Most goal tracking assumes you want to be seen. Streak counts to show people, badges to share, a feed of other people doing the same thing. That works for some goals. It works badly for the ones people care most about.
A goal you have not told anyone about is the normal case, not a strange one.
The goals people do not announce
Think about what someone actually puts a photograph of on a goal app. A house they cannot afford yet. A body they are embarrassed about wanting. A country they have never been to. Leaving a job. Leaving a relationship. A qualification they might not pass.
These have something in common: telling people costs something. It invites an opinion you did not ask for, or it sets up a public failure if it does not happen. Plenty of research and plenty of common sense both suggest that announcing a goal can make you less likely to finish it, because the announcement itself feels like progress.
So the person quietly working toward something is not being secretive. They are being sensible. An app for that goal should be built for one reader.
Three different things called "private"
This word gets used for three claims that have almost nothing to do with each other, and it is worth separating them before you trust any app's marketing.
Nobody is collecting it. The data is not sent anywhere, sold, or fed to advertising. This is about the company.
Nobody can read it in transit or at rest. If anything does leave the device, it is encrypted first, and the company holds no key. This is about the engineering.
Nobody standing next to you can see it. Someone picks up your unlocked phone, or glances at your laptop, or reads your home screen while you are holding it. This is about the room you are in.
The third is the one that actually happens, and it is the one almost nothing addresses. A perfect answer to the first two is no help at all when your partner picks up your phone to look at a photo and the app is still open.
What a lock has to cover
Here is where most implementations stop too early. Locking the app is the easy part. The information leaks from three other places.
The home screen widget. If the whole point of the app is a widget you see every day, then the widget is the leak. Anyone who glances at your phone sees the goal without unlocking anything.
Notifications. A reminder that names your journey on the lock screen undoes the lock entirely, and lock screen previews are on by default for most people.
The app switcher. When you swap apps, the system takes a snapshot of the screen to show in the switcher. If it snapshots your goal, the lock is decorative. This one is genuinely difficult and it is where careless implementations fail.
A lock that does not answer all four is a lock on the front door of a house with the windows open.
The trap that makes people switch it off
There is one design mistake that will make anyone abandon a lock within a day.
Choosing a photo means leaving the app. The photo picker, the camera and the share sheet are separate programs, so from the app's point of view you just left. If it locks the moment you leave, then tapping "Choose Photo" locks you out of the exact task you were in the middle of. Every time.
The rule has to know that a picker the app itself opened is not you walking away. It sounds like a detail. It is the difference between a feature people keep on and a feature people turn off once and never revisit.
The other half is the delay. Locking instantly is correct if you are worried about someone in the room. It is infuriating if you check in, switch to reply to a message, and come back ten seconds later to a fresh authentication prompt. That is a choice only the person using it can make, so it should be a setting rather than an assumption.
How Reveal the Dream does it
The app puts a photograph of your goal behind a cover that comes off one piece per check-in, so the private version of this question is unusually literal: the goal is a picture, and either someone can see it or they cannot.
The first two kinds of privacy are the default and cost nothing. There is no account needed, and your journeys, check-ins and photographs stay on your device. Two optional things reach a server: Premium's cross platform sync, which holds one copy encrypted on your device before it leaves so it cannot be read on our side, and an optional email sign in that carries a subscription from one platform to another and never carries a journey or a photo.
App Lock is the third kind, and it is a Premium feature. What unlocks it depends on the device, because claiming otherwise would be false somewhere: Face ID or Touch ID on iPhone, iPad and Mac, your fingerprint or face on Android, and a password you set on Windows. On Apple and Android it falls back to the device passcode, so a failed fingerprint never locks you out of your own goal.
One thing the Windows app says plainly on its own settings card, and this page should not soften: there the lock is a privacy screen rather than encryption. It stops the person who wanders past your desk. It is not a claim about somebody who takes the machine away and goes looking through the files, and an app that let you believe otherwise would be selling you a feeling instead of a protection.
When you switch it on you are asked, once, whether to hide widgets and reminders too. That question gets no default on purpose. Guess "just the app" and someone believes they are private while the photograph sits on their home screen. Guess "widgets too" and the widget goes blank with no explanation and reads as a bug. With hiding on, the widget shows a locked card, reminders stop naming your journey, and a paired watch is sent the progress count without the photograph.
You also choose whether it locks immediately or after a minute, and opening the photo picker does not count as leaving.
Two things worth stating plainly. On Android, turning App Lock on also stops screenshots of the app, including in the app switcher. That is the only way to keep the switcher snapshot from showing your goal on Android, and it is a real cost, so the app says so on the settings card rather than letting you discover it. iPhone does not pay that cost, because its cover is drawn in a separate window that can be shown in time.
And if your subscription ends, the lock stays on. Premium buys switching it on, not keeping it on. Nobody should ever find their private app unlocked itself because a card expired.
You can try the app on your own photo on the homepage without installing anything, see what else Premium includes, or read about the vision board idea this is built on.