Privacy Policy

planFlo is built with a privacy-first mindset. We collect only what's necessary to run the service, we don't sell your data, and we try to be transparent about everything we do with it.

Account information (if you register):

• Name and email address
• Password (hashed — we never store plaintext passwords)
• Plan type (Free, Pro, or Max)

Usage data:

• Cards, drafts, and calendar events you create
• AI chat messages you send (used to call the Claude API; not stored on our servers)
• Memory entries you create (stored and processed by AI for summarization, following the same data handling practices as Notes and Chat)
• App preferences (theme, layout settings)
• Google Calendar events (read and write, only if you connect Google Calendar — see Section 5 for details)

Technical data:

• IP address and browser type (for security and abuse prevention)
• Error logs (to diagnose and fix bugs)

For users without an account, all workspace data is stored exclusively in your browser's localStorage and never transmitted to our servers.

• To provide and improve the Service
• To authenticate your account and protect against unauthorized access
• To process payments (via Stripe — we never handle raw card numbers)
• To send transactional emails (e.g., billing receipts, password resets)
• To diagnose technical issues

We do not sell, rent, or share your personal data with third parties for advertising or marketing purposes.

When you use the AI chat assistant, your messages are sent to Anthropic's Claude API to generate a response. Anthropic's own privacy policy governs how they handle API data. planFlo does not store your AI prompts or responses on its own servers after the session ends.

planFlo uses only strictly necessary cookies and browser storage to run the Service. Specifically:

• Authentication cookies — set by Supabase to keep you signed in. These are essential and cannot be disabled without preventing login.
• Browser localStorage — stores your workspace data (cards, notes, preferences) on your device for offline access and faster loading. This data stays on your device and is only sent to our servers when you are signed in.

We do not use:

• Third-party tracking cookies
• Advertising or marketing pixels (Facebook, Google Ads, LinkedIn, etc.)
• Third-party analytics tools (Google Analytics, Mixpanel, Hotjar, etc.)

Because we only use strictly necessary cookies, no consent banner is required under GDPR or similar privacy laws. If we ever introduce non-essential tracking, we will update this policy and present a consent prompt.

• Anthropic (Claude API): Processes AI chat messages. Privacy policy →
• Stripe: Handles payment processing for Pro and Max subscriptions. Privacy policy →
• Supabase: Handles database storage and authentication. Privacy policy →
• Google Calendar API: If you choose to connect Google Calendar, planFlo will (a) read your calendar events to display them in your planFlo calendar view, and (b) write events to your primary Google Calendar — but only when you create, edit, or delete a planFlo card with a date (and only if the "Push cards to Google Calendar" setting is enabled). Events written by planFlo are tagged with "Synced from planFlo" in the description. We store an OAuth token securely on our server to maintain the connection. You can disconnect at any time from Calendar settings. Disconnecting does not remove events that planFlo previously wrote to your calendar — you can delete those manually in Google Calendar. Privacy policy →
• Vercel: Hosts the application. Privacy policy →

You have the right to:

• Access your personal data — email us and we'll send you a copy
• Correct inaccurate information via your account page
• Delete your account and all associated data (available in account settings)
• Export your workspace data (coming soon)

To exercise any of these rights, contact us at hello@planflo.ai.

We retain your account data for as long as your account is active. If you delete your account, your data is removed within 30 days. Anonymized, aggregated usage statistics may be retained indefinitely.

We use industry-standard security practices: HTTPS everywhere, hashed passwords, and API key management via environment variables. However, no system is perfectly secure — please use a strong, unique password.

planFlo is not intended for users under 13 years of age. We do not knowingly collect personal information from children under 13.

Privacy questions or concerns? Contact us at hello@planflo.ai.