Privacy Policy
Effective Date: October 27, 2026 (Version 1.0.0)
01Introduction and Scope
Welcome to Plandid ("Plandid," "we," "us," or "our"). Plandid is a personal, structured visual journal application designed to turn experiences into browsable, private archives.
- Plandid is built from the ground up on the principles of privacy by design, data minimization, and child safety by design. This Privacy Policy explains what personal data we collect, why we collect it, how it is processed and protected, and how you can exercise your statutory rights under applicable privacy laws, including:
- • India's Digital Personal Data Protection Act, 2023 (DPDP Act) and rules framed thereunder
- • The Children's Online Privacy Protection Act (COPPA) (US)
- • The General Data Protection Regulation (GDPR / UK GDPR)
- • The California Consumer Privacy Act (CCPA / CPRA)
- • Applicable App Store (Apple) and Google Play privacy requirements
02Eligibility & Age Restriction (13+)
Plandid is strictly a 13+ application.
- • Users under the age of 13 are strictly prohibited from registering, accessing, or maintaining an account.
- • We do not knowingly collect, process, or solicit personal data from children under 13.
- • If we obtain actual knowledge or have reason to believe that personal data of a user under 13 has been collected without statutory authorization, we will immediately restrict the account and permanently delete all associated data.
- • If you are a parent or guardian and discover that your child under 13 has created an account, please contact us immediately at contact@plandid.life with the subject line "Under-13 Account Deletion Request".
03Special Protections for Minor Users (Ages 13–17)
- Plandid recognizes the enhanced privacy obligations owed to teenagers (ages 13–17):
- • Audience-of-One Default: Plandid V1 is a personal journal. There are no public profiles, no stranger discovery, no follower counts, and no public activity feeds.
- • No Targeted Advertising: We do not serve targeted advertisements, behavioral advertising, or profiling of any user, especially minors.
- • No Commercial Data Exploitation: Minor data is never sold, licensed, or shared with third-party advertisers or data brokers.
- • Safety Defaults: Location data embedded in photos is never broadcast to strangers.
04Personal Data We Collect
We adhere to strict data minimization. We only collect data that is necessary for core app functionality:
- A. Data You Provide Directly:
- • Email Address — Authentication, password reset, account recovery, security notices.
- • Password (Hashed) — Authentication and session security (handled securely by Supabase Auth).
- • Display Name — Your self-chosen personal moniker inside the app.
- • Birthdate — Enforcing the 13+ age gate and calculating your zodiac sign. Never displayed to strangers.
- • Profile Photo & Bio — Optional identity customization for your personal journal.
- • Referral Source — Optional onboarding answer ("how did you hear about us?").
- B. Content You Create (User-Generated Content):
- • Photos — The photos you select to document a moment. Stored in private Cloudflare R2 buckets; accessed exclusively via short-lived presigned URLs.
- • Captions & Sticky Notes — Captions, dates, and sticker arrangements placed on your photos. Stored in Supabase Postgres under row-level security (RLS).
- • Boards & Moments — Titles, date ranges, and categories organizing your photos. Stored in Supabase Postgres under row-level security (RLS).
05Photo Metadata, Location Data & Cartography
When you import a photo into a moment, Plandid extracts the capture timestamp and geographical coordinates (latitude/longitude) stored in the photo's EXIF metadata.
Why: To order your photos chronologically and display your moment's path on an interactive map.
What We Do NOT Do: We NEVER collect live GPS tracking, background location, or real-time device telematics. If a photo contains no GPS metadata, Plandid displays a scrapbook view without map coordinates.
EXIF Handling: The upload pipeline re-encodes every image as a fresh JPEG, which strips the original EXIF metadata from the uploaded file. Coordinates are extracted client-side before upload and stored as structured database fields — the raw EXIF data is not retained in cloud storage.
Map Tile Delivery: Map vector tiles are rendered via MapLibre using open-source cartography from OpenFreeMap and OpenStreetMap contributors. Only the bounding map tiles necessary to display your private route are fetched over HTTPS; your personal journal data and photos are never sent to map tile servers.
06Application Diagnostics & Privacy-Preserving Telemetry (Sentry & PostHog)
We utilize industry-standard diagnostic and telemetry infrastructure under strict privacy controls:
- A. Crash Diagnostics (Sentry):
- • Purpose: Identifying application crashes, unhandled exceptions, and fatal runtime errors to maintain app stability.
- • Privacy Safeguards: sendDefaultPii is strictly disabled. Outgoing error payloads and breadcrumbs are filtered through multi-stage redaction regexes that strip presigned storage URLs, bearer tokens, Supabase JWTs, email addresses, and phone numbers.
- B. Product Telemetry & Usage Metrics (PostHog):
- • Purpose: Understanding aggregate feature adoption (e.g., onboarding completion, moment creation progression) to diagnose bottlenecks and improve application performance.
- • Strict Consent & Host Isolation: Telemetry is strictly optional and requires your explicit consent. Telemetry data is hosted on PostHog's European Union (EU) infrastructure.
- • Zero-Content Guarantee: PostHog NEVER receives personal journal photos, image binaries, moment titles, photo captions, location coordinates, or personal journal text.
- • Technical Safeguards: Autocapture, session recording, screen recording, and IP address tracking are completely disabled. All user properties are sanitized to strip names, emails, and sensitive identifiers.
- • Automated Deletion: When you delete your Plandid account, an automated backend process purges your associated telemetry identity in PostHog.
07What We Do NOT Collect
- To prevent ambiguity, Plandid explicitly DOES NOT collect or process:
- ❌ Phone numbers
- ❌ Address book or contact lists
- ❌ Live background location tracking
- ❌ Biometric identifiers or facial recognition geometry
- ❌ Microphone or audio recordings
- ❌ Third-party advertising identifiers (IDFA, GAID)
- ❌ Cross-site tracking cookies or behavioural trackers
08How Your Data Is Stored & Architecture
- • Relational Database (Supabase Postgres): Stores your profile metadata, board and moment structures, photo captions, and timestamps. Protected by Row-Level Security (RLS) ensuring that only your authenticated session (auth.uid() = user_id) can query or mutate your records.
- • Media Storage (Cloudflare R2): All photos are stored in encrypted, private Cloudflare R2 buckets. Media objects cannot be read publicly; every read requires a short-lived presigned URL (maximum 4 hours) authorized against your active database ownership.
- • No Direct Secret Exposure: All signing credentials and service-role secrets reside solely in protected backend Edge Functions and are never embedded in the client application.
09Third-Party Service Providers (Data Processors)
We engage trusted enterprise infrastructure vendors to provide hosting, database, telemetry, and reliability services:
| Processor | Role / Purpose | Data Processed | Transfer Safeguards & Location |
|---|---|---|---|
| Supabase Inc. | Managed authentication, relational database hosting, Edge Functions. | Email, profile data, journal metadata, timestamps. | Standard Contractual Clauses (SCCs), DPA |
| Cloudflare Inc. (R2) | Private encrypted object storage for journal photos and thumbnails. | Uploaded image binaries, assigned object keys. | SCCs, ISO 27001, SOC 2 Type II |
| PostHog Inc. | Privacy-preserving feature usage telemetry (opt-in only). | Aggregated feature interaction events, platform, app version (zero journal content). | EU Hosting, SCCs, zero-content logging |
| Functional Software (Sentry) | Application crash logging and error diagnostics. | Redacted error stack traces, OS version, device model (zero-PII scrubbing). | SCCs, SOC 2, HIPAA compliant |
| OpenFreeMap / OSM | Cartographic map tile delivery for visual moment journeys. | Transient IP address strictly for HTTP tile delivery caching (no user tracking). | Public map tiles, open-source cartography |
We do not sell, rent, trade, or monetize your personal data with any third party.
10Data Retention and Account Deletion
- Retention Schedule:
- • Active Accounts: We retain your journal data for as long as your account is active.
- • Deleted Media: When you delete a photo or moment, the database record is removed immediately and the corresponding R2 storage object is scheduled for deletion via our automated media deletion queue.
- • Database Backups: Automated point-in-time recovery logs and database snapshots are retained for rolling operational retention (maximum 30 days) before overwriting.
- Account Deletion (In-App & Public Web):
- Under Apple App Store Guideline 5.1.1(v) and Google Play User Data policies, users can delete their account at any time:
- • In-App: Open Settings → Delete Account. After confirmation, an authenticated Edge Function deletes all R2 media objects under your user prefix, purges your relational rows, cascades through your boards, moments, and photos, terminates your auth record, and queues telemetry purge.
- • Public Web URL: You can request account deletion online at https://www.plandid.life/delete-account. You must authenticate as the account owner before deletion proceeds.
- • Email: You may also request deletion by emailing contact@plandid.life.
11Your Statutory Privacy Rights
Depending on your country of residence, you have specific rights under applicable law (e.g., India DPDP Act §11–§14, GDPR Articles 15–22, CCPA §1798.100):
- • Right to Access & Data Portability: You can download a complete, machine-readable JSON archive of your personal data at any time via Settings → Privacy & Your Data → Download My Data.
- • Right to Correction / Rectification: You can update or correct your profile information directly within the app.
- • Right to Erasure / Deletion: You can delete individual photos, moments, boards, or your entire account at will.
- • Right to Withdraw Consent: Where processing is based on consent (such as optional telemetry), you may withdraw your consent at any time through app settings or written request.
- • Right to Nominate (India DPDP Act): You have the right to nominate an individual who will exercise your rights in the event of death or incapacity.
12Grievance Redressal Mechanism & Resident Officers
Pursuant to Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and Section 13 of the Digital Personal Data Protection Act, 2023, Plandid has designated a Grievance Officer:
- • Designation: Grievance Officer / Privacy Redressal Officer
- • Email: contact@plandid.life
- • Response Timeline: We acknowledge grievances within 24 hours and resolve complaints within 15 calendar days from receipt.
13Security Measures
- We implement multi-layered administrative, technical, and physical security measures:
- • Database Row-Level Security (RLS) on all user data.
- • Strict token-scoped Cloudflare R2 presigned URLs with short TTLs (maximum 4 hours for reads, 10 minutes for uploads).
- • Encryption in transit (TLS 1.3) and encryption at rest (AES-256).
- • Denial-of-service rate limiting on authentication and media signing endpoints.
- • Server-side upload limits: 1.5 MB per file, account storage ceiling (default 1.0 GB aggregate storage as configured in database limits), 60 presigned URL requests per minute.
14Updates to this Policy
We may update this Privacy Policy from time to time to reflect operational or legal updates. When changes are made, we will update the "Last Updated" date at the top and provide notice through the application.