Privacy Policy

If you only browse: nothing that identifies you. Our hosting provider keeps standard server logs (such as IP address, browser type and the page requested) for security and troubleshooting, and we briefly use your IP address in memory to limit abuse (rate limiting).

If you create an account:

• Account: email address and password (stored only as a secure hash by our authentication provider).
• Profile you choose to add: display name, @handle, photo, short bio, home area, favorite topics.
• Activity: events you save ("Interested") and reminder settings; comments; events you share with friends, notes and replies; friends, friend requests and blocks; reports you make; your invite link.
• Settings: whether friends can see what you're interested in, and whether you get the weekly digest (both off by default).
• Plans and check-ins: plans you make or join with friends and your replies, check-ins (whether you went to an event), organizers and venues you follow, events you hide ("Not interested") and organizers you mute, events you suggest or post, event photos you upload, and organizer page claims.
• Notifications: if you turn them on, a push "subscription" for that device (a web address and keys issued by your browser's push service, or in the iPhone app a device push token issued by Apple). It doesn't include your name or location.

Event listings are collected automatically from public web pages and calendars (see where event data comes from). They describe events and venues, not you.

On your device we use a sign-in cookie (required to keep you signed in) and your browser's local/session storage to remember things like where you were in the event list and a pending invite. These never leave your device except as part of normal requests to Planit.

We don't collect or store your precise location. The distance filter asks your device for your location only when you tap a distance or the locate button; it is used on your device to filter events. If you then open For you, an approximate position (rounded to about 1 km) is sent with that one request so nearby events rank higher, together with a short summary of the topics you tend to like that is kept on your device. Neither is logged, stored or linked to your account.

Event listings are gathered automatically from public sources: venue and organizer websites, public calendars, and the public event feeds below. Our crawler only reads publicly available pages, respects robots.txt and links every listing back to its source. This data is about events and venues; it doesn't include information about you.

Venue locations: Map data © OpenStreetMap contributors (ODbL) — openstreetmap.org/copyright.

Event listings: Visit Maryland (Maryland Office of Tourism) — visitmaryland.org.

Event data: Ticketmaster — ticketmaster.com. Event data: SeatGeek — seatgeek.com. Ticket links open the seller's own site; Planit doesn't sell tickets and isn't paid for these links.

• To run the service: sign you in, show your profile, saved events, comments, friends and shares, and send the notifications you asked for.
• To keep Planit safe: rate limits, spam and abuse prevention, reviewing reports, and enforcing the Terms.
• To answer you when you contact us.

For people in places with laws like the GDPR: we process account data to provide the service you asked for (contract), and safety/security processing is based on our legitimate interest in keeping the community safe.

• Anyone (even signed out): your display name, @handle and photo, and your comments on events.
• Signed-in users: also your bio, home area and favorite topics.
• Friends only: events you share with them, notes and replies, and — only if you turn it on — which events you're interested in.
• People you block, and people who block you, can't see each other's profiles, comments or activity in the app.
• The site owner can see reports and reported content to moderate it.

We use a small number of providers to run Planit. They process data only on our behalf:

• Hosting (Vercel) — serves the website and app.
• Database, sign-in and photo storage (Supabase) — stores account data and sends sign-in and password-reset emails.
• Push services run by your browser or phone maker (Apple, Google, Mozilla) — deliver notifications you turned on.

We don't sell personal information, and we don't share it with anyone for advertising. We may disclose information if the law requires it or to protect people from harm.

Delete your account any time in Account → Settings → Delete account. It takes effect immediately:

• Removed: your profile details (name, photo, bio, area, topics), saved events and reminders, notification subscriptions, friends and friend requests, blocks you made, your invite link and read markers. Your @handle is released (held for 14 days so nobody can immediately impersonate you).
• Erased but kept as placeholders: your comments and replies are marked deleted and their text is replaced with "[deleted]", so conversations still make sense. Events you shared or were shared with you lose any note; the other person sees "Deleted user".
• Kept for safety: reports made by or about your account (who reported whom, and why) so we can deal with abuse.
• Sign-in record: your email address and password are wiped from our sign-in system and all your sign-in sessions are revoked. A device that already has the app open can stay signed in until its current access token expires (up to about an hour); after that it can't renew and is signed out. An anonymous internal record (a random ID, no email) remains so the placeholders above stay consistent. If our sign-in provider ever blocks the automatic wipe, your password is replaced with a random one immediately and we finish removing the email by hand within 30 days.

Backups kept by our providers roll off on their normal schedule (typically within 30 days). You can also email support@planitsocialapp.com to ask us to delete your data.

You can see and change most of your data in the app. You can also ask us to give you a copy of your data, correct it, or delete it by emailing support@planitsocialapp.com. We'll respond within 30 days (usually much sooner) and won't treat you differently for asking.

California residents: you have the right to know what personal information we collect and how we use it (this page), to access, correct and delete it, and to opt out of "sale" or "sharing" — we don't sell or share personal information, so there's nothing to opt out of. We don't use sensitive personal information to infer things about you.

If you're in the UK/EU/EEA: you can also object to processing, restrict it, and complain to your local data protection authority.

Planit isn't for children under 13, and we don't knowingly collect their personal information. If you believe a child under 13 has made an account, email support@planitsocialapp.com and we'll delete it.

Data is sent over HTTPS, passwords are hashed, and database access is locked down so each person can only reach what they're allowed to. No system is perfectly secure, so please use a unique password. We keep account data while your account exists and delete it as described above when you delete your account.

When you change your password or delete your account, your other sessions are revoked right away, but a device that is already signed in may keep working until its current access token expires (up to about an hour).

Our sign-in provider (Supabase) keeps its own security logs of sign-in activity, such as sign-ins, sign-outs and password changes, which can include your IP address. Those logs are kept for the period set by Supabase's own retention policy; we don't control that exact period.

If we make significant changes to this policy we'll let you know in the app. Questions or requests: support@planitsocialapp.com.