1. Scope of this notice
This notice covers the public Planofam website and the invitation-only Planofam mobile app. Mobile access is provided through an approved testing channel while the product is evaluated. The website is a public marketing and application site: it has no household dashboard or sign-in. Selected adults may create mobile accounts only after receiving an invitation.
2. Who is responsible
The Planofam project operator is responsible for the information described here. Privacy enquiries can be sent through the contact form by choosing “Privacy or data request”.
3. Website information
- Beta applications: email address, privacy consent version and time, plus any optional first name, country, household-size band, broad coordination challenge, beta interest, and referral source.
- Contact messages: name, email address, category, message, status, and submission time.
- Abuse protection: form name, a short abuse reason such as honeypot or oversized request, and time. The abuse record does not contain the submitted message.
- Necessary hosting data: infrastructure providers may process technical request data needed to deliver and secure the website.
4. Mobile-app information
- Adult account and security data: email, verification and recovery state, secure session identifiers, display name, locale, timezone, and security events.
- Household data: household name, adult roles and memberships, invitations, and a minimal managed-child alias or avatar chosen by an authorised adult. A managed child does not need an email address.
- Coordination content: calendar entries, tasks, routines, lists and items, their audience, responsibility, recurrence, completion history, and related timestamps.
- Optional planning content when included in a particular app build: recipes, meal plans, special days, and household contacts.
- Device and reliability data: installation identifier, platform, app version, permission state, sync status, generic error codes, and—only after remote delivery is enabled—an encrypted push token.
- Audit and rights records: content-minimised security actions, invitation or membership changes, and export or deletion request status.
5. Information not collected by the core beta
The core beta does not request bank connections, receipt images, medical records, identity documents, advertising profiles, precise location history, or a child’s school, exact age, biometrics, personal email, or phone number. Documents, budgeting, location, AI extraction, co-parenting, and caregiver access remain unavailable unless a later notice and feature-specific safety review say otherwise.
6. Why we use information
- To review access applications and provide the invitation-only service.
- To authenticate adults, enforce household roles and item audiences, sync authorised changes, and recover accounts.
- To show the calendar, responsibilities, lists, and relevant notifications to the right household member.
- To protect accounts, prevent abuse, investigate content-free reliability or security signals, and honour privacy requests.
- To answer enquiries and improve the product using product events that exclude private household content.
7. Choices and lawful handling
Website beta applications use active consent and optional questions may be left blank. Mobile processing is limited to what is necessary to provide and secure the beta, choices you make in the app, and legal obligations that may apply. In builds where device-calendar or phone-notification access is explicitly enabled, those permissions are optional and requested by the operating system only after an adult action. You may withdraw a website application or request access, correction, export, or deletion.
8. Household visibility and private items
Current household membership is checked by the service before protected reads and changes. Household items are visible to the audience selected in the app. “Private to me” items are not available to another adult merely because that person is a household owner or administrator. Removed members and revoked devices should lose access; any failure of that boundary is treated as a security incident.
9. Device calendars and notifications
External calendar access is optional and read-only where it is enabled. An adult controls which calendar is selected, and imported event details are not turned into household records without a separate action. Calendar write access is not part of the current service. In-app alerts use generic recipient-only messages. Remote push is enabled only after encrypted registration, provider credentials, receipts, revocation, and physical-device checks pass; lock-screen wording stays generic.
10. Sharing and service providers
Authorised Planofam operators use the least access needed for support, security, and rights requests. Cloudflare provides website and edge services. The mobile beta is designed to use Supabase for authentication and authorised database services and Expo, Apple, and Google for app distribution and optional notification delivery. Providers process information only to deliver and secure their services under their own contractual and legal safeguards. We do not sell household data or use it for targeted advertising.
11. Retention and deletion
- Website applications are kept for up to 12 months after recruitment closes, unless an application becomes part of a later programme under a new notice or deletion is requested sooner.
- Contact messages are kept for up to 12 months after resolution and content-free form-abuse events for up to 90 days, subject to a narrow active abuse or legal hold.
- Mobile account and household content is kept while the account or household is active and then deleted or minimised through the verified deletion process, subject to another member’s rights, narrow legal or security records, and backup aging.
- We review retention schedules, hold handling, restore suppression, and deletion procedures as the service evolves.
12. Security and international processing
Controls include encrypted transport, encrypted device storage, server-side membership checks, tenant identifiers, row-level database rules, restricted credentials, validation, and content-minimised logs. No internet service can promise absolute security. Providers may process data in other countries subject to applicable safeguards.
13. Your privacy rights and deletion path
Depending on where you live, you may have rights to access, correct, export, delete, restrict, or object to certain processing and to withdraw consent. Where a particular mobile build exposes a protected Settings request, a signed-in adult may start there. Anyone may use the contact form with the email connected to the record. We verify requests without asking for passwords, child PINs, recovery links, identity documents, or private household content. See the delete-account page for the current supported path.
14. Children
The website and adult account flows are for adults. Children should not submit public forms or create adult accounts. An authorised adult may create a minimal managed-child profile, with adult-session isolation and appropriate safety controls. Child data is not used for advertising, profiling, or model training.
15. Analytics and support limits
Analytics and diagnostics must not contain event titles, task text, list contents, child names, invitations, contact details, calendar content, documents, finances, precise location, PINs, tokens, notification text, or search queries. Do not send these through the public contact form or a support request.
16. Changes and contact
We will update the date and wording when the app scope, provider set, or legal basis changes. Material changes will be presented to mobile users before they continue. For questions or requests, use the contact page and select “Privacy or data request”.