Who is responsible

The controller for PlanIT under the GDPR is Simon Williams, vibedsolutions, Neues Rottland 18, 29614 Soltau, Germany. Contact: @vibedsolutions on X.

PlanIT is hosted with xAI’s app platform. xAI processes technical data as a processor / platform provider under its own privacy policy. Their terms describe how they handle infrastructure data, logs, and abuse prevention.

What we collect

Account: email address or the identity Google / X share with us (name, public handle, and a unique id). Password hashes if you create an email account — we never store a raw password.

Email confirmation: when you create or change an email sign-in we send a link to that address and store whether it was confirmed. Links expire after 48 hours and are not used for marketing.

App data you enter: plans, times, notes, templates, goals, to-dos, friend invites, sharing choices, and language / theme.

Connectors (operator testing): the operator may attach a bot key from Admin. Work stays hidden. Suggested plans wait until they are kept or dismissed. We store a hash of the key, not the secret itself. Revoke the key to cut access.

Notifications (optional): if you turn them on, we store a push subscription for this device (endpoint and encryption keys from your browser) so we can send plan reminders, goal-day nudges, and a ping when a friend ticks a shared challenge. You can turn this off in Profile. iPhone and iPad only receive these after PlanIT is added to the Home Screen.

Technical: session cookies or a sign-in token so you stay logged in, plus basic device and security logs on the host.

Anonymous visit counts: we store a date, page path, country code when the host provides one (not your IP), and a referrer/source (for example google or direct). No user id. Used so the operator can see how many people open PlanIT.

Why we use it (GDPR legal bases)

Art. 6(1)(b) — to run your account and store the plans you asked us to keep.

Art. 6(1)(a) — optional reminders, push notifications, and sharing, which you can switch off.

Art. 6(1)(f) — security, abuse prevention, keeping the service stable, and anonymous visit counts (country and source). You may object to this processing.

We do not sell your data. We do not use your plans to train public models.

Where it is stored

On your device (local copy) and, when you are signed in, in the cloud database attached to this published app.

Hosting may involve processing outside the EU (including the United States) by xAI. Where required, that relies on appropriate safeguards such as Standard Contractual Clauses, as described in xAI’s privacy policy.

How long we keep plans

On the schedule we keep today, days still to come, and the last 7 days before today.

One-off plans that ended more than 7 days ago are deleted from this device and from our cloud. They cannot be recovered.

Repeating plans keep going even if they were first created in a period we later delete. Only the old days are removed. The series stays until it finishes or you delete it.

Goals, to-dos, templates, friends, and your account stay until you delete them or close the account.

How long

Account and cloud plans (except schedule days older than 7 days, as above) are kept while your account exists. Delete your account or ask us to erase it and we will remove personal data unless we must keep a record for legal claims or security.

If we close an account as operator we email the address on file to confirm that personal data has been deleted. That notice is not used for marketing.

Local copies remain on a device until you clear site data. Past schedule days are still removed after 7 days on that device.

Your rights

You have the right to access, correct, delete, restrict, and port your data, and to object to processing based on legitimate interests (GDPR Arts. 15–21).

You may withdraw consent at any time without affecting prior lawful processing.

You may lodge a complaint with a German data protection authority (your state commissioner, or the BfDI).

To exercise rights, write to @vibedsolutions on X from the account we should match.

On this device you can export or delete your local plans from Profile → Your data, and change cookie choices in Cookie settings.

Cookies and sign-in

Strictly necessary: a session cookie (and, in some previews, a token) so you can stay signed in and the app can load. These are required for the account and are always on.

Preferences (optional, consent): we remember light/dark mode, language, and “Remember me” on this device. You can accept, refuse, or change this at any time in Cookie settings. Refusal does not stop you using PlanIT.

We do not set analytics or advertising cookies. First-party visit counts (country and source only) are stored on our server without cookies. We do not sell or share personal information for cross-context advertising (CCPA / US state privacy laws). “Do not sell or share” is recorded as a preference and is the default.

Google Fonts may load from Google so type looks the same on every device. That can transfer your IP address to the United States. Details are in Google’s privacy policy. You can refuse optional storage; the typeface still displays from the page you already opened.

Consent is stored in a small record on your device (planit.consent.v1) so we know what you chose. Change or withdraw it from Cookie settings, the menu, or this page.

Children

PlanIT is not directed at children under 16. Do not create an account for a child without the holder of parental responsibility.

Changes

We will update this page if our processing changes. The date at the top is the latest version.