One suggestion: goal URLs should use a salted hash key, so that they aren't so easily guessed. Alternatively, implement some kind of access control so that you can only see goals you are a party to. Otherwise, seems great, I'm trying it out!