Golden Triangle Privacy Policy

Updated October 3, 2026

About Golden Triangle

Golden Triangle is an independent, voluntary platform developed and operated by the Golden Triangle developer to help people organize profiles, hubs, tasks and reminders. It is not affiliated with, sponsored by, endorsed by or approved by the U.S. Department of Defense, any military branch or any government agency. It does not replace official military systems or reporting requirements. This policy covers the Golden Triangle website, mobile app and account service.

Application and demonstration data

Use fictional information in the demonstration workspace. Account and hub services are separate from the local demonstration workspace. Personal vault and shared-record services support encrypted storage, recovery, and explicit record sharing. The local workspace remains separate from these services. Local demonstrations must use fictional information. The presence of a tracker does not mean it is approved for real personnel records.

Information that is not allowed

Do not upload, paste or enter CAC card photos, medical records, diagnoses or treatment details, classified information, Controlled Unclassified Information (CUI), or sensitive military information, including nonpublic operational plans, movements or mission details. Administrative tracker fields are not permission to enter prohibited information. Do not put prohibited content in notes, tasks, calendar titles, exports submitted for import or support messages. A privacy warning or agreement to share does not authorize otherwise prohibited use.

Information used to operate accounts

The account service stores account names, email addresses, password hashes, verification status, sessions, authentication settings, hub memberships, invitations, permissions and activity or consent records. These operational details are not encrypted with your personal recovery key. We use them to authenticate you, deliver account messages and enforce hub access.

Information in trackers

Depending on the fields you use, records can include names, rank, positions, contact details, dates of birth, addresses, the last four digits of an SSN, CAC expiration dates, family and dependent details, vehicle and license information, career dates, qualifications, fitness measurements and results, equipment, housing deficiencies, additional duties and administrative status. Tasks and calendar entries may include assignments, attendance, dates, times and completion details. Family entries can include names, relationships, gender, age and birthdays. These fields remain subject to the prohibited-information rules above.

The workspace uses entered information to display trackers and profiles, calculate results, organize tasks and appointments, and identify missing information and upcoming dates. Local records stay on the device unless you export or explicitly transfer them. Account and service metadata are handled separately as described in this policy.

Other people's information

Do not enter or share another person's information unless you have appropriate permission or other applicable authority. This includes information about soldiers, spouses, children and other dependents. Holding a leadership role does not itself establish authority to put information into this independent service. The app is intended for adult users, not for children to use directly. Family fields describe dependents; they do not create child accounts.

Personal and hub records

The experimental vault and shared-record pages encrypt supported record content on your device before sending it to the service. They store encrypted content and identifiers, version numbers and timestamps. For account-managed personal profiles and hub records, the service generates or receives record keys over HTTPS and stores them encrypted with a separate service secret. It provides those keys only after checking verified sign-in and ownership of the personal profile or current hub record permissions. This is service-managed encryption, not end-to-end encryption that excludes the service operator. While an account is linked to a hub, saved personal tracker changes are copied to its linked Soldier records, and authorized leader edits are copied back to the personal profile. The service decrypts and re-encrypts these updates to keep the linked information consistent. Leaving or unlinking stops future synchronization; existing hub copies remain unless removed through a record or account deletion action. A higher-HUB administrator can unlink an account throughout that HUB and its connected lower HUBs. Encrypted record keys may be stored for selected recipients. Legacy unmanaged personal profile and record keys cannot be recovered by resetting your password. Account-managed profiles and hub records remain accessible after normal account recovery, subject to current hub permissions. Older profiles and hub records require their original key once to enable managed access. Optional downloaded hub backups contain record keys and must be kept private.

This protection has not received an independent security review. It does not protect a compromised device or guarantee that an operator capable of changing the website could never access future entries. Do not enter prohibited sensitive information.

Sharing with a hub

The Members list includes linked accounts from the selected HUB and its connected lower HUBs. Authorized higher-HUB leaders can manage access within this hierarchy. An account may appear in the higher HUB even when its direct membership is in a lower HUB. Membership details can include your name, email address, role and HUB names.

In experimental sharing, authorized hub users can read account-managed records after signing in; legacy unmanaged records also require their record key. Users with editing access can change shared information. Review the recipients and access settings before sharing; this policy does not guarantee that information is restricted to your immediate supervisor.

A record offer lets its recipient review tracker information and choose whether to keep the hub information or transfer personal information. The accepted merge can update the personal and hub records. Open shared-record editors can refresh saved changes from the same hub while preserving unsaved drafts for review. Account-managed personal profiles and linked HUB records synchronize when saved online, as described above. This does not provide a guaranteed offline save queue or cryptographic erasure of keys already downloaded. Removing access cannot erase information another person has already downloaded or copied.

Sharing recovery

The experimental sharing screen creates an identity on your device. The service stores its public key, fingerprint and a private key encrypted with a separate sharing recovery key. Selected recipients receive encrypted record keys, bound to the sender, recipient, hub, record and saved version. Members must compare identity fingerprints through a trusted conversation. Password resets cannot restore the sharing recovery key. Identity replacement, key rotation and automatic recovery of every record are not implemented.

Record key backups

You can save an encrypted backup of up to 40 record keys for your account and hub. It is encrypted on your device with a separate backup recovery key. The service stores only the encrypted backup, account and hub identifiers, version and timestamp. Restoring requires that same account, current hub record access and the backup recovery key. Replacing the backup replaces its entire key collection. Account or hub deletion removes the active backup; infrastructure backups may persist under the retention limits described below. Password resets cannot recover the backup recovery key. Keep your original private key file separately.

Local prototype data

The local prototype keeps its records in that browser or app's local storage. It does not automatically import them into your online account. The private transfer tool lets you review and copy selected personnel fields from local saved data or an export into new encrypted hub records. Selected tasks, calendar events and assessment history can also be transferred. Historical scores are preserved without recalculation. New assessment transfers require the corresponding personnel record; the service stores the relationship between their record IDs so deleting the personnel record also deletes those assessments. This relationship does not identify an account until the personnel record is associated with one. Older unlinked imports are not automatically associated. Imported person and section identifiers do not grant access or assign cloud members; access rules are not transferred. The original export and local storage are not deleted. Clearing app storage, uninstalling the app or losing the device can remove local records. Keep backups before changing devices.

Service providers

Cloudflare provides hosting and database infrastructure. Resend processes recipient addresses and message content for verification, password-reset, invitation, membership-notification and support-related emails. Support reports and replies may also be stored in the application database. Better Auth handles authentication within our account service, and Capacitor integrates mobile device features; these libraries are not additional recipients merely because they are used in the app. Infrastructure providers may process technical request information, such as IP addresses, to deliver and protect the service. Do not send personnel records or recovery keys by email.

Fitness and administrative profile information

If entered, fitness scores, measurements, results and administrative profile status or expiration dates are used to display readiness trackers and related calculations. Online entries are stored with account-managed records and can be accessed by users with the applicable HUB permissions. These features do not provide medical diagnosis, treatment or advice. Do not enter diagnoses, treatment details or medical documents. Our service-managed encryption does not make uploaded information inaccessible to the service operator.

Service analytics and support operations

We count daily website page views and service errors to understand use and reliability. These counters do not store visitor identifiers, IP addresses, page URLs, or individual browsing histories; repeat visits and automated traffic may be included. Daily counters are retained for up to 366 days. Store-provided aggregate download reports may be used to understand iPhone and Android distribution. They are not linked to individual accounts. Total account-creation counters are retained without account identifiers.

Support reports may include internal investigation notes and completion status. If you request an update about a report, we can email you automatically when it is marked resolved. Direct support replies may also be sent to answer your request. Support inbox email replies are handled separately from the in-app report history.

Device storage, notifications and exports

The website uses sign-in cookies, and the app or browser stores preferences such as your theme and workspace view. Local demonstration records are not encrypted by the application; local role selection is a demonstration, not a secure multiuser access boundary. Protect your device and exported files. Your device or operating-system backup settings may also affect copies of local data.

With your device's notification permission, supported mobile screens can schedule local expiration reminders. Notification text is generic, such as “You have a reminder.” You can control notification permission in device settings. This does not promise remote delivery of every task or reminder.

Exporting creates a separate copy you control. Sharing that file gives its recipient access to the exported information. External links take you to services with their own privacy practices. The current application does not include advertising or analytics SDKs, and we do not sell entered records.

Support and privacy requests

If you contact support, we receive your email address and the information you choose to send. We use it to respond, troubleshoot and address your request. You can request access, correction or deletion of information held by the service using the contact below. We may need to verify your identity and clarify which records are involved. Local data and copies held by other users cannot be remotely erased by a support request. We handle requests according to applicable law; available rights depend on your location and the information involved.

Device unlock

The optional mobile biometric feature stores a sign-in session in biometric-protected device storage. It does not store your password or send Face ID or fingerprint templates to us. Session expiry, biometric changes or device loss may require signing in again. Record recovery keys are separate.

Retention and deletion

Active account information is retained to provide your account and HUB services until it is deleted through the relevant controls. Unlinking or uninstalling the app does not delete an account. Contact privacy support if you cannot sign in or need help requesting deletion of associated information.

The experimental record store retains up to ten previous encrypted versions. Encrypted backups you download remain in your possession and require the appropriate key. Deleting an active shared record removes its active history; downloaded copies and infrastructure backups may still exist. Confirmed administrator removal from a HUB ends that person's memberships and clears their position assignments throughout that HUB and its connected lower HUBs. It deletes associated Soldier records and dependent assessment history in that hierarchy. Administrator unlinking ends account access and profile synchronization across the same hierarchy while retaining historical HUB records. These actions do not delete the HUBs or other members' records. A linked member can explicitly copy their saved hub record into an existing personal vault before unlinking; later hub changes are not automatically copied. Unrelated HUBs, the person's account and existing personal vaults are not deleted by these membership actions. You can start account deletion on our website without reinstalling the app, or through Account Settings in the app. Sign in to verify ownership of the account. Confirm your password to delete your account immediately; no owner approval or waiting period is required. Transfer ownership or delete each HUB you own first. Completing self-service deletion removes your account, personal vault, sessions, key backups, and in-app support reports and replies. HUB-owned Soldier profiles and tracker history remain in their HUBs and are unlinked from your deleted account. Contact privacy support to request removal of retained identifiable HUB records. Support emails are deleted from the support mailbox, including Trash, within 30 days after the issue is resolved. Verified requests to delete those emails are handled within 30 days unless retention is legally required. This mailbox process is separate from in-app account deletion. While an account exists, limited record-to-account associations support privacy requests. Self-service account deletion removes these associations; retained HUB records must be identified separately when requesting their removal. The developer does not currently keep manually downloaded backups of user information. Support emails are retained in the support mailbox separately from the application database. Infrastructure backup expiration and deletion after a restore remain under verification before public release. This policy does not promise deletion of copies other people already downloaded.

Policy updates

We will update this page when our data practices change. The date above identifies this revision. Features described as experimental are not a promise that they are available in your version. This policy is a disclosure of our practices, not a government authorization or a guarantee against security incidents.

Contact

Email goldentriangleapp@gmail.com for privacy questions or to report unintended access. Include only the information needed to explain your request. Never include a password, verification code, recovery key or personnel record.