Privacy, explained

Your plan stays on your device.

This page says what that means in practice. The formal policy is on the privacy page; this is the plain version.

What stays on your device

Everything you enter: the date, the two addresses, the companies, your own tasks and every tick. The planner runs in your browser; nothing is posted to a server while you work.
The preview, the calendar file and the PDF. All three are built in your browser from your plan. The fonts for the PDF are two static files loaded from this site, like an image.
The plan file you save. It is a plain file on your computer or phone. We never see it.
The “remember on this device” copy, if you switch it on. It lives in your browser’s storage until you erase it.

What leaves your device

The payment. Stripe receives your email address, billing country and payment details, as it would in any online shop. It does not receive your plan. Your email is used to send you the unlock link or the download link.
The unlock check. When you open an unlock link, your browser sends the unlock code (a signed reference to your purchase) to our server, which answers “valid” or “not valid”. Nothing else is in that request.
A visit count. A small script counts page views on all our sites: the page path, the time and a non-reversible daily identifier. It sets no cookie, builds no profile and never sees form contents. It is the same counter we use on every site we run.
Ordinary hosting logs. Our host keeps short-lived server logs (IP address, time, page) for security.

How we check this

Before each release an automated test fills the planner with unique made-up entries, previews, exports the PDF and the calendar file and opens an unlock link, while recording every network request the page makes. The test fails if any of those entries appears in any request. It also fails if the planner code contains any network call other than the unlock check and the font files.

What you can do

Use a private device, not a shared or public computer, and leave “remember on this device” off on anything shared.
Keep the plan file with your other private documents.
On the last step of the planner, “Erase everything stored on this device” removes the plan, the remember setting and the unlock from that browser. Files you already downloaded are yours and stay where you put them.

What we cannot do

Recover a plan file you lost, read your plan, or reset a password: there is none. Support can only help with the site, the payment and the download or unlock link, and will never ask you to send your plan.

Formal details: privacy policy · legal notice.

Why is the plan file not encrypted?

Because an encrypted file needs a password, and a lost password would mean a lost plan with no way back. We chose no password on purpose. The file holds the same information as the printed plan; keep it the same way.

Does the calendar file send anything anywhere?

No. It is a plain text file built on your device. What happens next depends on the calendar app you open it in; a cloud calendar will store the events in that account, as it does with any event.

Does the unlock link contain my plan?

No. It contains a signed reference to your purchase and an expiry date, nothing else. Anyone with the link could unlock the exports on their device, so keep the email as you would a receipt.