Privacy Policy

Draft · last updated September 2026

Draft for legal review. This describes how PLANIT actually handles data today. It has not been reviewed by a lawyer and is not legal advice. Before offering PLANIT to the public or charging for it, have it reviewed, especially the sections on children and on the countries/states where users live.

What PLANIT is

PLANIT is a shared family planner: calendar, chores, meals, groceries, documents, notes and a simple allowance ledger, shared between the members of one family.

What we store

Account: your email address and a securely hashed password (handled by our sign-in provider, Supabase). We never see or store your password in readable form.
Family content you add: family and member names, calendar events (which can include places and notes), chores and points, meal plans, grocery items, notes, allowance entries, and documents (PDFs) you scan or upload.
On your device only: your light/dark choice, text size, calendar view, and (if you draw or type one) your signature image for Fill & Sign. These stay in your browser and are never uploaded unless you place the signature on a document.
Speaking to PLANIT: when you dictate into Quick add or Ask PLANIT, your browser turns the speech into text. On Chrome and Edge that means the audio goes to Google's speech service; on Safari, to Apple's. That is your browser's behaviour, not ours: PLANIT never receives, stores or sends any audio, only the text your browser hands back. If you would rather nothing was listened to at all, type instead, everything PLANIT can do by voice it can do by typing.
How PLANIT is used: so that we can tell which parts of PLANIT are worth keeping, PLANIT records that something happened, for example “a chore was ticked off”, “a document was scanned”, “a question was asked by voice, and took 1.8 seconds”. Each record holds the event's name, which part of the app it belongs to, whether it worked, whether you typed or spoke, a rough device type (phone, tablet or desktop), the app version, a per-tab marker that is discarded when the tab closes, and the time. See What is never recorded below.

Ask PLANIT, Add from a photo, and when your information leaves PLANIT

Most questions are answered on your own device and nothing leaves it. When PLANIT cannot answer a question itself, it sends a snapshot of your family's current information, together with your question, to Google's Gemini API so that the answer can be written. This is the one and only feature that sends your family's content to a third party, and it happens only at the moment you ask a question.

The snapshot can include: calendar entries with their times, places, driver and notes; chore names; the meal plan; the grocery list; notes; document names and categories; and, if a parent is asking, recent money entries with their description, amount, category, date and who they belong to. It does not include your documents' contents, your files, your signature, your password or your email address.

Nobody has to use it. If a parent leaves the AI key unset, Ask PLANIT answers only from what your own device can work out, and nothing is ever sent to Google.
Google's own terms govern what they do with it, including how long they keep it. We do not control that, and on free API tiers Google may use submitted content to improve their services. If that is not acceptable for your family, do not use Ask PLANIT for anything sensitive, or lock the events you would not want sent (🔒 keeps them out of a child's view, but not out of a parent's snapshot).
For children it is switched off by default. Ask PLANIT is a per-child setting (Family ▾ → tap a child → Leaving PLANIT), and it starts off. A parent has to turn it on deliberately. PLANIT asks its own database whether that child is permitted before it sends anything, so the setting holds however the app is opened. It is not simply a hidden button.
If it is switched on, the snapshot a child's question sends contains only what that child is allowed to see. Everything else a child does in PLANIT, calendar, chores, documents, notes, groceries, never leaves your own database whatever this setting says.

Add from a photo works the same way and carries the same warning. When you photograph a flyer or choose a screenshot, that picture is sent to Google to be read, along with today's date and your family members' first names so the dates and people can be worked out. The picture is not stored by PLANIT, it is read and discarded, and nothing is added to your calendar until you tick it and press the button. Whatever is in the frame goes: if a photograph has something on it you would not send, crop it first or type the event in by hand.

Both features share one setting. A child has neither until a parent switches it on (Family ▾ → tap a child → Leaving PLANIT), and PLANIT asks its own database before sending anything, so the setting holds however the app is opened.

Needs legal review before charging for PLANIT: sending family content to Google makes them a sub-processor. Commercial use in the EU/UK will need them named in a processor list and covered by the appropriate data-processing terms, and families told before they first use the feature.

What is never recorded about how you use PLANIT

The usage record holds no readable words. Every value the app may send is one of a fixed list: an event name, which part of PLANIT it belongs to, whether it worked, whether you typed or spoke, a rough device type, and the three values that are not from a list are handled by the database itself rather than trusted: the per-tab marker is replaced with a hash of itself, so even a value crafted to look like a sentence cannot be read back; the app version must be three short numbers, so it cannot be an amount or a date; and a duration is rounded to a tenth of a second, so it cannot carry an amount in cents. So the record does not contain:

what a calendar event, chore, meal, grocery item or note says
a document's name, its contents, any text read from it, or a signature
any amount of money, category or description from the money tracker
what you asked Ask PLANIT, what it answered, or what you typed or spoke into Quick add
any recording of your voice, or any transcript of it
passwords, sign-in tokens, your location, or an advertising identifier

The record belongs to your family and stays in your family's own database, under the same rules as everything else: only parents in your own family can read it, no other family can see it, and children cannot. Parents can view it (Family ▾ → “See what the family has built up”), download it as a spreadsheet, and clear the whole record at any time with one button. Records older than 400 days are cleared the next time a parent opens that panel, and each family's record is capped at 150,000 entries.

What we don't do

No advertising and no ad tracking.
No selling or sharing of your data with anyone for marketing.
No third-party analytics or tracking scripts of any kind. No Google Analytics, no advertising pixels, no session recording. The usage count described above is PLANIT's own, stays in your family's database, and is never sent to anyone else.
No profile of an individual child. Each record does note which family member did something, because otherwise “how many people used PLANIT this month” could not be counted. But PLANIT never shows a per-child breakdown, and removing someone from the family clears their name from the records while leaving the totals intact.

Who can see your family's information

Only signed-in members of your family. This is enforced by the database itself (row-level security), not just by the app. Documents marked Parents only are visible only to parents. Anyone you give your family's invite code to can join your family, so share it only with family; codes expire after 7 days and parents can cancel a code at any time.

Where data is kept

Data is stored with Supabase (database, sign-in and file storage) and the app is served by Netlify. Both are third-party service providers that process data on our behalf. Files are kept in private storage and opened through short-lived private links.

Children

PLANIT is designed to be set up by parents, who invite their children. Children's accounts can see the family's shared information and add a limited set of things (events, notes, grocery items, ticking off their own chores).

Needs legal review: if children under 13 create their own accounts, laws such as the U.S. Children's Online Privacy Protection Act (COPPA), and similar laws elsewhere (e.g. GDPR-K in the EU/UK), may require verifiable parental consent and specific notices. A lawyer should confirm what is required for how PLANIT is offered.

Keeping, exporting and deleting your data

Export: parents can download a full backup of the family's information (Family ▾ → Download a backup), download any document, and download the usage record as a spreadsheet.
Leave: Family ▾ → Leave family removes your access; your name and history stay with the family.
Delete: Family ▾ → Delete my account permanently deletes your login. If you're the last person in the family, the whole family and its documents are deleted too.
Deleted data may remain in our providers' backups for a limited period before it is overwritten.

Security

Connections are encrypted (HTTPS). Access rules are enforced by the database. No system is perfectly secure; please use a strong password and don't store information in PLANIT that you couldn't afford to have exposed.

Contact

Questions or deletion requests: [support email: to be added]

PLANIT · Built by Dhimy Jean