Privacy Policy
This document is the binding statement of how Planye handles personal data. Where a help page summarises it, this document governs.
Who holds your planner
Planye is made and run by Riquetti Studio, CNPJ 41.011.161/0001-68, Rua Rodriguês do Prado, 150, Ermelinda, Belo Horizonte, MG, Brazil. Under Brazil's Lei Geral de Proteção de Dados we are the controller of everything described below.
Planye is open to readers anywhere, so where the GDPR, the UK GDPR or a comparable law reaches you, we act as controller under that law too, and this document is written to hold either way.
Anything in this document, or any request about your own data, goes to contact@planye.com.
What we hold
A few kinds of thing, and they are worth telling apart.
One thing on that list can exist before we hold any of it. Planye opens without an account, and while it is open that way everything you write stays in your own browser's storage on your own device. None of it is sent to us, we cannot see it, and nothing about it reaches any of the companies named below. It becomes ours to hold, in the sense the rest of this document means, only when you make an account and it moves onto that account. Until then, clearing your browser's data removes it, and there is nothing here we could put back.
That is the whole list. There is no advertising network and no data broker, and we do not buy data about you from anyone. One measurement tool and one crash reporter are named below. The measurement tool counts which of our pages get opened, never what is on them; answers which features are switched on for you, and is told who is asking (your account's identifier and email address) and nothing else about you; counts a short list of moments inside the app; and, while you are signed in and have not turned it off, keeps a recording of the screen with every letter you wrote, every photo and every amount blanked out before it leaves your browser. The crash reporter is told what broke, and around some crashes it keeps a recording of the screen masked the same way. Nothing you write into your planner is ever sent to either.
| What | Specifically |
|---|---|
| Your account | Your email address, whether it is confirmed, and the name you chose. A profile picture, if you set one: it is cropped to a small square in your browser before it is sent, which removes the location and camera details a photo normally carries. If you sign in with Google, the name, email address and profile picture Google passes over. If you sign in with Apple, the email address and, once and only on the first sign-in, the name Apple passes over. Apple lets you hide your address, and when you do, what reaches us is the relay address Apple gives in its place: that is the address we hold and the one we write to, and your own never arrives here at all. We also keep the token Apple issues for that sign-in, for one use only: telling Apple to end the sign-in when you close your account. Your password is handled by Supabase Auth: it never reaches our server and we cannot read it. |
| Your planner | Everything you write into it. Weeks, categories and entries, habits and their marks, priorities, moods, cycle days and symptoms, budget lines, envelopes and holdings, projects, lists, wishes, your reading and watching shelf, year notes and memories, sealed capsules, and every journal page including the photos, video and voice notes on it. This is never shown to anyone but you. |
| A feature request you post | If you post one (Help, then Suggest a feature), the title and description you write are shown to every other signed-in account once we approve it; before that, only you can see it. It carries no name and no avatar, and nothing on the board tells another reader which account wrote it. We keep the author internally, only so we can limit how many requests one account posts in a day and let you take your own back down, and that is never sent to anyone reading the board. Voting works the same way: nobody else can see which requests you voted for. |
| Requests | Our server records the ordinary things a server records when your device syncs: the IP address the request came from, the time, the path, and the browser string. Separately, because the Marco Civil da Internet requires it of us, we keep a record of which account used Planye from which IP address and in which hour. Nothing in either record names what you wrote. |
| Usage measurement | We count which of our pages get opened, on the website and inside the app, with PostHog. It receives the address of the page with everything after the question mark removed and any row identifier replaced, the site that sent you, your browser and device type, and an approximate country worked out from your IP address, which PostHog is set to discard once it has done that. On the website it stores nothing on your device, so it is given no identifier that lasts beyond the page and cannot tell that two visits were the same person. Inside the app the count is made as your account, like the moments in the row below, and the same switch stops it. It never receives the contents of your planner, your journal, your cycle or mood entries, or which week or page you had open. |
| A few moments inside the app | So that we can tell whether people who start using Planye keep using it, and which parts of it get used, we count a list of moments inside the app and send them to PostHog as your account: that an account was created, that somebody signed in, the first task and the first habit you write, that the app was open on a given day, that you kept one of the ready-made lines a brand-new planner is offered, that a planner was kept in this browser before there was an account and later moved onto one, that a guest planner was instead deliberately left behind, that we asked how the app is going or mentioned Planye+ without being asked and whether you opened what we mentioned, that you made, changed, ticked off, removed or brought back something in your planner and which kind of thing it was (a journal page, a list, a list item, a task, a habit, a budget line and so on, but never anything in Cycle or Mood), and for a journal item what it is made of (text, a photo, a video, a voice note, tape, a sticker, a shape, a drawing or a task) and which kind of book it is in (a day, a capsule, a notebook or a layout), that you changed a setting, which setting it was and, for a switch or a theme, what you changed it to, but not your own colours or hours, that you switched how a page is shown or turned to another period, but never which one, that you opened the journal, the assistant or a help page and which help page, that you asked us something, reported a bug, or posted or voted on a feature request, that you connected or disconnected a calendar, changed the weekly email, used a promo code, opened your billing page, saved your media, applied a template, recorded a photo, video or voice note, or closed your account, that you put a block on a page you laid out and which kind, that you opened a row's menu and which action you picked, that you sent the assistant a message and whether you typed it or spoke it, that you undid a change the assistant made, that you met one of the free plan's limits and which one, that you looked at the price, that you started paying and that you finished, and that a free trial started or turned into a subscription. That is the entire list. Each of them says only that the thing happened, on what day: not which one, not what you named a task or a habit, not an amount, not what you said to the assistant, and nothing else from inside your planner. They are tied to the same random identifier and email address the row below describes, and to nothing else about you. While you are signed in, PostHog also keeps a recording of the screen: where things sat on the page and what you tapped, with every letter you wrote, every photo, video and voice note, every amount and every date you entered blanked out in your browser before anything is sent, so that only the app's own words and the shape of the page survive. It is kept for 30 days, and it is never made for a planner kept without an account. You can turn all of this off: Your account, then Counting. With it off, nothing on that list is sent and no recording is made, from any device you are signed in on, and the planner works exactly as it did. |
| Which features you get | We can turn a feature on for a few accounts before everybody has it, or switch one off if it misbehaves. To do that your browser asks PostHog which switches are on, saying who is asking: the random identifier your account has in our database, and your email address, which is what lets us name an account when turning a feature on early. That pair is what PostHog keeps as its record of your account, and it is the whole of what is sent about you. It is also told which of our sites you are using, the live one or the one we test on, so a feature can be switched on for testing without switching it on for everybody. That is a fact about our setup, not about you. It receives no page address and nothing you wrote. The only record of anything you did that reaches it is the short list of moments in the row above, sent as the same account. |
| A calendar you connected | If you connect a calendar, Google's or Outlook's: the title, day and time of each event in a window running three months back and twelve months forward, so they can be drawn on your week. Also which calendars you chose, what you named them, and anything you set on one of those events yourself, such as a colour. We read your calendar and never write to it. Your permission is held as a token we keep encrypted. Disconnecting deletes that token and the events come off your week. For a Google calendar the permission is also revoked at Google. Microsoft offers no way for us to revoke from our side, so Planye stays listed in your Microsoft account's app permissions until you remove it there; with the token deleted we can read nothing more either way. We keep the copy, along with the account's address, so that connecting the same account again restores the week and everything you set on it. If you would rather it went now, ask at contact@planye.com and we delete it. Closing your account removes all of it either way. |
| When something breaks | What broke and where: the error, which version of Planye you were on, the address of the page it happened on, and your account's random identifier, never your email address. For some crashes, the minute of screen activity in front of it, masked in your browser before it is sent so that every letter and every photo, video and voice note is blocked out. It records nothing while nothing is wrong. |
| The weekly email, if you turn it on | A look back at your week, sent on Mondays and off until you ask for it. Building it reads your week's headline, your priorities, the habits you marked, how many tasks you finished each day and how many events a calendar you connected held, and what is on the week starting, including the titles of the first few of its tasks and events. The week just gone is counted rather than listed, so nothing you wrote on it is named in the email. Turning it off stops the sending and the reading both. |
| The assistant, if you use it | The assistant is part of Planye+ AI, and it adds, changes and finds things in your planner when you write or speak to it. Each message you send goes to our server and on to the company whose model answers it, named in the list of companies below, with what it needs to answer: the message itself; the date, the time and the language the app is in; the names of the things in your planner, such as your lists, categories, habits and envelopes, and for mood, cycle and the journal only whether there are any; and the entries of the part of your planner the message is about, such as this week's tasks or the items on one list. The changes it makes are made on your device, the same way a change you make yourself is. The conversation, and the list of changes it made, are kept on that device only: they are not synced and they are not on our server. Our server keeps none of its words. For each answer it records which model gave it, how much text went in and out, what it cost, how long it took, whether it worked, and the names of the actions taken, such as adding a task. If you tap Report on an answer, that conversation's messages are sent to us so we can see what went wrong, and that is the one time its words reach us. When you speak to it on a phone, or in Chrome or Safari, the listening is done by your device's or your browser's own speech recognition, and Chrome sends the sound to Google and Safari sends it to Apple, under their own policies rather than ours. Where your browser cannot listen by itself, as in Firefox, the recording of what you said is sent to OpenAI to be written down. If you turn on the OpenAI voice, the sentences of a spoken reply are sent to OpenAI to be read aloud. |
| Your subscription | If you subscribe to Planye+: which currency you are billed in, the country that decided it, whether the plan is running, and the identifier Stripe gave your account there. If you subscribed inside the iPhone or Android app instead, it is which plan you bought, when it renews and whether it is still running, told to us by RevenueCat. Card numbers are typed on Stripe's or the store's own screen and never reach us, so we do not have one to hold, lose or show you. |
Health, money, and the things you would not say out loud
A planner is not a to-do app. Some of what Planye holds is genuinely sensitive: your cycle and its symptoms, how you felt on a given day, what you earn and what you spend, and a journal with your photographs in it. Under LGPD article 11 and GDPR article 9, cycle and mood entries are health data and carry a higher bar than the rest.
Nothing is filled in unless you fill it in. Cycle, Mood and Money are modules you choose to add from Customize, and a planner without them holds none of this.
It is used for one thing, which is showing it back to you: storing it, syncing it between your own devices, and drawing it on the page. There is no second purpose.
It is never sold, never shared with advertisers, and never used to train a machine-learning model, ours or anyone else's. This holds for all of your planner, not only the sensitive parts.
It also stays out of the two places people reasonably worry about. Our measurement receives page addresses on our public pages, and inside the app the bare fact that one of the listed moments happened. It never receives page contents, so it cannot see a cycle day, a mood, a budget line or a word of your journal. Writing a cycle day or a mood is counted nowhere at all. Writing or changing a budget line is counted as the bare fact that it happened, never the amount, the name or the category. Whoever handles the payment (Stripe on the website, Apple or Google inside the apps, and RevenueCat, which keeps track of both) receives what a payment needs and nothing from inside the app at all: subscribing to Planye+ tells them that somebody paid, never what they wrote.
The assistant in Planye+ AI is the one place any of it can be sent somewhere to be worked on rather than stored. If you ask it about your cycle, your mood or your journal, the entries it needs to answer go with your message to the model that answers it, as the table above describes. If you do not, all it is told is whether you have any.
Google user data
If you connect a Google calendar, Planye's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. That policy is published at https://developers.google.com/terms/api-services-user-data-policy.
Four rules come with it, and they are Google's rather than promises we invented. What we read from your calendar is used for one thing, which is drawing those events on your week, and that is the feature you connected it for. It is never sold and never passed to an advertising network. It is never used to train a machine-learning model. And nobody here reads it, other than where you ask us to look at something for you, where we are investigating abuse or a security problem, or where a law requires it.
We ask Google for read access and nothing else. Planye cannot add, change or delete anything in your calendar, and no code in it tries to.
Why we are allowed to hold it
Every law in this area asks the same question in a different accent: on what basis. Ours, per kind of data.
| What | On what basis |
|---|---|
| Your account | Performing our agreement with you, and keeping the account secure. LGPD art. 7, V; GDPR art. 6(1)(b). |
| Your planner content | The same. Storing what you wrote and syncing it to your devices is the service you signed up for. |
| Cycle, symptoms and mood | Your specific consent, given by adding those modules and writing in them. LGPD art. 11, I; GDPR art. 9(2)(a). You withdraw it by deleting the entries, removing the module, or closing the account. |
| A feature request you post | Our legitimate interest in running a public request board, weighed against posting being entirely your choice and never carrying your name. LGPD art. 7, IX; GDPR art. 6(1)(f). |
| Request logs | Our legitimate interest in keeping the service running and defending it from abuse. LGPD art. 7, IX; GDPR art. 6(1)(f). |
| The access record | A legal obligation: the Marco Civil da Internet, article 15, requires it. LGPD art. 7, II. Where the GDPR reaches you, a Brazilian obligation is not one that law recognises, so there the basis is our legitimate interest in obeying the law we operate under, GDPR art. 6(1)(f). |
| Usage measurement | Our legitimate interest in knowing which pages work and which ones lose people, weighed against how little it holds: no planner content, nothing after the question mark, and on the website no identifier that outlasts the page. LGPD art. 7, IX; GDPR art. 6(1)(f). On the website nothing in it could pick out your visits, so the way to object is to block it in your browser; inside the app the switch under Your account, then Counting, stops it. Planye works the same either way. |
| A few moments inside the app | Our legitimate interest in knowing whether people who start using Planye keep using it, which parts of it get used, and where inside it they get stuck, weighed against how little each moment says, how thoroughly a recording is blanked out before it leaves your browser, and the one switch that stops both. LGPD art. 7, IX; GDPR art. 6(1)(f). |
| Which features you get | Our legitimate interest in releasing a change to a few accounts before all of them, and in being able to switch one off without waiting for a new version of the app. LGPD art. 7, IX; GDPR art. 6(1)(f). What is kept to do it is your account's identifier and email address, as the table above says. |
| A calendar you connected | Performing our agreement with you: you connected it so its events would appear on your week. LGPD art. 7, V; GDPR art. 6(1)(b). |
| When something breaks | Our legitimate interest in finding and fixing what broke, weighed against the masking described above. LGPD art. 7, IX; GDPR art. 6(1)(f). |
| The weekly email, if you turn it on | Your consent, given by turning it on and withdrawn by turning it off. LGPD art. 7, I; GDPR art. 6(1)(a). |
| The assistant, if you use it | Performing our agreement with you: you asked it to do something in your planner, and sending your message and the part of your planner it is about to the model that answers is how it does it. The same holds for a conversation you choose to send us with Report. LGPD art. 7, V; GDPR art. 6(1)(b). |
| A message you send us | Answering it, which is what you asked for by sending it. LGPD art. 7, V; GDPR art. 6(1)(b). |
| Your subscription and its payment records | Performing our agreement with you, plus the legal obligation to keep tax records. LGPD art. 7, II and V; GDPR art. 6(1)(b) and 6(1)(c). |
Where it lives, and who else touches it
Two copies. One is on your device, in the browser's own database, and it is the copy Planye reads from: that is why the app works with the network off and never spins waiting for a server. The other is on ours, so a new phone gets your planner back.
We do not run our own data centre. The companies that hold a piece of it on our behalf are listed in the next clause, each under a contract that lets them process it only on our instructions.
Who holds what
Each of these processes data only on our instructions, under a contract that says so. Adding one is a change to this document and is announced the same way any other change is.
| Who | What they hold |
|---|---|
| Supabase | Sign-in and the server copy of your planner, in a Postgres database. Also your profile picture, if you set one. That single file is the one thing Planye stores where a link to it can be opened by anyone who has the link, because it has to be drawable on every page without a delay. Nothing else you write is stored that way. |
| Render | The sync API your devices talk to. |
| Cloudflare R2 | The photos, video and voice notes on your journal pages. Each file is stored under your account id and reached only through a short-lived signed link. |
| Netlify | The website and the app itself. |
| Google Fonts | Planye loads its typefaces from Google, which means Google sees the IP address your browser asks from. Nothing else about you is sent. |
| PostHog | Which of our pages get opened, which optional features are switched on for you, a short list of moments inside the app, and a masked recording of the screen while you use the app. It runs in the European Union. The page count receives the address with everything after the question mark removed and any row identifier replaced, the site that sent you, your browser and device type, and an approximate country from your IP address, which it then discards; on the website it keeps nothing on your device. Your browser asks the feature question as your account: the random identifier it has in our database, and your email address, which is what lets us switch a feature on early for a few accounts named by email. That pair is the whole of PostHog's record of who you are, alongside which of our sites you are using: the live one or the one we test on, which is a fact about our setup rather than about you. The moments are the ones listed earlier in this policy, from an account made to a trial that started or turned into a subscription, and each says only that it happened. The recording is made only inside the app, only while you are signed in, and only after your browser has blanked out every letter you wrote, every photo, video and voice note, and every amount and date, so that what arrives is the app's own words and the shape of the page; it is kept for 30 days. One switch in your account stops the moments and the recording together. Click recording is turned off in the code, and of everything else the library would send, nothing leaves your browser but the page count, those events, the recording and the note that says which account signed in, each with the page cut down to the tab it names before it goes. |
| Sentry | Crash reports, and only when something breaks. It is told what broke and where: the error itself, which version of Planye you were on, the address of the page, and the random identifier your account has in our database. Never your email address. For some crashes it also keeps the minute of screen activity in front of them, and that recording is masked inside your browser before it is sent: every letter is blocked out, and every photo, video and voice note with them. What arrives is the shape of a page, never a word of what is on it. Our own server reports its own errors to the same place. |
| Formspree | Messages you send through "Ask us" in Help: what you wrote, your reply address, and the page you were on. Nothing from inside your planner. |
| Resend | Only if you turn the weekly email on. It delivers that one email, so it handles your email address along with everything the email says: your week's headline if you wrote one, the titles of your priorities, the names of the habits you marked, how many tasks and how many calendar events each day of the week just gone held, and the titles of the first few things on the week starting, those from a connected calendar included. Nothing else from your planner reaches it. No journal page, cycle day, mood or budget line is ever in one of these emails. |
| Stripe | Payments for Planye+ bought on our website. Your card details, your billing address and whatever else the payment needs, all typed on Stripe's own page rather than ours. What comes back to us is whether the plan is running, in which currency, and until when. We never see a card number. |
| RevenueCat | Only if you subscribe to Planye+. Inside the iPhone or Android app, Apple or Google takes the payment and RevenueCat is what tells us the subscription exists: it is told the random identifier your account has in our database and receives from the store which plan you bought, when it renews and whether it is still running. On the website, Stripe takes the payment and we tell RevenueCat about the subscription, so that we can see every subscription in one place: it is told the same identifier and Stripe's identifier for the subscription, and reads from Stripe which plan it is, what it costs, when it renews and whether it is still running. It never sees a card number, your address or anything from your planner. |
| Google Calendar | Only if you connect one. We ask Google for the events in the calendars you picked, so they can be drawn on your week, and Google is told nothing about your planner in return. The permission is read-only: we cannot add, change or delete anything in your calendar. Disconnecting deletes our copy of the permission and revokes it at Google, so we can read nothing more. |
| Outlook Calendar | Only if you connect one. We ask Microsoft for the events in the calendars you picked, so they can be drawn on your week, and Microsoft is told nothing about your planner in return. The permission is read-only: we cannot add, change or delete anything in your calendar. Disconnecting deletes our copy of the permission, so we can read nothing more; Microsoft offers no way for us to revoke it on their side, so Planye stays listed in your Microsoft account's app permissions until you remove it there. |
| Anthropic | Only if you use the assistant in Planye+ AI. Anthropic's Claude models are the first choice to answer every message you send it, and each message is sent with what it needs to be answered: the message itself; the date, the time and the language the app is in; the names of the things in your planner, and for mood, cycle and the journal only whether there are any; and the entries of the part of your planner the message is about, such as this week's tasks or the items on one list. We reach it through its API, under commercial terms that do not let Anthropic train its models on what we send. |
| OpenAI | Only if you use the assistant in Planye+ AI, and only in three cases. When Anthropic's models fail to answer a message, OpenAI answers it instead and is sent the same things the Anthropic row lists, for that answer only. If you turn on the OpenAI voice, the sentences of a spoken reply are sent to it to be read aloud. And where your browser cannot listen by itself, as in Firefox, the recording of a question you speak is sent to it to be written down. When it answers a message, the request asks OpenAI not to store it, and OpenAI does not train its models on what is sent through its API by default. |
| Langfuse | Only if you use the assistant in Planye+ AI. It is where we watch whether the assistant is working, and for each answer it is told numbers and names only: which model answered, how much text went in and out, what it cost, how long it took, the names of the actions taken, such as adding a task, the random identifier your account has in our database, and an identifier for the conversation. Never the words, with one exception: when you tap Report on an answer, that conversation's messages are sent to it so we can see what went wrong. |
Who is deliberately not on this list
One of the companies above measures something, and it never sees what is on a page. It counts which pages get opened, answers which features are switched on for your account, counts the moments this policy lists, and keeps a masked recording of the screen inside the app. Beyond it there is no advertising network, no data broker, and nothing here is bought from anyone or sold to anyone. That is not an oversight, it is the whole reason the list is short enough to publish.
It is worth being plain about which of the things that company is known for we use. PostHog can record a session, capture every click and count every page. Ours counts pages, with the address cut down to the tab it names. It does not capture clicks: that feature, which sends the words around whatever you tapped, is off. And it records the screen only inside the app, only while you are signed in, only until you turn Counting off, and only after your browser has replaced every letter you wrote, every photo and every amount with blanks, so that what arrives is the app's own words and the shape of the page. What it may send is a list written down in one file rather than whatever the library would send on its own: the sign-in note, carrying the identifier and email address above and which of our sites you are using; the page count; the recording; and the few moments this policy names, from an account made to a trial started or converted. Nothing on it carries which week you had open or a word you wrote. So what is left is a question about switches, an answer about switches, a name to switch one on early for, a count of which pages people reach and whether they stay, and a masked picture of where they get stuck.
Apple and Google are not on the list either, and for a different reason than the two above. Subscribe inside one of the apps and the store is the seller rather than a company holding something for us: it takes the payment, it keeps what a payment needs, and what it does with that is governed by its own policy rather than by ours. What reaches us is the line in the RevenueCat row, which is which plan you bought and whether it is still running. No card number comes back to us on that route either.
Screen recording is the other thing worth answering plainly, because the honest answer is a qualified yes rather than a no, and since 29 October 2026 it is two yeses. Sentry, the crash reporter above, can keep the minute of screen activity in front of a crash, and it does so for some of them; it never records while nothing is wrong. PostHog, described just above, records an ordinary session inside the app to see where people get stuck, and that is the recorder of the other kind this policy used to say there was none of. Both are masked inside your browser before anything is sent: every letter is blocked out, and every photo, video and voice note with them, so a recording shows where things sat on the page and what moved, and none of what you wrote. The second one has a switch, Your account, then Counting, and the first one does not, because a crash report is how the service is kept working.
Your data leaves Brazil
It has to. The companies listed above run in data centres outside Brazil, mostly in the United States and the European Union, so operating Planye at all means an international transfer. The usage measurement goes to PostHog in the European Union, which the ANPD recognises as giving an adequate level of protection, so that transfer rests on LGPD article 33, I.
Where a provider has adopted the ANPD's standard contractual clauses, the transfer rests on them, which is the route LGPD article 33, II, b sets out. Where the transfer is needed to give you the service you signed up for, it also rests on article 33, IX. Where GDPR chapter V applies, transfers rest on the European Commission's standard contractual clauses. If you would like to know which provider sits in which region, or to see the clauses that apply, ask and we will tell you.
What is stored on your device
One cookie, and it is one you create yourself by choosing a language. No advertising cookie, no measurement cookie, and nothing here follows you to another company's website. Five things are stored, and three of them are ones the app cannot work without.
Your sign-in token, in local storage if you asked to stay signed in on this device and in session storage if you did not, in which case it is gone when the tab closes.
Your planner, in IndexedDB, one database per account, so two people sharing a laptop never see each other's pages.
Your dress: theme, pinned spine and view preferences, which also sync so a second device opens looking the same.
The fourth is the list of which features are switched on for you, kept in local storage rather than a cookie, beside the identifier and email address the question is asked with. It is there so a page opens the way it opened last time, instead of changing shape a moment after it draws. It holds no record of anything you did.
The fifth is the cookie, and it holds one word: the language you picked. It has to be a cookie rather than anything else because our server reads it before the page is built, which is what lets the page arrive already in your language instead of turning over after you have started reading. It is written when you choose, removed again when you have chosen nothing, and it lasts a year. Nobody outside Planye can read it.
The page counting is not on that list. On the website PostHog is set up to keep nothing on your device at all: no cookie, and no identifier that outlives the page you are on. That is why this site does not ask you to accept cookies. There is nothing to accept, and a banner shown in order to be dismissed is not a choice. Inside the app the count is made with the same list of switches the fourth item describes, and adds nothing to it.
The iPhone and Android apps keep the same list in the same places, with two differences worth naming. There is no language cookie, because an app reads the language from the device itself. And your sign-in token is kept a second time, in the app's own storage rather than the web page's, because iPhones treat a web page's storage as cache and may empty it whenever the phone needs the room, which would sign you out for no reason you could see. Only the sign-in token is copied there, only when you asked to stay signed in on that device, and signing out removes it. Pages are counted in the apps as they are inside the app on the web, with the address cut down to the tab it names, the few moments listed further up are counted there too, and the recording described there is made in the apps on the same terms; one switch stops all of it.
On Android and on iPhone, a home screen widget keeps its own small copy of what it draws: the habits on your week, and the first few entries on each of the next seven days, so that it can turn over to the next day at midnight without the app. It also keeps a token that can do one thing: ask our server whether the tasks on today's page are finished, about every half hour while the Today widget is on your home screen, so that a task you finished on another device shows as finished. The request carries the identifiers of those tasks and the answer says only whether each is finished and when that last changed, with none of your words in either direction. We keep a fingerprint of that token rather than the token, it stops working after 30 days, and it goes with your account. All of this is separate from everything above and it is there because a widget has to draw before the app has opened. It holds nothing else, nothing reads it back into your planner, and signing out empties it.
Clearing your browsing data clears all five. That signs you out and empties the local copy. It does not touch the server copy, which comes back the next time you sign in. In the apps the same is done by signing out, which empties the widget's copy with it, or by removing the app.
How long it is kept
Your planner is kept for as long as your account exists. We do not expire old weeks, thin out last year, or delete a journal page because it is large.
One thing here is worth being straight about. Deleting something in Planye does not erase the row at once: it marks the row deleted and keeps the marker. That is what carries the deletion to your other devices, and it is what makes the five-second undo possible. The content is no longer shown anywhere and no longer counts toward anything, but the marker sits in the database until the account is closed.
Close your account (the button is at the bottom of your account panel) and the whole of it goes, on this timetable.
| What | Gone within |
|---|---|
| Your planner, including deletion markers and every file in the media bucket | At once, when you close the account |
| Your sign-in record with Supabase, and your profile picture if you set one | At once, in the same act |
| If you signed in with Apple, the token Apple issued for it | At once, in the same act, after we tell Apple to end that sign-in |
| Encrypted backups holding any of it | 90 days, as they roll off |
| Request logs | 30 days, on a rolling basis |
| The access record (which account, which IP address, which hour) | Six months, as the Marco Civil da Internet requires, then deleted. It is handed over only on a court order, and it outlives a closed account for that reason and no other |
| Usage measurement | 30 days for a recording of the screen. Up to a year for the page counting and the moments counted inside the app, neither of which holds planner content to begin with |
| What our server records about the assistant's answers (which model, what it cost, how long it took, which actions it took) | 90 days, then deleted. The count of how many messages you sent each day, which is what the daily limit reads, 60 days. Neither holds a word of the conversation |
| Payment and invoice records | Kept as long as Brazilian tax law requires, currently five years, and for nothing else. They outlive a closed account for that reason and no other |
What you can ask us for
Under LGPD article 18 you may ask us to confirm whether we hold data about you, to show you it, to correct it, to anonymise, block or delete it, to hand it to you in a portable form, to tell you who we have shared it with, and to withdraw a consent you gave.
Under the GDPR and UK GDPR you additionally have the rights of access, rectification, erasure, restriction, portability and objection, and the right not to be subject to a purely automated decision. Planye makes no automated decisions about anyone.
Deletion you can do yourself, at the bottom of your account panel, and it takes effect as you press it. Everything else on those two lists goes to contact@planye.com from the address on the account, and we answer LGPD requests within 15 days and GDPR requests within 30. It costs nothing, unless a request is repeated so often that it stops being a request.
If California law reaches you: we do not sell or share personal information as the CCPA defines those words, we have never done so, and there is nothing here to opt out of.
If you think we have got this wrong, you can complain to the ANPD in Brazil, or to your own supervisory authority in the EEA or the UK. We would rather you wrote to us first, but you do not have to.
How it is protected
Everything travels over TLS. Every request to our server carries a token that is verified before a single row is read, and every table is keyed on your account id, so one account cannot address another's rows. Journal media is filed under your account id too, which means cross-account reach is not so much blocked as impossible to express. Your password never touches our server.
What we will not tell you is that this is perfect. No service can promise that, and Planye is a beta run by a small team. If a breach ever puts your data at risk we will tell you and the ANPD within three working days of learning of it, as Brazilian law requires, and any other authority we owe a report to within its own deadline, which under the GDPR is 72 hours.
Age
Planye is not built for children and is not offered to anyone under 13, or under 16 where local law sets that age for using a service like this one without a parent. If you believe a child has an account with us, write to contact@planye.com and we will remove it.
If this document changes
We will publish a new version, dated, with a note saying what changed. If a change materially affects what we hold or what we do with it, you get an email and a notice in the app at least 30 days before it takes effect, and for anything that needs your consent we will ask rather than assume.
A company added to the list of who holds what is published as a new version before it starts processing anything, with a note saying who and what for. If you object to a new one, write to contact@planye.com, and if we cannot resolve it you can close the account.
The company behind Planye
Planye is made and run by Riquetti Studio, CNPJ 41.011.161/0001-68, Rua Rodriguês do Prado, 150, Ermelinda, Belo Horizonte, MG, Brazil. Planye is the product; that company is the legal person these documents bind.