data, or to use any of your rights

Information we collect

Account information

When you create a GoodOff account, we collect:

• Your name and email address
• Password (stored only as a secure hash)
• If you sign in with Google or Apple: your name, email address and account ID from that provider
• Profile information you choose to provide (avatar, bio)
• Date of birth (for age verification — forums are 18+ only)
• Payment information (processed securely through Stripe — we never store full card details)

Study content

We store the learning content you create or upload:

• Libraries (uploaded documents, notes, study materials)
• Flashcard decks and individual cards
• Quiz results and performance data
• Voice recordings (for voice notes feature)
• Podcast audio generated from your content
• Forum posts and comments (18+ users only)
• Files and events from services you connect, such as Google Drive, Google Calendar or Notion, only the ones you choose

Usage & analytics data

We automatically collect certain information to improve your experience:

• Study patterns: time spent, cards reviewed, accuracy rates
• Session data: session duration, features used, navigation patterns
• Device information: device type, operating system, app version, push notification token
• IP address and general location (country/region level)
• Spaced repetition algorithm data: ease factors, intervals, review history
• Challenge progress and gamification data (XP, streaks, badges)
• Email engagement: whether our emails were delivered, opened or clicked
• On iOS: the Apple Search Ads campaign ID, if an ad led you to install the app (no other ad data)

Information from other sources

Some data comes to us from other companies rather than from you directly:

• Google or Apple, if you sign in with them: your name, email address and account ID
• Stripe, the App Store, Google Play and RevenueCat: whether a payment or subscription went through, and its status (never your full card details)
• Resend, our email provider: whether our emails to you were delivered, opened or clicked
• Apple, on iOS: the Apple Search Ads campaign ID described above
• ManyChat, if you message GoodOff on Instagram: your Instagram username and what you send us
• Services you connect, such as Google Drive, Google Calendar or Notion: only the files or events you choose

Cookies and similar technologies are covered in our cookie policy at https://goodoff.co/cookies.

How we use your information, and our legal bases

Data protection law, including the GDPR, requires a legal basis for each use of personal data. We rely on these:

• Contract: we need the data to provide GoodOff to you under our Terms of Service
• Consent: you have said yes, and you can withdraw at any time
• Legitimate interests: we have a reasonable interest that isn't outweighed by your rights. You can object to these uses
• Legal obligation: the law requires it, for example tax records

You need to give us your account details and your date of birth to use GoodOff; without them we can't create an account. Everything else, including analytics, is optional.

We don't sell your personal information, and we don't use it for targeted advertising.

Automated decisions

A few decisions are made automatically:

• Age checks: if the date of birth you give shows you are under 13, we lock the account automatically and then delete it. If you are under 18, the forums stay closed to you
• Forum moderation: automated filters (our own rules and Microsoft Azure AI Content Safety) screen forum posts, comments and images. They can block or hide a post or comment, or send it to a person for review. Suspensions and bans are decided by a person
• Fair-use limits: daily limits on AI features apply automatically and reset the next day

If you think an automated decision about you is wrong, email privacy@goodoff.co. A person will review it, and you can explain your side.

AI processing & content generation

GoodOff uses AI to enhance your learning experience:

• Flashcard generation: uploaded documents are processed by AI (Google Gemini, OpenAI or Anthropic) to automatically generate flashcards and quizzes
• Document reading: text is extracted from your files by Mistral AI and LlamaParse
• AI chat tutor: conversations with Sage, the tutor, are processed to provide personalized explanations
• Voice tutor: audio is transcribed (Deepgram, OpenAI or fal.ai) and processed to enable voice-based learning
• Podcast and video generation: content is turned into audio and video (ElevenLabs, Google, OpenAI or fal.ai)
• Content categorization: AI analyzes content to suggest topics and categories

Important: we use your uploaded study materials only to make your own study materials. GoodOff doesn't use them to train AI models. We send AI providers only the content each task needs, through their business (API) services, and each provider handles it under its own API terms. Most of those terms don't allow the provider to train its models on the data we send.

Data protection & security

We implement industry-standard security measures to protect your data:

• TLS/SSL encryption for all data in transit
• Encryption at rest for sensitive data in our databases
• Secure password hashing (bcrypt) — we never store plain-text passwords
• JWT-based authentication with secure token handling
• Row-Level Security (RLS) in our database to isolate user data
• Automated secret scanning and security review of code changes
• Secure cloud infrastructure (Supabase, DigitalOcean) with daily database backups
• Limited employee access to personal information on a need-to-know basis

Data retention

We keep personal data only as long as we need it for the purposes above:

• Account data: retained while your account is active, plus 30 days after deletion request
• Study content: retained until you delete it or close your account
• Analytics data: Google Analytics keeps event data for the retention period set on our property, which Google limits to 14 months at most. Amplitude keeps product analytics events until we delete them; you can ask us to delete the events linked to your account at any time
• Payment records: retained for 7 years for legal/tax compliance
• AI usage and credit records: retained while your account is active, for billing and support
• Forum posts: retained until you delete them or request removal
• Content removed as suspected child sexual abuse material: preserved for 1 year and reported to the National Center for Missing & Exploited Children, as US law requires
• Support conversations: retained for 1 year after resolution
• Server logs: kept for up to 31 days, for security and troubleshooting, then deleted
• Backups: our database provider makes daily backups and keeps them on a rolling basis for up to 30 days. Deleted data leaves our backups as they expire
• Cookies: each cookie's expiry is listed in our cookie policy

Your rights

Depending on where you live, you have the right to:

• Access: request a copy of all personal data we hold about you
• Correction: update or correct inaccurate information
• Deletion: request deletion of your account and associated data
• Export: export your flashcards, decks, and learning data (JSON, CSV, Anki formats)
• Portability: receive the data you gave us in a machine-readable format
• Restriction: request we limit processing of your data in certain circumstances
• Objection: object to any use based on legitimate interests. We will stop unless we have compelling grounds, and we always stop for direct marketing
• Withdraw consent: at any time, without affecting processing before you withdrew. For analytics, use Cookie preferences in Settings → Account & privacy in the web app, Cookie preferences at the bottom of goodoff.co, or the analytics settings in the mobile app
• Marketing: unsubscribe from promotional emails at any time, using the link in any email
• Automated decisions: not be subject to a decision based solely on automated processing that significantly affects you, and to have a person review an automated decision about you
• Complain: lodge a complaint with a data protection supervisory authority. In the EEA, that's the authority where you live, work or where the issue happened. In the UK, it's the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to help first

To exercise any of these rights, email privacy@goodoff.co. We may ask you to confirm your identity first. We respond within one month; for complex requests we may extend that by up to two more months, and we will tell you why.

Age requirements

• Minimum age: you must be at least 13 years old to create an account
• Forums: the community forums are restricted to users 18 years and older
• Parental consent: GoodOff does not offer parent-managed accounts or collect parental consent. Where local law sets a higher age for consent than 13, you may use GoodOff only if you meet that age or have the consent that law requires
• Age verification: we ask for your date of birth before you create an account, including with Google or Apple, and we ask existing accounts without one at their next sign-in

If we learn we have collected personal information from a child under 13, we will delete that information promptly.

Service providers

These companies process personal data for us, on our instructions, to run GoodOff:

We give each provider only the data its task needs. Providers act on our instructions and may use the data only to provide their service to us, under their data processing terms.

Other companies you interact with through GoodOff

• Apple and Google: if you sign in with Apple or Google, or pay through the App Store or Google Play, they process that data under their own privacy policies
• Services you connect: if you connect Google Drive, Google Calendar or Notion, we access only the files or events you choose
• Search and content sources: when you search the web or import from a link, we send the search terms or link (not your account details) to services such as Brave Search, YouTube, OpenAlex and Giphy

Other disclosures

• Other users: content you choose to make public, such as forum posts and shared decks
• Legal requirements: when the law requires it, or to protect the rights and safety of our users and of GoodOff
• Business transfers: if Nexobe, Inc. is involved in a merger, acquisition or sale of assets, we will tell you before your data moves to a new controller

International transfers

Nexobe, Inc. is based in the United States, and GoodOff's main infrastructure is there too. Our main database runs on Supabase in the US (Ohio), and our servers and file storage run on DigitalOcean in the US (New York and San Francisco). Cloudflare serves goodoff.co from its global network.

If you use GoodOff from the European Economic Area, the UK or Switzerland, you send your personal data to us in the United States, and we protect it as this policy describes wherever it is processed. Our service providers may also process it in the US and other countries where they operate. These transfers rely on:

• The European Commission's Standard Contractual Clauses, with the UK Addendum and the Swiss adjustments where needed, which are part of our providers' data processing terms
• The EU–US Data Privacy Framework, its UK Extension and the Swiss–US Data Privacy Framework, where a provider is certified under them

You can ask for a copy of these safeguards by emailing privacy@goodoff.co.

Cookies & local storage

• Strictly necessary: keeping you signed in, protecting the site from bots, and remembering your cookie choice
• Preferences: remembering settings such as light or dark mode
• Offline access: storing study data locally for offline use in the mobile apps
• Analytics: Google Analytics and Amplitude, only after you accept
• Payment: Stripe fraud-prevention cookies, only on payment pages

You can change or withdraw your choice at any time: in the web app, go to Settings → Account & privacy → Cookie preferences; on goodoff.co, select Cookie preferences at the bottom of any page. We treat a Global Privacy Control signal as a rejection. The full list, with each cookie's provider and expiry, is in our cookie policy at https://goodoff.co/cookies.

Account deletion

• Go to Settings → Account → Delete Account in the app
• Or email us at the addresses below
• Deletion is processed within 30 days
• Some data may be retained for legal compliance (see Data Retention)
• Anonymized analytics data may be retained for product improvement

Contact us

If you have questions about this privacy policy or your data:

• Privacy questions and requests: privacy@goodoff.co
• Email: Ibrahim@goodoff.co or sana@goodoff.co
• Post: Nexobe, Inc. (operator of GoodOff), Privacy Team, 1839 Heather St, Bolingbrook, IL 60490, United States

We aim to respond to all privacy inquiries within 48 hours, and fulfill data requests within one month.

Changes to this policy

We may update this privacy policy from time to time. When we make significant changes:

• We will notify you via email and/or in-app notification
• The "Last updated" date at the top will be revised
• For material changes, we will provide 30 days notice before they take effect
• If a change needs your consent, we will ask for it