Plaan

Privacy policy

This is a pilot-stage draft. It hasn't been legally reviewed yet and may still change before a wider release.

Updated: 3 November 2026

1. Data controller

Janne Paananen, Lappeenranta, Finland. During the pilot stage the service is run by a private individual.

2. Contact

For any questions about this policy: email getplaan@proton.me.

3. What data is processed

Phone number (login only, never shown to other users), first name and optional surname and username, date of birth (private, never shown to others), optional profile photo.

Plans you create, related invitations and responses, groups and memberships, chat messages, your connections and connection requests, blocks, and your notification and privacy settings.

If a plan's organizer adds a guest who does not use Plaan, the guest's name, a note written by the organizer and the guest's response are stored. If the guest answers through an invite link shared by the organizer, they type their own name and answer on a web page. The page uses no cookies or analytics, and the guest's browser remembers the answer only on their own device so they can change it. The web hosting provider may process the visitor's IP address to deliver the page. The data is visible only to the organizer; everyone else only sees the total number of participants. A guest can delete their own answer on the same page. The data is also deleted when the organizer removes the guest, the plan or their account. A guest can ask for their data to be deleted from the organizer or from us (email getplaan@proton.me).

Your push-notification device token, if you turn notifications on. Your language choice. Your location only at the moment you use Discover's "near me" search — it is never stored.

A short-lived technical log (action and time, no content) used to prevent abuse such as mass messaging. The log is automatically deleted after two days.

4. What the data is used for

To provide the service: logging in, showing plans and chats to the right users, notifications. The legal basis is performance of the contract (terms of use).

Preventing abuse (e.g. rate limits) is based on our legitimate interest in keeping the service safe.

Optional features, such as being findable by phone number or push notifications, are based on the consent you give in settings.

5. Who the data is shared with

The following providers process data on our behalf (data processors):

  • Supabase: database, login and file storage. Hosted in the EU (Stockholm, eu-north-1).
  • Twilio: sends SMS verification codes, once enabled. Data may be transferred outside the EU; EU Commission-approved standard contractual clauses are used.
  • Expo: push notification relay service.
  • Google (Firebase Cloud Messaging): delivers push notifications to Android devices.
  • Cloudflare: hosts and delivers the website and the invite-link page. The service may process the visitor's IP address to deliver the page.

We don't sell your data and don't use third-party advertising or tracking.

6. Retention periods

Your profile and usage data is kept for as long as your account exists.

When you delete your account, it is permanently deleted. The structure of others' plans and chats stays, but you'll appear in them as "Deleted user" and your messages' sender information is removed.

After deletion, only a non-identifying hash of your phone number and your free-trial dates are kept, so the same number can't get a new free trial on a new account.

Unused push-notification tokens are deleted automatically. The technical abuse-prevention log is kept for two days, and unused invite codes for 60 days.

7. Security

At the database level, each user is only allowed to access data that belongs to them (row-level security). Data transfer is encrypted. Profile photos are stored privately and can only be viewed by users who are allowed to.

8. Your rights

You can download a copy of your data and permanently delete your account yourself under Settings → Account management.

You can correct your profile information yourself under Edit profile. You can contact us if you want to review, restrict or object to how your data is processed.

You have the right to lodge a complaint with the Data Protection Ombudsman if you believe your data protection rights have been violated.

9. Automated decision-making

We don't use profiling or automated decision-making.

10. Changes to this policy

This policy may be updated as the service develops. Significant changes will be announced in the app.