Privacy Policy

This Privacy Policy explains how MileStone's maker ("we", "us", "our") handles information when you visit our website (codemilestone.com, the "Site") and when you use the MileStone goal & habit planner application (the "App"). It is written to be read — not skimmed past — because our architecture is genuinely unusual: your planning data stays on your device unless you switch on device sync — and even then we receive it only encrypted, with a passphrase we never see.

1. Who we are

MileStone is made and run by one person, an independent developer in Queensland, Australia ("we", "us"). CodeMilestone is the website's name, not a separate company. MileStone is our product: a browser-based, installable (PWA) goal and habit planner. For anything in this policy, contact us at info.codemilestone@gmail.com. That developer is the "data controller" (GDPR) / responsible entity (Australian Privacy Act) for the limited personal information described below.

2. Consent & acceptance

By accessing the Site or using the App, you consent to the collection, use and disclosure of information as described in this Privacy Policy. If you do not agree with any part of it, please do not use the Site or the App.

• Free use requires no account and no personal information. The only data processing involved in free use is the technical minimum described in section 4.1 (loading the App from our host).
• Buying Pro additionally involves Lemon Squeezy processing your payment details (section 5) and our license-verification service processing your license key (section 4.2). Completing a purchase constitutes consent to that processing — it is also technically necessary to deliver what you bought.
• Device sync is optional and off by default. Setting it up in the App constitutes consent to the encrypted upload described in section 4.3; turning it off withdraws that consent for future uploads, and you can ask us to delete the stored copy at any time (section 11).
• Email signup and support email are processed on the basis of your consent, given by submitting the form or sending the email. You can withdraw it at any time (sections 4.4, 4.5, 11).
• Withdrawing consent: stop using the Site/App, clear your browser data for it, and — for anything server-side (license records, email-list entries, support correspondence) — email us and we will delete what we are not legally required to keep (section 11).

Where the GDPR or similar laws apply, our lawful bases are: performance of a contract (delivering the App and verifying Pro licenses), legitimate interests (hosting, security, fraud and refund-abuse prevention, standard server logs), and consent (email updates, support correspondence).

3. Data saved on your device (and the optional sync copy)

Everything you create in MileStone is stored in your browser's local storage, on your device:

• Goals, milestones, steps, deadlines, hour estimates, budgets and spend logs
• Habits, check-ins, streaks, skips, notes and reflections
• Todos, categories, settings, theme, and your reminder preferences
• Your Pro license key and its activation details, if you have one
• Any export files you save (kept wherever you choose to keep them)

Date of birth. The optional Life Line asks for your date of birth. It stays in your browser and in any export file you save, wherever you choose to keep it. If you turn on Pro sync, it's also part of your encrypted sync copy, which we can't read. We never see your date of birth, and MileStone doesn't send it to the AI you plan with. Removing the Life Line deletes it from this device and from your next sync copy. Older encrypted sync copies are replaced as you keep syncing, and any export file you saved earlier still contains it.

Browsers can clear this data on their own. Safari on iPhone and iPad removes a site’s stored data after seven days without opening that site, and any browser may evict it under storage pressure, after a long period without use, or when you clear site data. Installing MileStone to your home screen and exporting a copy from Settings → Your data lowers the chance of losing it, but nothing can guarantee it; the App shows a reminder when your browser has not promised to keep the data.

Without device sync we keep no copy of any of this. If you are a Pro user and switch on device sync (section 4.3), we store an encrypted copy on our host that only your passphrase can open, along with a few details we can see (that the copy exists, its size, when it last changed, a short device name and the number of goals). We cannot read your goals, habits or other content in that copy, and we have no way to decrypt it, reset your passphrase or rebuild your data from it. Either way, we cannot recover your planning data for you (see section 15).

4. What touches our servers (the complete list)

4.1 Loading the App and Site — hosting logs

MileStone is delivered from the web, so opening the Site or the App sends a standard web request to our hosting provider, Netlify, Inc. (USA). Like effectively every website, this creates routine server access logs that can include your IP address, browser type (user agent), requested page and timestamp. Netlify keeps these logs for us as our hosting provider, under its data processing agreement, for a limited period it sets; we use them, if at all, only for security and diagnosing outages. We run no additional analytics on top of them — no page-view tracking, no session recording, no fingerprinting.

4.2 Pro license verification

If you activate MileStone Pro, the App contacts our license endpoint (a Netlify serverless function) which in turn checks your key with Lemon Squeezy. Specifically:

• What is sent: your license key, a device-instance identifier, and the label "MileStone". Nothing else — none of your goals or habits ever accompany the request.
• What comes back: whether the key is valid, its type, and its expiry. Lemon Squeezy's reply also includes the purchase email it holds for the key; our endpoint passes it to your browser, and the App discards it without displaying or storing it. We do not log or keep it.
• What we log: a masked version of the key (most characters removed) and the validation result. We deliberately do not log full license keys.
• What we store: if a purchase is refunded, disputed or a subscription lapses, Lemon Squeezy notifies our webhook and we record that key in a small "revoked licenses" list (a scrambled form of the key, the reason and the time; a few entries made before 20 September 2026 still hold the key itself until we clear them) so it stops unlocking Pro. This list contains no name, email or usage data. We also keep operational records that hold no goal or habit content: abuse limits (a shortened, scrambled form of your IP address, deleted within about two days); a list of payment events we have already handled (kept with no fixed end date); and, for each activated device, a scrambled form of the licence key with the device identifier and activation dates (kept until the device is deactivated or the licence ends). Device entries are removed when you deactivate a device, or when a licence is refunded or expires; otherwise we keep them while your licence exists. To prevent abuse, we briefly keep a shortened, scrambled (hashed) form of your licence key and IP address, deleted within about two days.

4.3 Device sync (optional, Pro only)

Pro users can turn on device sync from Settings so that a second device — say, a phone and a laptop — can share the same goals and habits. It is off by default, and nothing is uploaded until you set it up. When it is on:

• What is sent: a snapshot of your planning data (goals, milestones, steps, habits, check-ins, to-dos, notes, budgets and spend logs, your profile if you filled it in, contacts you added, recently-deleted items, pacing and activity history, and your reminder settings), encrypted on your device with a key made from a passphrase you choose. We never receive the passphrase or the key, so we cannot read your copy, and nobody who obtained the copy could read it without your passphrase. Your licence key is deliberately excluded from the snapshot.
• What we can see: that a copy exists, its size and when it last changed, a short device name chosen by the App (for example "iPhone" or "Windows PC"), and the number of goals in it. The App uses these to describe the copy to you; they contain no goal or habit content.
• Where it is stored: on our hosting provider (section 5), under an identifier that is not your licence key and not your email. We keep a few recent versions so that a bad sync can be undone from the App.
• When it runs: on setup, when you tap Sync, and — if you leave auto-sync on — automatically each time the App opens.
• Forgotten passphrase: we cannot recover or reset it, by design. The data on your devices is untouched: from any device that still holds your data you can delete the cloud copy and set sync up again with a new passphrase, and your other devices will ask for it. A cloud copy whose passphrase is lost, with no device and no export file holding the data, cannot be opened by anyone, including us.
• Deleting it: turning sync off on a device stops that device syncing but leaves the cloud copy in place for your other devices. Delete cloud copy in Settings → Your data removes it; you can also email us from the purchase email of the licence (section 11). If your licence has been refunded, disputed or has lapsed, the App can no longer reach your cloud copy, so the Delete button will not work: email us from the purchase email (section 11) and we will delete the copy within 30 days. A deleted copy is kept, still encrypted, for at least 30 days so a mistaken deletion can be undone on request; after that it cannot be restored, and we remove it from storage on request.

4.4 Email signup ("Follow the build")

The Site previously offered an email-signup form; it was removed in July 2026. If you signed up while it existed, your address is stored by Netlify (Netlify Forms) and is used only for occasional product updates from the maker. Every email includes an unsubscribe link, and you can request deletion at any time (section 11). We never buy, sell, rent or share email lists. Product-update emails are sent through Lemon Squeezy’s email service with open tracking turned off. Receipts and licence emails are transactional and are not tracked.

4.5 Support email

If you email info.codemilestone@gmail.com, your message (and address) is processed by Google's Gmail service and kept as ordinary correspondence so we can help you and keep records of refund/billing issues.

4.6 Site analytics & advertising — none today

We currently run no analytics or advertising tools at all — not on the Site and not in the App. No Google Analytics, no Meta Pixel, no session recording, no fingerprinting, and therefore no cookie-consent banner (there is nothing to consent to). This is technically enforced as well as promised: the Site’s Content-Security-Policy blocks third-party scripts from loading. We will update this policy before adding any analytics or advertising tool.

If we ever introduce visitor measurement on the marketing Site, three commitments apply in advance: (1) it would run on marketing pages only — never inside the App, so it could never observe your goals or habits; (2) we would update this policy first, and where consent is legally required (for example in the EU/UK) such tools would load only after you accept them; (3) declining would keep the Site fully usable.

That is the entire list. If it is not in 4.1–4.6, it does not happen.

5. Payments — Lemon Squeezy is the merchant of record

All purchases are processed by Lemon Squeezy, LLC (USA), which acts as the merchant of record. That means Lemon Squeezy — not us — is the legal seller for payment purposes: it processes your payment, collects and remits applicable sales tax/VAT/GST, handles PCI compliance, issues receipts, and manages refunds and chargebacks through its payment processors (such as Stripe and PayPal).

• Lemon Squeezy collects from you: name, email address, billing address/country, tax information where applicable, and payment details. This is governed by the Lemon Squeezy Privacy Policy and Buyer Terms.
• We receive from Lemon Squeezy: order metadata — your purchase email, the product/variant bought, order status, and the license key it generated. We never receive or store your card number or payment credentials.

6. Third-party services we rely on

Each provider processes data under its own privacy policy and safeguards. We choose them deliberately for narrow roles; none of them receives readable planning data — the only copy that leaves your device is the encrypted sync snapshot, and Netlify holds it as ciphertext it cannot open.

7. What we never do

• No selling, renting or trading of personal information — to anyone, ever.
• No data brokers, no selling of audiences, no ad code at all — the Site’s security policy technically blocks third-party scripts.
• Inside the App: no analytics of any kind, no session replay, no heatmaps, no fingerprinting, no advertising code — ever.
• No profiling or automated decision-making with legal or similar effects.
• No reading, mining or "improving our models" on your goals and habits — we cannot; without sync we do not have them, and with sync we hold only ciphertext.

8. Cookies & local storage

Neither the App nor the Site sets any cookies, so there is no cookie banner. The App uses your browser’s localStorage only for things it needs to work: your planning data, settings, theme, reminder preferences, banner and install choices, app-lock settings, licence state and, if you use device sync, your sync settings and sync key. None of this is used for tracking or advertising. Your planning data is not sent to us except as the encrypted sync snapshot if you turn on device sync (section 4.3); your licence key and device identifier are sent when the App checks your Pro licence (section 4.2). Clearing your browser's site data removes all of it — including, note well, your planning data (see section 15).

We don't track you across other websites and we don't sell or share personal information, so there is nothing for "Do Not Track" or Global Privacy Control signals to switch off, and we don't respond to them differently. If you open the Site inside Instagram's built-in browser, that browser is run by Meta under Meta's own terms, not by us.

9. The AI planning feature — you choose what to share

MileStone's "Plan with AI" and "Update with AI" features work by copy and paste that you perform yourself: the App generates a prompt, you paste it into an AI assistant you choose and are logged into (such as ChatGPT, Claude or Gemini), and you paste the AI's reply back. MileStone never transmits anything to any AI provider. Whatever you choose to paste into a third-party AI service is shared by you, under that provider's privacy policy and terms — please review them. If your goals contain sensitive information, consider editing the prompt before pasting. We accept no responsibility for how a third-party AI service you choose to use handles data you give it.

10. Notifications

If you enable reminders, MileStone uses your browser's local notification permission. Reminder scheduling and content are computed and displayed on your device; no push-notification server of ours is involved. If you use device sync (section 4.3), your reminder settings are included in the encrypted snapshot, which we cannot read. You can revoke the permission in your browser or device settings at any time.

11. Retention & deletion

• Your planning data: retained by you, on your device, for as long as you keep it. Delete it any time via Settings → Your data → Clear All Data, or by clearing your browser's site data. Without sync we hold no copy to delete.
• Sync copy (if you enabled device sync): kept until you delete it from the App or ask us to. We keep the latest copy plus up to five earlier versions. Turning sync off or clearing a device does not delete the cloud copy. A deleted copy is kept, still encrypted, for at least 30 days; after that it cannot be restored, and if you email us we will remove it completely within 30 days.
• After a refund or lapse: your cloud copy stays stored, still encrypted, until you ask us to delete it. Email us from the purchase email and we will delete it within 30 days.
• License records: order metadata and license keys (including the revoked-key list) are kept for as long as needed to operate license enforcement and to meet tax, accounting and fraud/chargeback obligations, then deleted. Lemon Squeezy retains its own transaction records under its policy and legal obligations.
• Email list: until you unsubscribe (one click in any email) or ask us to delete you, which we will do promptly.
• Support correspondence: kept as long as reasonably necessary for support history and billing-dispute records, then deleted on request where the law allows.
• Hosting logs: generated and rotated by Netlify on its standard schedule; we do not separately archive them.

To exercise any deletion request, email info.codemilestone@gmail.com from the relevant address. We will act within 30 days.

12. Your rights

Australia: we handle personal information consistently with the Australian Privacy Principles under the Privacy Act 1988 (Cth). You may request access to or correction of personal information we hold, and complain to us first; if unresolved, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

EU/UK (GDPR/UK GDPR): you have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time without affecting prior processing. You may lodge a complaint with your local supervisory authority. For your planning data, you can see, export, correct and delete it yourself in the App, because it is stored in your browser. If you use device sync, we also hold an encrypted copy we cannot read; you can delete it in Settings → Your data → Delete cloud copy, or ask us to (section 11).

California (CCPA/CPRA): we do not sell or share personal information for money or cross-context behavioural advertising — we run no advertising tools at all. We collect only the limited categories described above (identifiers you volunteer; internet activity in routine server logs). You may exercise access/deletion rights via the contact below; we will not discriminate against you for doing so.

13. International transfers

Our service providers (Netlify, Lemon Squeezy, Google) are U.S.-based and may process data in the United States and other countries. Where required, transfers are protected by these providers' data processing agreements and recognised safeguards such as Standard Contractual Clauses. By using the Site or App you acknowledge this processing location.

14. Security

• All connections to the Site, App and license endpoint use HTTPS/TLS.
• Payment webhooks are cryptographically signed and verified (HMAC-SHA256) before we act on them.
• License keys are masked in our logs; we do not store full keys outside the narrow revocation list.
• Sync snapshots are encrypted on your device with a key made from your passphrase before anything is sent; the passphrase and the key are never transmitted. We do not publish implementation details here; a security researcher can reach us through security.txt.
• The single most effective security measure is architectural: we minimise what exists to be breached. A compromise of our infrastructure cannot expose goals, habits or personal content that was never sent to us — and the sync copy, the one thing that is sent, is encrypted before it leaves your device.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security of the limited data described in sections 4–5; we will comply with applicable data-breach notification laws (including the Australian Notifiable Data Breaches scheme) should an eligible breach of data we actually hold occur.

15. Data loss & your responsibilities — please read this one

The privacy benefit of on-device storage comes with a duty of care that sits with you, and — to the maximum extent permitted by applicable law — we are not liable for loss of, damage to, or disclosure of data that occurs on your device or through services we do not control. In particular:

• Clearing browser data, uninstalling, browser resets, OS "free up space" cleaners, private/incognito windows, or switching devices without exporting first will permanently destroy your planning data. We cannot restore it — we never had it. Use Settings → Export Data regularly and keep the file somewhere safe.
• Device security is yours: anyone with access to your unlocked device or browser profile can read your MileStone data. Use device locks; be careful on shared computers.
• Export files are yours: an export file contains, in readable form, your goals, milestones, steps, habits, check-ins, to-dos, notes, budgets and spend logs, and any profile details and contacts you added. It does not include your licence key, sync passphrase or sync key, app-lock PIN, reminder settings, sidebar notes, recently-deleted items, pacing history or activity history. Store and share it as carefully as you would a diary.
• Third-party services (your browser vendor, your device manufacturer, Lemon Squeezy, Netlify, Google, any AI provider you paste content into) operate under their own policies; we are not responsible for their acts or omissions to the extent the law permits us to exclude such responsibility.

Nothing in this policy excludes, restricts or modifies rights or guarantees that cannot lawfully be excluded — including your rights as a consumer under the Australian Consumer Law and any non-waivable rights under the GDPR or other applicable law. Our Terms of Service contain the full liability provisions that apply to the App.

16. Children

MileStone is for people aged 16 and over. Pro is bought by adults; a parent or guardian may buy it for someone aged 16 or 17. The Site and App are not directed at children under 16, and we do not knowingly collect personal information from them. Since the App requires no account and stores content in the browser, we usually receive little or no information about any user. If you're a parent or guardian and your child under 16 is using MileStone, email info.codemilestone@gmail.com. We'll refund any purchase, switch off the licence, and delete what we hold (support emails, licence and device records, and any sync copy) within 30 days. Plans saved in the browser stay on that device; we'll tell you how to clear them. We keep only what tax or payment law requires us to keep. Lemon Squeezy holds its own purchase records; we will ask it to act where it can.

17. Changes to this policy

We may update this policy as MileStone evolves — for example if we add an email provider or new infrastructure. The "Last updated" date at the top will change, and for material changes we will post a notice on the Site. Continued use of the Site or App after changes take effect constitutes acceptance of the updated policy. Earlier versions are available on request.

Changes in version 1.9 (16 October 2026): Netlify named as the hosting provider that keeps access logs for us (4.1); how we treat Do Not Track and Global Privacy Control signals, and Instagram's in-app browser (8); the age rule for using and buying Pro, and what we do when a parent or guardian contacts us (16).

Changes in version 1.7 (11 October 2026): corrected what happens to the purchase email at licence activation (4.2); listed everything device sync uploads, including your profile, contacts and reminder settings, all encrypted (4.3, 10); stated how long licence, device and sync records are kept (4.2, 11); explained how to delete a cloud copy after a refund or lapse (4.3, 11); described exactly what an export file contains (15); set a deletion time for requests about children (16); clarified what we can and cannot see in a sync copy (3, 12); confirmed we set no cookies (8); updated the page description.

18. Contact

Privacy questions, access/deletion requests, complaints:
Queensland, Australia
info.codemilestone@gmail.com

We aim to respond within 7 days and to resolve any privacy complaint within 30 days.