Privacy Policy

Hushplan helps groups plan things together without anyone revealing what they can afford. Privacy is the product, so this policy explains exactly what we store, who can see it and when it is deleted.

Who is responsible

The controller of your personal data is Hushplan. You can reach us at privacy@hushplan.app.

What we store

• An account. You can use Hushplan as a guest without an email address (the account then lives on your device or in your browser), or sign in with Google, in which case we receive your Google account ID, email address and name from Google.
• The name you choose to show in plans.
• Plans you create or join and what happens in them: options and their prices, votes, reactions, proposed dates and answers to date polls, whether you are going, and an activity timeline of these events.
• Your private spending limit for each plan and your answers when an option is above your limit.
• If you turn on notifications: a notification token for each device or browser, the language notifications should use, your notification choices and a short-lived queue of notifications waiting to be delivered.
• Technical records needed for security, such as counters that limit how often an action can be repeated.
• How many guests you bring to a plan and whether the organiser has marked you as a guest of honour.
• If you add one, a private maximum next to your limit. Options above it are declined for you automatically, without a question.
• The time zone of the organiser’s device for each plan, so that reminders on the day arrive at the right local time.
• Groups you save of people you have planned with, direct invitations you send or receive, people you block, and reports you send about content or people.

Who can see what

• Members of a plan see its title, options, prices, votes, reactions, date poll answers, who is going, member names and whether each member has set a limit.
• Nobody else, including the organiser, can see your limit or your answers to quiet checks. They are only used to work out whether an option fits the group, and never appear in the activity timeline or in notifications.
• A rounded group figure is shown only once at least four members have set a limit.
• In a plan with two people, whether an option fits can reveal the other person’s answer. The app points this out.
• Members of a plan also see how many guests each member brings and who is a guest of honour. Your private maximum is as private as your limit.
• Only people you have shared a plan with can invite you directly, and you can turn this off in Settings. Your groups are visible only to you. People you block cannot join plans you organise or invite you, and they are not told.
• Reports go only to the Hushplan team. The group is never told who reported. A report includes a copy of the reported content, so it can be reviewed even if it is changed.

How long we keep it

• Private limits and answers are deleted 7 days after a plan is decided or cancelled, or 30 days after the plan date (90 days after creation for plans without a date).
• Delivered notifications are removed from the queue after 7 days, undelivered ones after 2 days.
• Guest accounts that are not part of any plan are deleted after 30 days.
• Everything else is kept until you delete your account or leave the plan.
• When you delete your account, your data is deleted. Plans you organised are handed to another member, or deleted if nobody else is in them.
• Direct invitations are deleted 30 days after they are answered, or when the plan is closed. Groups and blocks are kept until you remove them or delete your account.
• Reports are kept for 12 months, so that repeated abuse can be recognised.
• An encrypted backup of the database is made every day and kept for 30 days, so that data can be restored after an outage or a mistake. Data you delete disappears from the backups within those 30 days.

Service providers

• Supabase, which hosts our database and sign-in in the European Union (Frankfurt, Germany).
• Vercel, which serves this website.
• Google, if you choose to sign in with Google, and Firebase Cloud Messaging (Google) to deliver push notifications. Notification content contains the plan name and short text, never amounts.
• Geoapify, which answers place searches. It receives the search text and, if provided, the plan’s city location. Place data is from OpenStreetMap.
• Cloudflare Turnstile, which checks that sign-ins come from people rather than bots. It processes technical signals from your browser or device for that check only.
• GitHub (Microsoft), which stores those encrypted backups. Only we hold the key to open them.

Some of these providers may process data outside the European Economic Area. Where they do, transfers are covered by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

We do not sell personal data, show ads or use tracking or analytics cookies. The website stores your session in your browser’s local storage so that you stay signed in. If you choose a language, it is remembered in a cookie (hp_lang) for one year so that pages open in that language.

Legal basis

We process your data to provide the service you asked for (performance of a contract, Article 6(1)(b) GDPR) and to keep it secure, for example by limiting abuse (legitimate interests, Article 6(1)(f) GDPR). Push notifications are only sent after you allow them, and you can turn them off at any time.

We review reports, filter a short list of offensive words and remove content that breaks our terms to keep Hushplan safe and to meet our obligations for handling reported content (legitimate interests and legal obligations, Article 6(1)(f) and (c) GDPR).

Your rights

You can access, correct, export or delete your data, and object to or restrict its processing. In the app and on the website you can download a copy of your data (Settings, “Download my data”) and delete your account at any time, also on the account deletion page. For anything else, email privacy@hushplan.app. You also have the right to complain to your data protection authority.

Age

Hushplan is for people aged 16 and over.

Changes

If we change this policy in a way that matters, we will tell you in the app before the change takes effect.