privacy.

This policy describes what Plan (the "Service") collects and how it is used. It applies to anyone with an account and to anyone who submits Content through the Service.

what we store.

We store what you publish: the source, each revision, titles, visibility, expiry, and any assets you upload. We also keep account records, which hold an id, a name, limits, and membership. Access logs hold the request metadata a Worker writes.

how we use it.

We use the Content and account data you submit solely to operate, secure, and support the Service: storing and serving your plans, enforcing account limits, and troubleshooting problems you report. We do not use Content you submit to train machine learning or AI models, ours or a third party's, and we do not use it for any purpose beyond providing the Service to you.

No ads. We do not sell your data. We do not run trackers beyond Cloudflare's operational logs.

sign-in and credentials.

Sign-in and credentials are handled by our identity provider. You can change your name, password, passkeys, sessions, and API keys in Plan. We pass password changes through and do not store the password.

share links.

Share-token URLs show up in access logs. Treat them as sensitive. Anyone who has the URL can read the plan until the token expires or you revoke the plan's share links.

webhooks.

If you add a webhook, each event sends the plan's id, title, address, visibility, and project name to the URL you gave. It never sends the plan's content. We keep a record of each delivery, with the event, the plan id, and how your server answered, for 14 days.

abuse reports.

Anyone can report a plan from its page. A report stores the plan id, the reason you picked, the details you wrote, your email address if you gave one, and when you sent it. It also stores a keyed hash of your IP address and the date. We use that hash only to drop duplicate reports and to cap how many reports one address can send in a day, and the nightly cleanup deletes it after two days. We never store the address itself.

Only the people who run the Service read reports. The author of a reported plan does not see them and is not told who sent one. If we remove a plan, its author sees the reason we give in their account.

deletion and export.

Email us if you want your account and its Content deleted; we will do that, subject to the recycle window described in the Terms of Service. You may also request an export of your Content at any time, not only if the Service is discontinued.