Back to WhatPlan

Privacy Policy

Last updated: July 2026

End-to-End Encryption

WhatPlan uses AES-256-GCM encryption, performed entirely in your browser using the Web Crypto API. When you create or edit a document:

• A unique encryption key is generated on your device
• Your content is encrypted before being sent to our server
• The encryption key is stored in the URL fragment (the part after the #) which is never sent to the server
• Only people who have the full link can decrypt and read the document

What We Store

Our server stores only:

• Document ID — a short random identifier for each document
• Encrypted content — an opaque blob we cannot read or decrypt
• Timestamp — when the document was last updated

We do not store encryption keys, document titles, task names, photos in readable form, or any other plaintext plan content. Anonymous plans are created and shared purely by link — no account is required to create, edit, or share a plan.

Optional Accounts & Sign-in

WhatPlan works fully without an account. If you choose to create one — to save your plans and access them across devices — our server additionally stores:

• Your email address — used only to send one-time sign-in codes and any update notifications you turn on. We never sell it or share it for advertising.
• An encrypted list of your saved plans — an opaque blob we cannot read. It is encrypted on your device with a key derived from a PIN or passphrase that never leaves your device. The individual plan decryption keys stay inside your shared links, not in anything we can read.
• A sign-in session — a secure cookie so you stay signed in between visits.

To sign in, you enter your email and we send a six-digit code; there is no password. Sign-in codes and update emails are delivered through our email provider, Resend. You can permanently delete your account and everything tied to it at any time from More → Security → Delete my account.

Payments & Subscriptions

If you choose a paid subscription, web payments are processed by Stripe, iOS payments are processed by Apple, and RevenueCat helps us keep your subscription access in sync between platforms. WhatPlan does not receive or store your full card details.

We store an opaque billing identifier and limited subscription records such as the product, provider, status, renewal or expiry date, transaction environment and provider transaction references. These records are separate from your encrypted plan contents; no plan title, task, comment, photo, encryption key or document contents are sent to a payment provider.

Before account deletion, WhatPlan warns you about known active subscriptions and provides any available management route. Deletion does not cancel an Apple subscription. For a standard WhatPlan web subscription billed through Stripe, confirmed deletion stores a durable non-renewal request which our billing worker sends to Stripe; limited opaque billing records are retained afterwards to reconcile that request and prevent reuse of the provider-facing identity. Any subscription held through another provider must be managed with that provider.

Notifications

If you opt in, WhatPlan can let you know when a shared plan changes, by web push and/or email. To do this we store your notification preferences and, for push, an anonymous device endpoint provided by your browser. Notifications never contain your plaintext plan content, and you can turn them off at any time. (Web push is a browser / installed-web-app feature and is not available inside the WhatPlan iOS app.)

Local Storage

WhatPlan uses your browser's localStorage and on-device database to:

• Keep a backup of your most recent edits (so you don't lose work if your connection drops)
• Remember your recently visited documents for quick access
• Keep a read-only copy of plans you've opened or saved to your account — including their photos — so you can still read them when you're offline

This data stays on your device and is never sent to our server. Decryption keys are never written to this on-device storage.

Privacy-First Analytics

To know whether basic flows like saving and sharing are working at all (and to spot regressions quickly), WhatPlan uses Plausible Analytics. Plausible is cookie-less, does not use cross-site identifiers, anonymises IP addresses on the fly, and is GDPR/PECR/CCPA compliant by design.

What we collect:

• Anonymous page views (URL path, referrer, browser, device type, country)
• A small set of named product events: document created, save success or failure (with a coarse size bucket and duration), share-link copied, sign-in code requested, first sign-in completed, plan saved to account, push notifications enabled, photo uploaded (with a coarse size bucket), edit-conflict detected, PWA installed, and offline page load

What we never send:

• Document IDs, titles, task names, comments, photos, or any other plaintext content
• Encryption keys (they live only in the URL fragment, which browsers do not transmit)
• Email addresses, account IDs, or device identifiers
• Cookies or any persistent tracking identifier

Opt out: WhatPlan honours the browser Do Not Track setting and suppresses every analytics event when it is on. You can also opt out persistently on this device by opening your browser's developer console and running:

localStorage.setItem('whatplan.analytics.optout', '1')

To opt back in, run localStorage.removeItem('whatplan.analytics.optout') and reload.

Photos

Photos added to tasks are resized on your device for efficiency, then encrypted alongside the rest of your document content before being stored. We cannot view or access your photos.

Data Retention

Documents remain stored on our server until they are naturally cleared. Since we cannot read document content, we cannot identify or target specific documents for removal. If you lose the link (and its encryption key), the document becomes permanently unreadable.

Contact

If you have questions about this privacy policy, you can reach us through the WhatPlan project page.