Account and sign-in data
When you create an account, we receive a profile name, email and information from your chosen sign-in method. We store a local user ID, provider association, email verification status and optional profile-image URL. Existing password accounts store a password hash; Planapp never receives your Google or GitHub password. Verified social sign-in provides the Free plan and current learning paths. Account data identify the user and protect their workspace.
Google and GitHub
Google data are received only when you start sign-in or explicitly link an account. We request openid, email and profile. The Google subject identifier (sub) binds sign-in to the correct account; email and email_verified confirm the address and support secure linking; name and optional picture describe the profile. We do not request Gmail, Drive, Calendar, contacts or user files. GitHub uses read:user and user:email, without repository access. These data support authentication and account linking. Permissions follow the learning plan or explicit administrator role. Google data are not used to assess skills or for advertising.
Learning records
We store your chosen preferences, notes, bookmarks, quiz attempts, review schedules, reading positions and self-declared completion. They provide learning materials and continuity on your account. API access checks the user, workspace and material grant. Other learners do not receive your notes or history. The administrator sees basic account details and aggregated learning records: recent activity, materials read, declarations, quiz attempts and AI attempts. The statistics panel does not display note bodies or AI questions. Reading a lesson or passing a reference test does not certify a skill.
Optional AI requests
The tutor is optional. Only clicking the send button transmits your question, relevant lesson passages, a definition of the selected concept when applicable, and response language to the AI provider, currently OpenAI. Google/GitHub profile data, private notes, learning history and IDE files are not automatically attached. Data obtained from Google APIs are not used to train AI models. Do not enter secrets or sensitive data in a question. Answers are not automatically saved as notes. Usage counters enforce service limits. API response storage is disabled; this does not guarantee zero retention of provider security logs. OpenAI processing is described in its documentation and privacy policy.
Purposes and legal grounds
Account and learning data are necessary to provide the service you request, under GDPR Article 6(1)(b). Account protection, abuse limits and necessary maintenance rely on the administrator’s legitimate interests under Article 6(1)(f). Handling data-rights requests fulfils legal obligations under Article 6(1)(c). Optional transmission to AI requires your deliberate action; learning materials work without AI. Where consent is the applicable basis, you may withdraw it for future processing. Google data are not used for automated decisions with legal effects, advertising profiles or sale.
Recipients, location and access
The application and database are hosted on Hetzner infrastructure in Germany. Cloudflare proxies HTTPS traffic and processes technical connection metadata. Google and GitHub operate their authentication services; OpenAI receives the context of questions you choose to send. Authorized operators access data only as needed for support, protection, handling requests and maintenance. Google profiles are not shared with other learners, advertisers or the tutor as identity context. External providers may process data outside the EEA under their terms and applicable transfer mechanisms. Tailscale is used for infrastructure administration and is not required by learners.
Retention and deletion
Account, OAuth association and learning data remain until you delete supported items or an account-deletion request is fulfilled. Inactivity alone does not delete them. A session is valid for up to seven days and may be renewed by activity; expired session records are removed by daily cleanup after 30 days from expiry. Expired authentication verification records are removed after one day, and request counters after 30 days. These are technical records, not notes or learner results. Open contact requests remain until resolved; closed requests remain for 30 days plus the next daily cleanup. Hashed form-limit keys are removed after two days plus that cycle.
Cookies and local storage
Necessary cookies maintain sessions, language and theme. Theme preferences may be shared between the application domain and its public www subdomain; session cookies do not provide sign-in to the information site. Local storage keeps interface preferences such as term explanations and the reader panel. Preference cookies last up to one year; local storage remains until cleared in your browser. The application uses no advertising cookies or third-party behavioral analytics. Blocking necessary cookies prevents sign-in.
Your rights and contact
Use the contact form linked below to request access, correction, export, deletion or restriction, or to object where the right applies. An active sign-in session is not required. Provide a reply address and request type; do not send passwords, tokens or identity documents. The administrator verifies identity before disclosing data or deleting an account and responds within applicable legal deadlines. Entering another person’s email alone cannot automatically delete their account. You may complain to the relevant supervisory authority, including Poland’s President of UODO.
Revoking Google access and deleting an account
In your Google Account, open Security → Connections to third-party apps and services, select Planapp and revoke access. Revocation prevents future use of that authorization but does not automatically erase existing notes or the Planapp account. To delete stored data, submit a request through the form. Verification and deletion cover the Google association, tokens and sessions, and records linked to your account; in a shared workspace, the administrator considers other users’ records before deleting the workspace. Any minimum retained on a legal basis is excluded from current learning use and restricted to its stated purpose.
Security and backups
HTTPS protects traffic; sessions and permission checks protect accounts, and public password registration is disabled. OAuth access and refresh tokens are encrypted by the authentication library; an identity-confirmation ID token may be stored in the access-controlled database. We do not claim that all data and backups are encrypted by the application. Database backups have a 30-day recovery window; noncurrent backup-object versions have an additional 30-day retention cycle. Deleted active records can remain in restricted backups until rotation. Separate restore-check copies are operator-accessible and reviewed when the maintenance purpose ends. Backups are not used for routine account access; fulfilled deletion requests must be respected again after a restore.
Contact form
The form stores the supplied email, category, message, reference number, submission time and closure time. Only the operator can read requests in the private inbox; they are not published or used for marketing or AI. The email is used for the operator’s private reply. We send no automatic confirmation or newsletter. Spam controls include a honeypot and daily request limits. A network address is converted into an HMAC key rather than stored as a raw IP by the form. Submission is voluntary; the data are needed to handle the request.
Google policy and changes
Planapp follows the Google API Services User Data Policy, including Limited Use requirements. Google data support the stated sign-in and profile functions. They are not sold, shared with advertisers, used for direct marketing or used to train general-purpose models. Material changes in data use will be announced in the application, and additional consent will be obtained where required before a new purpose is applied. The date at the top identifies this version.
Data administrator
Abersite
Contact form — data access, export, correction or deletion
The form works without sign-in. Requests are private; a public administrator email is not needed to submit them.