นโยบายความเป็นส่วนตัว.

1. Who we are

MIGOL ("MIGOL", "we", "us") is operated by Ferðavefir ehf. (kennitala 700910-0750), Sigtún 29, 105 Reykjavík, Iceland. Ferðavefir ehf. is the data controller for the personal data processed through migol.io and the MIGOL app. As Iceland is part of the European Economic Area, we process personal data in line with the EU General Data Protection Regulation (GDPR) and Icelandic Act No. 90/2018 on Data Protection.

Questions about privacy can be sent to support@migol.io, or call Ferðavefir ehf. on +354 775 6363.

2. Data we collect

• Account data: email address, password (stored hashed by our authentication provider), username, display name, profile picture and birthday. We use your birthday to check that you meet the minimum age for MIGOL (13) and for Networking (18). Only your age, not the date, can be shown on your profile.
• Optional profile details: full name, country and city, profession, best skill, bio, life goal and proudest achievement. You choose whether to fill these in. We use them to show your profile (only what your privacy settings allow), to tailor tips and to keep age-appropriate rules. You can edit or clear them in Settings at any time.
• Optional financial figures: net worth and monthly salary, and figures you enter in My Businesses. These are optional, private to your account, never shown on your public profile and never used for advertising. We use them only to show your own progress back to you.
• Feedback: when you send feedback in the app we store your message, your account email, the page you were on and your browser type, so we can reply and fix the problem.
• Marketing preference: whether you opted in to tips and product news, and when and where (sign-up or Settings) you made that choice.
• Content you create: habits and completions, daily tasks, goals, projects and milestones, 30-day commitments, journal entries, books, business figures, posts, comments and direct messages.
• Progress data: XP, ranks, achievements, badges, streaks and daily spin results.
• Social data: who you follow and who follows you (people who follow each other are mutual followers), follower counts shown on your profile, notifications and interactions with other users.
• Invites: if you join through a friend's invite link, we record who invited you, you follow them automatically, and after your first check-in we give you both a Streak Freeze and notify you both. Invites are not sent by MIGOL: you share your own link.
• Reports and blocks: when you report a profile, post, comment or message we store your report, the reason, any details you add and a copy of the reported text, so it can be reviewed even if it is later edited or deleted. The person reported is not told who reported them. We also store who you block and the posts you hide for yourself.
• Payment data: subscriptions are not open until 1 January 2027, so we do not take a payment or a receipt before then. When you subscribe, Paddle.com (our reseller and Merchant of Record) will take the payment and handle billing. Prices include VAT. Paddle processes payment details under its own privacy policy. We receive your subscription status, whether you are in a trial, your Paddle customer id, plan, renewal date and whether you joined as a founding member, never your full card number.
• Technical data: device and browser information, IP address, log data, push-notification tokens if you enable notifications (used only for the reminders and alerts you switch on in Settings, such as habit reminders and a streak-at-risk alert; turning notifications off removes the token), and usage analytics, including which campaign link brought you to MIGOL (for example utm_source=instagram) and a few steps such as starting and finishing sign-up.

3. Why we use it (legal bases)

• To provide the service (performance of a contract): creating your account, storing your data, syncing it across devices and running gamification and social features.
• To improve and secure MIGOL (legitimate interests): fixing bugs, preventing abuse and understanding how features are used.
• Analytics cookies (consent): we ask in our cookie banner before loading Google Analytics. You can withdraw consent at any time via Cookie settings.
• Cookieless usage statistics (legitimate interests): Vercel Web Analytics counts page views and a few anonymous steps, such as starting sign-up, adding a first habit or coming back the next day. It sets no cookies, stores nothing on your device and receives no names, emails or account ids. Signed-in users can switch it off with “Anonymous Usage Analytics” in Settings.
• Marketing emails (consent): we only send tips and product news if you tick the optional box at sign-up or turn on “Tips and product news” in Settings. The box is never pre-ticked. Every marketing email contains an unsubscribe link, and you can switch it off in Settings at any time. Withdrawing consent does not affect account emails such as sign-in and password messages, which we send to provide the service.
• Optional profile and financial details (consent, by choosing to provide them): you can remove them at any time.
• Legal obligations: for example keeping accounting records for payments.

Journal and mood entries. Journal entries, mood ratings and other reflections may reveal sensitive information, such as details about your health or wellbeing. We process them only to store them and show them back to you (performance of a contract). Where an entry contains special-category data, we process it on the basis of your explicit consent, which you give by choosing to write it, and you can withdraw it at any time by deleting the entry. This content is private to your account, is never shown to other users unless you share it yourself, and is never used for advertising or sold.

4. Where your data is stored

Your data is stored with Supabase, which provides our database, authentication and file storage, running on cloud infrastructure. The website is hosted on Vercel. Database access is protected by row-level security so that each user can only access their own private data. Other processors we use include Google Analytics (usage analytics, with consent), Vercel Web Analytics (cookieless usage statistics), Sentry (error monitoring, hosted in the EU, which receives technical crash details such as browser type and the page where an error happened, without IP addresses or account details) and an email delivery provider for account emails. When subscriptions open on 1 January 2027, Paddle.com will process payments as our reseller and Merchant of Record. It does not process a payment for MIGOL before then.

Some of these providers may process data outside the EEA, for example in the United States. Where this happens we rely on appropriate safeguards such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

5. Cookies and similar technologies

We use strictly necessary cookies and local storage to keep you signed in, remember your preferences (such as theme) and keep the app secure. These do not require consent, and if you block them signing in will not work.

With your consent, we use Google Analytics (cookies such as _ga and _ga_*, kept for up to 2 years) to understand how MIGOL is used. Google Analytics is not loaded until you click “Accept” in our cookie banner; we use Google Consent Mode v2 with all analytics and advertising storage denied by default. We do not use advertising cookies. Your choice is stored in your browser's local storage (migol-cookie-consent). You can change or withdraw your consent at any time via “Cookie settings” in the site footer; rejecting removes the Google Analytics cookies we set.

We also use Vercel Web Analytics, which works without cookies or local storage: it counts visits from a short-lived, anonymised request signature that is discarded within a day, so it runs whatever you choose in the cookie banner. Page addresses are sent without query strings (apart from campaign tags such as utm_source=instagram) or profile names. We also count a few anonymous steps (landing page view, a click on a sign-up button, sign-up started and finished, first habit and first check-in) together with the campaign source that brought you, and never with your name, email or user id. These are skipped for test accounts. Signed-in users can turn it off with “Anonymous Usage Analytics” in Settings.

6. Instagram and Meta

We run an Instagram account (@migolsocial), which is provided by Meta Platforms. When you follow, comment on or message our Instagram account, Meta processes your data under its own privacy policy, and we can see your public profile and the interactions you send us. We do not connect your Instagram account to your MIGOL account, and we do not sell your MIGOL data to Meta or anyone else.

7. Sharing

We do not sell your personal data. We share data only with the service providers listed above, with other users when you use social features (for example your profile, posts and messages to people you follow each other with), or when required by law.

8. Retention and account deletion

We keep your account data and the content you create for as long as your account is active. Feedback messages are kept for as long as needed to handle them, and no longer than 24 months. Records of your marketing choice are kept while your account exists so we can show what you agreed to. Technical logs and error reports are kept for a short period (typically up to 90 days) by our hosting and monitoring providers.

You can delete your account yourself at any time in Settings, Danger zone, Delete account. Your account will be deleted in 30 days. During those 30 days it is hidden from other members (your profile, posts, comments and messages show as unavailable), you get no notifications, and it is left out of analytics. Sign in before then to restore it exactly as it was. After 30 days your account and all associated data, including uploaded photos and files, are permanently erased by an automatic daily job, and your username becomes available again. Data we must keep for legal reasons (such as payment records) is kept only as long as required.

If you can't sign in, email support@migol.io from the email address linked to your account and we will delete it for you on the same schedule.

You can download a copy of your data at any time in Settings with Export your data. Export before deleting if you want to keep a copy: once an account is permanently erased, it cannot be recovered.

9. Your rights

Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time. You can export your data and delete your account yourself in Settings (see section 8). To exercise any of these rights another way, contact support@migol.io. You also have the right to lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd, personuvernd.is) or your local supervisory authority.

10. Children

MIGOL is not intended for children under 13, and users under 16 should have permission from a parent or guardian. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes

We may update this policy from time to time. We will post the new version here and, for significant changes, notify you in the app or by email. See also our Terms of Service.