Privacy Policy

Summary

Planily (“we”, “us”, “our”) provides a family planning app for iOS and Android. We collect the minimum personal data needed to operate the app (account and household data), use approximate location only for analytics, do not run ads, and do not do marketing. Our primary Firestore database is in the EU; some Firebase and Google services process data globally as described below. You can request access or export by emailing planilyapps@gmail.com, or permanently delete your account through our secure account-deletion page after signing in.

1. Who we are (Controller)

Controller / Company name: Planily
Registered address: Tveje-Merlose 3, 4300 Holbaek, Denmark
Privacy contact: planilyapps@gmail.com
Data Protection Officer (DPO): Johan Gyldenkaerne, planilyapps@gmail.com
Brands / Apps: Planily (iOS, Android)
Primary jurisdictions: EU/EEA and UK (GDPR-compliant). No CPRA/California-specific processing at this time.

2. Scope and services

This policy covers the Planily mobile applications for iOS and Android, the Planily website, and the web account-deletion flow (together, the “Service”). Core features include calendars and events, shared lists, calendar imports and exports, push notifications, app analytics, and crash reporting.

3. Data we collect

Account and profile data

• Name
• Email address
• Password (hashed and managed by our authentication provider)

Household / family structure

• Family/household name, members, and roles you define

App content you provide

• Events (titles, times, notes you add)
• Lists and list items (for example groceries and tasks)
• Calendar import source URLs and family export tokens used to connect calendars
• Feedback you send to Planily

Device and technical data

• Device and app information (device model, OS version, app version)
• IP address and general diagnostics/logs
• Push notification tokens
• Approximate location (only for analytics, not for live location features)

We do not collect

• Contacts/address book
• Precise location for live tracking
• Payment and billing data (no payments yet)
• Children's accounts or child profiles

4. Sources of data

• Directly from you when you create an account, set up a household, add events and lists, and use the app.
• Automatically from your device for security, analytics, crash reporting, and push notifications.
• From calendar feeds you choose to import into a family. Planily reads the feed at the source URL you provide so it can update shared events.

5. How and why we use your data (GDPR legal bases)

• Provide and operate the Service (create/manage accounts and households, sync content, send push notifications): Contract (Art. 6(1)(b)).
• Transactional communications (service updates, security, changes to terms): Legitimate interests (Art. 6(1)(f)) and/or Contract.
• Analytics and product improvement (including approximate location for aggregate insights) and crash reporting: Legitimate interests (Art. 6(1)(f)).
• Fraud prevention, security, compliance with law: Legitimate interests (Art. 6(1)(f)) and Legal obligation (Art. 6(1)(c)).

We do not send marketing communications and do not run third-party ads.

6. Push notifications and analytics choices

• Push notifications: opt-in via your device OS settings; you can turn notifications off at any time in device settings.
• Analytics/crash reporting: contact us if you want analytics limited for your account where feasible; you may also use OS privacy settings to limit certain identifiers.

7. Family groups and your sharing

Planily enables sharing within the family/household you choose to join. Events, event overrides, lists, list items, imports, and relevant shared history added to a family are family content. They are visible to other members according to the app's feature design and are not solely the private content of the person who created them. We do not provide parental controls. What you share in your family group is your responsibility. Leaving a family or deleting an account does not remove shared content needed by remaining family members. References to a departing account are removed or anonymized instead.

8. Children

The Service is not directed to children under 13. Do not use the Service if you are under 13. If you are 13 to 15, use requires the consent of a parent or legal guardian where required by local law.

9. Retention and deletion

We keep data only as long as needed for the purposes described above or as required by law.

Account and Data Deletion

You can permanently delete your account using the secure account-deletion page without access to the mobile app. You must sign in to the account, complete any required recent authentication, review the account-specific impact, and type the confirmation shown. An email address by itself is not proof of ownership for account deletion.

What deletion removes or anonymizes

• Your Firebase Authentication identity is deleted after the coordinated cleanup finishes.
• Your active Firestore profile is reduced to a minimal non-personal deletion marker containing the user identifier, deletion status, and deletion timestamp. Name, email, preferences, and other profile details are removed.
• Notification device records and feedback records linked directly to your user identifier are deleted.
• You are removed from every family and from event participants and list ownership. Creator, completer, invitation, and other personal references in retained shared data are removed or replaced with an anonymous deleted-account marker.
• You no longer receive family notifications or event reminders and no longer have family, invitation, import, or export-management authority.

Shared family content that remains

Events, event overrides, lists, list items, imports, and relevant shared history belong to the family and remain for other members. If you created a family, stewardship is transferred to a remaining administrator or member. Active calendar imports and exports for families with remaining members stay active so account deletion does not break their shared data or private-calendar subscriptions.

If a family has no remaining members, Planily currently retains the family and its shared content as an orphan. Its calendar imports are disabled and stripped of source URLs and sync validators, and its export bearer token is revoked. Planily does not currently run a periodic job to delete orphaned families.

External calendars

Planily cannot unsubscribe a private Google Calendar, Apple Calendar, Outlook, or other third-party calendar, and cannot remove events that the external provider has already downloaded or cached. If the deletion preview shows an active export, unsubscribe from Planily in each private calendar before deleting your account. A shared-family feed remains active while other family members remain; an orphaned family's feed is revoked, but previously downloaded events may still remain externally.

Data Retention Periods

• Account data: Kept while the account is active. If there is no activity for 24 months, we may contact you and then delete or anonymize your account after an additional grace period.
• Shared family content: Kept with the family as described above, including when a member leaves or deletes an account. The departing member's personal references are removed or anonymized.
• Firestore recovery data: Our Firestore database currently has seven-day point-in-time recovery. Deleted or changed records may remain in those protected prior versions until that recovery window expires. No scheduled Firestore backups are currently configured. If backup configuration changes, protected copies follow the configured retention and are used only for disaster recovery, security, or legal requirements.
• Authentication and provider recovery copies: The active Firebase Authentication account is deleted by the coordinated flow. Google states that associated Authentication data is removed from its live and backup systems within 180 days after deletion is initiated.
• Operational logs: Cloud Function and security logs follow the configured provider retention period and may temporarily contain a user identifier. Deletion code does not intentionally add names, email addresses, content titles, invitation codes, or calendar URLs to those logs.
• Analytics and crash reporting: Aggregate, non-identifying product metrics may remain. Planily does not delete historical Google Analytics data when an account is deleted. Analytics data follows the property's configured retention, and aggregated reports may remain. Firebase Crashlytics retains crash information and associated installation identifiers according to its provider retention schedule.
• Service providers and legal records: Providers may retain limited data for their documented backup, security, fraud-prevention, or legal periods. Planily may retain only information required by law or needed to establish, exercise, or defend legal claims, with access restricted to that purpose.

Deleting the Firebase identity does not currently revoke a Sign in with Apple provider token. Provider-specific Apple revocation is a separate release requirement and must not be represented as complete until it is implemented and verified.

Data Export: You can email planilyapps@gmail.com to request an export of your data. We will respond without undue delay.

10. Sharing of personal data

We do not sell your personal data. We share data only with service providers who act on our instructions:

• Hosting, authentication, database, and functions: Google Firebase and Google Cloud. The primary Firestore database is in the EU; Firebase Authentication operates from the United States, and other services may use global infrastructure.
• Push notifications: Firebase Cloud Messaging (FCM) and Apple Push Notification service (APNs)
• Analytics: Firebase Analytics
• Crash reporting: Firebase Crashlytics

Providers are bound by contracts to process data only on our behalf and to implement appropriate security. We may also disclose data if required by law, to defend our rights, prevent abuse, or respond to lawful requests.

11. International transfers

Our primary Firestore database is located in the EU. Some service providers, including Firebase Authentication, Analytics, Crashlytics, messaging, and hosting infrastructure, may process data outside the EEA/UK, including in the United States. Where required, we rely on lawful transfer mechanisms such as adequacy decisions, the EU Standard Contractual Clauses, and applicable provider data-processing terms.

12. Security

We implement appropriate technical and organizational measures, including:

• Encryption in transit (TLS) and at rest
• Role-based access and least-privilege controls
• MFA for administrator access, audit logging, and periodic access reviews
• Secure development and vulnerability management practices
• Resilient backups and disaster recovery procedures

No method of transmission or storage is 100% secure. If we become aware of a data breach affecting you, we will notify you and regulators as required by law.

13. Your rights (EEA/UK)

Subject to law, you have the right to request: access, rectification, erasure, restriction, objection (including to processing based on legitimate interests), and portability. You also have the right to withdraw consent where consent is our legal basis (we do not rely on consent for marketing). You can lodge a complaint with your local supervisory authority.

How to exercise your rights: email planilyapps@gmail.com. We may request information to verify your identity.

14. Cookies and website

The public website does not use non-essential analytics or advertising cookies. The account-deletion page uses Firebase Authentication browser storage that is strictly necessary to secure the signed-in deletion session. That session is limited to the browser session. If non-essential website analytics or cookies are introduced, we will request consent where required and update this policy.

15. Communications

We may send you essential service communications (for example security and changes to terms). We do not send marketing communications.

16. Changes to this policy

We may update this policy from time to time. We will post the new version in the app and update the effective date. Material changes will be communicated within the app or by email where appropriate. Your continued use of the Service after changes take effect constitutes acceptance.

17. Contact

Questions or requests about privacy and your data:

Email: planilyapps@gmail.com
Address: Tveje-Merlose 3, 4300 Holbaek, Denmark