Subprocessors
Every company that holds a piece of your planner on our behalf, what each one holds, and why. This list is part of the Privacy Policy.
Who holds what
Each of these processes data only on our instructions, under a contract that says so. Adding one is a change to this document and is announced the same way any other change is.
| Who | What they hold |
|---|---|
| Supabase | Sign-in and the server copy of your planner, in a Postgres database. Also your profile picture, if you set one. That single file is the one thing Planye stores where a link to it can be opened by anyone who has the link, because it has to be drawable on every page without a delay. Nothing else you write is stored that way. |
| Render | The sync API your devices talk to. |
| Cloudflare R2 | The photos, video and voice notes on your journal pages. Each file is stored under your account id and reached only through a short-lived signed link. |
| Netlify | The website and the app itself. |
| Google Fonts | Planye loads its typefaces from Google, which means Google sees the IP address your browser asks from. Nothing else about you is sent. |
| Google Analytics | Which of our pages were opened, the referrer that sent you, your browser and device type, and an approximate country from your IP address. It is told before it starts that it may store nothing on your device, so it holds no identifier for you and cannot join one visit to the next. It is not in the iPhone or Android apps, which are built without it. Nothing from inside your planner, and never your email address. |
| PostHog | Which optional features are switched on for you, and a short list of moments inside the app. Your browser asks the feature question as your account: the random identifier it has in our database, and your email address, which is what lets us switch a feature on early for a few accounts named by email. That pair is the whole of PostHog's record of who you are, alongside which of our sites you are using: the live one or the one we test on, which is a fact about our setup rather than about you. The moments are the ones listed in the privacy policy: an account made, a sign-in, your first task, your first habit, a day the app was open, a ready-made starter line kept, a planner kept before there was an account and later moved onto one, a prompt we showed you and whether you opened it, and a trial that started or turned into a subscription. Each says only that it happened, and a switch in your account stops them being sent at all. It is never told which page you were on or anything you wrote. Session recording, click recording and page counting are all turned off in the code, and of everything else the library would send, nothing leaves your browser but those events and the note that says which account signed in, each with the page it happened on taken off before it goes. |
| Sentry | Crash reports, and only when something breaks. It is told what broke and where: the error itself, which version of Planye you were on, the address of the page, and the random identifier your account has in our database. Never your email address. For some crashes it also keeps the minute of screen activity in front of them, and that recording is masked inside your browser before it is sent: every letter is blocked out, and every photo, video and voice note with them. What arrives is the shape of a page, never a word of what is on it. Our own server reports its own errors to the same place. |
| Formspree | Messages you send through "Ask us" in Help: what you wrote, your reply address, and the page you were on. Nothing from inside your planner. |
| Resend | Only if you turn the weekly email on. It delivers that one email, so it handles your email address along with everything the email says: your week's headline if you wrote one, the titles of your priorities, the names of the habits you marked, how many tasks and how many calendar events each day of the week just gone held, and the titles of the first few things on the week starting, those from a connected calendar included. Nothing else from your planner reaches it. No journal page, cycle day, mood or budget line is ever in one of these emails. |
| Stripe | Payments for Planye+ bought on our website. Your card details, your billing address and whatever else the payment needs, all typed on Stripe's own page rather than ours. What comes back to us is whether the plan is running, in which currency, and until when. We never see a card number. |
| RevenueCat | Only if you subscribe inside the iPhone or Android app. Apple or Google takes the payment; RevenueCat is what tells us the subscription exists, so it is told the random identifier your account has in our database and receives from the store which plan you bought, when it renews and whether it is still running. It never sees a card number, your address or anything from your planner. |
| Google Calendar | Only if you connect one. We ask Google for the events in the calendars you picked, so they can be drawn on your week, and Google is told nothing about your planner in return. The permission is read-only: we cannot add, change or delete anything in your calendar. Disconnecting deletes our copy of the permission and revokes it at Google, so we can read nothing more. |
| Outlook Calendar | Only if you connect one. We ask Microsoft for the events in the calendars you picked, so they can be drawn on your week, and Microsoft is told nothing about your planner in return. The permission is read-only: we cannot add, change or delete anything in your calendar. Disconnecting deletes our copy of the permission, so we can read nothing more; Microsoft offers no way for us to revoke it on their side, so Planye stays listed in your Microsoft account's app permissions until you remove it there. |
Who is deliberately not on this list
Two of the companies above measure something, and neither of them sees what is on a page. One counts which pages get opened. The other answers which features are switched on for your account, and counts the handful of moments the privacy policy lists. Beyond those two there is no advertising network, no data broker, and nothing here is bought from anyone or sold to anyone. That is not an oversight, it is the whole reason the list is short enough to publish.
One of them is worth being plain about, because the company is known for something we do not use it for. PostHog can record a session, capture every click and count every page, and ours does none of that: all three are turned off in the code, and what it may send is a list written down in one file rather than whatever the library would send on its own. What is on that list is the sign-in note, carrying the identifier and email address above and which of our sites you are using, and the few moments the privacy policy names: an account made, a first task, a first habit, a day the app was open, a starter line kept, a planner kept before there was an account, a prompt we showed, a trial started or converted. Nothing on it carries the page it happened on. So what is left is a question about switches, an answer about switches, a name to switch one on early for, and a count of whether people who arrive stay.
Apple and Google are not on the list either, and for a different reason than the two above. Subscribe inside one of the apps and the store is the seller rather than a company holding something for us: it takes the payment, it keeps what a payment needs, and what it does with that is governed by its own policy rather than by ours. What reaches us is the line in the RevenueCat row, which is which plan you bought and whether it is still running. No card number comes back to us on that route either.
Screen recording is the other thing worth answering plainly, because the honest answer is a qualified yes rather than a no. Sentry, the crash reporter above, can keep the minute of screen activity in front of a crash, and it does so for some of them. It never records while nothing is wrong. What it keeps is masked inside your browser before it is sent: every letter is blocked out, and every photo, video and voice note with them, so the recording shows where things sat on the page and what moved, and none of what you wrote. There is no recorder here of the other kind, the sort that watches an ordinary session to see how people behave.
If this list changes
Adding a subprocessor is published here as a new version before it starts processing anything, with a note saying who and what for. If you object to a new one, write to contact@planye.com, and if we cannot resolve it you can close the account.
The company behind Planye
Planye is made and run by Riquetti Studio, CNPJ 41.011.161/0001-68, Rua Rodriguês do Prado, 150, Ermelinda, Belo Horizonte, MG, Brazil. Planye is the product; that company is the legal person these documents bind.