Planeet Privacy Policy

Last updated: 31 October 2026

Leer en español

This policy explains what data of yours Planeet processes, what for, who sees it and what you can do about it. First comes the basic information and, below it, the full policy. Each section opens with an ‘In short’ to help you read it; it is only a guide: the full information is in the text of the section.

1. Who is the controller of your data?

In short: The owner of Planeet, Maximiliano Langer Barrios. For any questions about your data, privacy@planeet.app.

• Data controller: Maximiliano Langer Barrios, an individual, owner of Planeet.
• Contact: privacy@planeet.app.
• Data protection officer: none, because the law does not require one to be appointed in this case (article 37 of the GDPR and article 34 of Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights).

The controller is whoever decides what your data is used for and how, and is answerable for it to you and to the Spanish Data Protection Agency (AEPD).

2. What data we process

In short: We process what you put into Planeet, what other people add about you and technical data about your phone and how you use the app. We do not read your contacts or use your location in the background.

2.1 Your account

Your email, how you sign in (with a code we send you by email, with Apple or with Google) and the language of the app.

2.2 Your profile

Your name, your @username, your photo, your cover photo and your bio; whether your account is private; who can invite you and message you; and whether you use read receipts. Also your date of birth, which only you can see, and the version of the Terms of Use you accepted.

2.3 Which data is required

To have an account you need your email, your name, an @username and your date of birth, and to accept the Terms of Use: without them we cannot provide the service. Your photo, your cover photo and your bio are optional.

2.4 What you create in Planeet

Your plans and who is going to each one, invitations, messages (in plans, in groups and private ones) and their reactions, expenses, payments and splits, moments (photos and videos) and their comments, attachments, polls, tasks and their reminders, posts with their likes, saves and comments, groups, squads (your lists of people), who you follow, who follows you and who you block.

2.5 A plan’s location

Its name, its address, its coordinates and the identifier of the place. It comes from the place search, which uses Google, or from ‘Use my location’, which takes the position from the phone’s GPS and turns it into an address with the system’s service, which is Apple’s on iPhone and Google’s on Android, and which receives that position.

2.6 Your location and what you search for

If you have already allowed location access, when you open the place search the app reads where you are and sends that position to Google, unchanged, so that places near you, within a 5 km radius, come up first. Opening the search never asks for the permission. Your location is not stored. What you type when searching also goes to Google, and our server notes the first 20 characters in its logs together with your account’s identifier.

2.7 Your phone

If you allow notifications, we store the code through which your notifications reach you (the notification token), an identifier of the phone that only works for Planeet (the Android ID or, on iPhone, the IDFV), whether it is iOS or Android, its language and its time zone, the app version and the last time it was used. At most 10 phones per account.

2.8 What notifications say

Notifications are prepared by our server. They include names of people and of plans, up to 100 characters of the message and, in chat notifications, the photo of whoever is writing.

2.9 Photos, videos and documents

Photos are converted to WebP and videos to mp4, and in both cases the metadata is removed: the hidden data in the file, such as where it was taken, with which phone or when. Documents you attach to a plan are stored unchanged, with whatever they contain.

2.10 How you use the app

Which screens and features are used, without identifiers, amounts or text; the phone’s model and operating system, the app version, the language and the time zone; a random identifier that is not linked to your account; and your IP, which is used to work out your approximate country and city and is then discarded without being stored. We explain it in ‘13. Analytics and cookies’.

2.11 Errors and performance

When something goes wrong in the app, we receive a report (in Sentry) with the error, the phone’s model and operating system, the app version and the steps leading up to the error, without the data they carried. The reports also include your account’s internal identifier (a code, not your name or your email), which we can link to you. They do not include screen recordings.

Sentry also receives, on 1 in every 5 screen changes, how long the screen and its requests to the server take (the address of each request, without its parameters), and a count of the app’s usage sessions, to know how many end in an error.

2.12 Reports and blocks

If you report something, we store who is reporting, what or whom, the reason, the note you write (up to 500 characters), a copy of what was reported and what the team decides. If someone reports something of yours, the same is stored. Each block also leaves a record.

2.13 Technical logs

Your IP address and each request are kept in the logs of the server (Supabase) and of Cloudflare; and, while you have a session open on a phone, the IP you opened it from and which phone it was. And, to limit abuse, counters of how many times you search for places, post or delete photos and videos, start private chats, send message requests, share plans in a chat, invite and report.

2.14 What you write to us

The emails you send to support@planeet.app, privacy@planeet.app or report@planeet.app and our replies.

2.15 The website forms

To report content, your name, your email, the content you are reporting and whatever you explain to us; with the ‘Minors’ category, the name and the email are optional. If you give us your email, we send you an acknowledgement with the report’s reference. To ask us to delete your account, the email or the @username of the account. Turnstile, by Cloudflare, checks that you are not a robot. The forms go through our server (Supabase) and reach us by email, without being stored in the database. And, to limit abuse, we count the submissions from your connection on Cloudflare for an hour; the count is deleted an hour after the last submission.

2.16 The access list

While Planeet is in private testing, a list of the emails that can get in and of the attempts to get in with an email that is not on it.

2.17 What other people add about you

Other people also add data about you to Planeet: when they invite you to a plan or a group, add you to a group or to one of their squads, put you in an expense or a task, mention you in a comment, upload photos you appear in or report something of yours.

2.18 What comes from Apple and Google

If you sign in with Apple, Apple gives us your name and your email, which may be an Apple address that forwards to yours if you choose to hide it. If you sign in with Google, Google gives us your name, your email and your photo; the photo loads from Google’s servers.

2.19 What we do not process

Planeet does not read your phone’s contacts, does not use your location in the background and has no advertising or ad measurement system. The website does not set cookies or load analytics.

3. Phone permissions

In short: The app asks for permission for location, the camera, the microphone, the photo library and notifications. If you say no, you can still use Planeet, and you can remove any permission whenever you like in your phone’s settings.

Each permission is requested by the phone’s system with its own prompt. Location, the camera and the microphone are only used with the app open, never in the background.

• Location. For two things: setting where you are as a plan’s location, with ‘Use my location’, which passes that position to the system’s address service (Apple’s on iPhone and Google’s on Android), and, if you have already given that permission, sending your location to Google when you open the place search so that nearby places come up first. The permission is only requested when you tap ‘Use my location’: opening the search never asks for it. Your location is not stored: what is stored is the place you choose for the plan. Without that permission, you search for the place by its name or address, and the results are not sorted by distance.
• Camera. For taking photos and videos and adding them to a plan, and for taking your profile photo, your cover photo or a plan’s cover photo. If you say no, you choose photos from your library.
• Microphone. For recording the sound of the videos you make with Planeet’s camera. If you say no, you can take photos but not record videos.
• Photo library. Only for saving to your phone the photos and videos you download from a plan: the app asks for permission to add to the photo library, not to see it. To choose what you upload, the system picker opens, which needs no permission and only passes Planeet what you choose. If you say no, you cannot save what you download.
• Notifications. For letting you know on your phone about messages, invitations and what happens in your plans. If you say no, you do not get notifications on your phone, but you see the activity when you open the app.

To remove a permission, go to your phone’s settings, to the Planeet section. Removing it does not delete what you have already uploaded.

4. What we use it for

In short: We use your data to provide the service, keep it secure, moderate, measure how the app is used without linking it to your account, run the access list and reply to you. Each use has its legal basis, and here we tell you which.

The law (the General Data Protection Regulation, or GDPR, in its article 6) requires each use of your data to have a legal basis. Planeet uses four:

• Contract: what is needed to give you what you accept in the Terms of Use.
• Consent: your permission, which you can withdraw whenever you like.
• Legal obligation: what the law requires us to do.
• Legitimate interest: a reasonable aim of Planeet that you would expect from a service like this, such as keeping it secure, provided your rights do not outweigh it. You can object (see ‘10. Your rights’).

4.1 Providing the service

• What: your account, plans, chats, expenses, photos, posts and notifications within the app.
• With what data: your account and profile data, what you create in Planeet and the plans’ locations.
• Basis: the contract.
• How long: as long as you have the account.

4.2 Sorting places by distance

• With what data: your phone’s location.
• Basis: your consent, which you give with the system permission and withdraw in your phone’s settings.
• How long: it is not stored.

4.3 Notifications on your phone

• With what data: your phone’s data (the notification token and the rest listed in ‘2.7 Your phone’) and what each notification says.
• Basis: your consent, through the system’s notification permission.
• How long: the token, until you sign out on that phone, delete the account or Apple or Google treat it as expired; each notification, 7 days in the sending queue.

4.4 Security, preventing abuse and fixing errors

• With what data: the technical logs (your IP, your requests and what you search for), the IP and phone of your sessions, the abuse counters and the error and performance reports.
• Basis: legitimate interest: that Planeet works and is secure.
• How long: the logs, 7 days at most; the IP of each session, until you close it; error and performance reports, 30 days; the counters, as long as you have the account, and the one for the website forms, until an hour after the last submission.

4.5 Moderating

• What: reviewing reports, running an automatic word filter over what your followers see outside plans and groups, and suspending accounts that break the Terms of Use.
• With what data: reports, blocks and the text that goes through the filter.
• Basis: legal obligation (the EU Digital Services Act, articles 16 to 18) and legitimate interest: protecting the people who use Planeet.
• How long: the copy of what was reported and the note, 6 months after the report is resolved; the record of each block, 6 months; the rest of the report is kept.

4.6 Measuring how the app is used

• With what data: the data in ‘2.10 How you use the app’, without linking it to your account.
• Basis: legitimate interest, within the Spanish Data Protection Agency’s exemption for audience measurement, which allows it without asking for your consent.
• How long: 1 year.

4.7 Replying to you

• What: answering your emails and the website forms, and handling your rights.
• With what data: your email and what you write to us.
• Basis: legitimate interest and, when you exercise your rights, legal obligation.
• How long: the time it takes to deal with your request and, at most, 2 years.

4.8 Checking the minimum age

• With what data: your date of birth.
• Basis: legal obligation (article 7 of Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights).
• How long: as long as you have the account.

4.9 The access list

• What: checking, when you create the account, whether your email is on the list, and keeping the rejected attempts so that they can be approved.
• With what data: your email.
• Basis: legitimate interest: that, while Planeet is in testing, only those who are invited get in.
• How long: until Planeet comes out in the app stores, when the list is removed.

Planeet does not make automated decisions that have legal effects on you or affect you in a similar way. The word filter rejects a text when it is posted, but reports are always decided by a person on the team.

5. Who sees your data in Planeet

In short: Anyone with an account sees your profile. Anyone who has the link to your profile or to an invitation to a plan sees a card with the basics, even without an account. What is inside a plan, a group or a chat, whoever is in it. What you post, the audience you choose, and what someone else posts from your plan, theirs.

• Anyone with a Planeet account: your name, your @username, your photo, your cover photo and your bio. If your account is private, what you post and your plans are only seen by your followers. Nobody but you sees your date of birth.
• Anyone who has the link to your profile or to an invitation to a plan, even without an account: a card on the planeet.app website. The one for your profile shows your photo, your name, your @username and, if your account is not private, your bio; its link contains your @username, so anyone who knows it can open it. The one for an invitation shows the plan’s title, its cover photo, the name and @username of whoever created the link and the plan’s date and time, unless the organiser has hidden them; never the place, the description, who is going or how many are going. If someone sends one of these links on WhatsApp or another app, the message preview shows the same and stays in the chat as it was, even if your profile or the plan changes afterwards, or you delete your account.
• Whoever is with you in a plan, a group or a chat: what happens inside it (the messages, expenses, moments, attachments, polls and tasks). The photos and videos you add to a plan, your tasks, your links and the description and amount of your expenses can be chosen by anyone in the plan for a post of their own, which their audience will see. The post keeps a separate copy, which stays even if you delete your moment or your account, until its author deletes it or we remove it. If you do not want it to stay, ask them to remove it or report it.
• The audience you choose when you post. If you allow copying, other people turn your guide into a plan of their own. They take what you put in it (title, category, tips, tasks, links, the estimated budget and, if you showed it, the place), never the photos, who went, who paid, the exact date or the chats.
• The Planeet team: what it needs to moderate and give you support.
• The authorities: when the law requires it, for example if someone’s life is at risk.

Outside Planeet, your data is processed by the providers in the next section.

6. Providers

In short: Planeet works with these companies, which process data on our behalf. Google and Apple, when you sign in with them, decide for themselves, under their own policies.

A provider (in law, a ‘processor’) is a company that processes data on behalf of Planeet, for what the table says. These are all the ones we use:

When you sign in with your Google or Apple account, that data is processed by Google and Apple as controllers: they decide what for. Google also does so with what you type in the place search and with the emails you send us, which arrive in Gmail. This is explained in Google’s privacy policy and Apple’s privacy policy.

7. Data outside the European Union

In short: All the providers except Bunny.net process some data outside the European Union: in the US, in Singapore or on their worldwide networks. Here we tell you what leaves it and under which safeguard.

Planeet’s database is in the European Union, but data leaves it in these cases:

• To the US: the emails Resend sends and the notifications Expo delivers; in Sentry, access by its support to the error reports; PostHog’s data, which its contract allows it to process there; and access by Supabase’s support.
• To Singapore: access by Supabase’s support. The company we contract with, Supabase Pte. Ltd., is based in Singapore.
• Worldwide: Cloudflare serves the photos, the videos and the website through its worldwide network. Google, when searching for places, when turning your position into an address on Android, with the map and notifications on Android, when signing in with Google and in Gmail; and Apple, when signing in with Apple, when turning your position into an address on iPhone and with notifications and the map on iPhone.

The safeguards are these:

• The EU-US Data Privacy Framework: a decision of the European Commission recognising that US companies that sign up to it protect data to a level equivalent to that of the European Union. We rely on it with the certified providers.
• The European Commission’s standard contractual clauses (Decision 2021/914): a contract approved by the Commission that obliges the provider to protect data as in the European Union. They apply to all providers that process data outside the European Union; with those in the Framework, as a backup.
• Bunny.net needs neither: it is a European Union company and serves only from servers in the European Union.

The providers table shows this for each one. You can ask for a copy of these safeguards by writing to privacy@planeet.app.

8. How long we keep it

In short: What you create, as long as you have the account; technical logs, 7 days at most; errors, 30 days; and analytics, 1 year. Reports, notifications and emails have their own periods.

• Your account, your profile and what you create: as long as you have the account. When you delete it, it is deleted straight away, except what stays under ‘Deleted user’ (see ‘9. Deleting your account’).
• Copies of your photos and videos in other people’s posts: until their author deletes the post or we remove it.
• Plans and groups you delete: 30 days in the bin; if they have unsettled debts, up to 2 years.
• Messages: as long as the chat exists. If you delete a message, its text is emptied.
• Notifications: those waiting to be sent, 7 days; the activity in the app’s bell, 30 days.
• A phone’s notification token: until you sign out on it, delete the account or Apple or Google treat it as expired.
• Group invitations: they expire and are deleted after 30 days.
• Reports: the copy of what was reported and the note from whoever reported it are deleted 6 months after the report is resolved. The rest (who reported, what, the reason and the decision) is kept; if an account is deleted, it is no longer linked to it.
• The record of blocks for moderation: 6 months. The block itself lasts until you remove it.
• Abuse counters: as long as you have the account; the one for the website forms, until an hour after the last submission.
• Analytics: 1 year.
• Error and performance reports: 30 days.
• Server and Cloudflare logs, with your IP and what you search for: 7 days at most.
• The IP of each session and which phone it was: until you close it.
• The access list and the rejected attempts: until Planeet comes out in the app stores, when the list is removed.
• Emails you send us, including those from the website forms: the time it takes to deal with them and, at most, 2 years.

9. Deleting your account

In short: You can delete your account from the app whenever you like, and it is deleted straight away. What you shared that affects other people stays under ‘Deleted user’.

In the app, go to Settings → ‘Delete account’. It asks you to confirm it is you and the account is deleted straight away and permanently. If you delete it from your iPhone and confirm with Apple, we also ask Apple to withdraw the permission you gave Planeet; otherwise, you can withdraw it yourself in your Apple Account settings. If you cannot get into the app, ask for it with the website form or write to support@planeet.app from your account’s email. We write to your account’s email to confirm it and delete it when you reply from that address, within 72 hours as our target and no later than one month after you ask.

9.1 What is deleted

Your profile, who you follow and who follows you, your likes, your saves and your settings; your moments, your posts and your comments; your personal tasks; the invitation links you created; and your files: your photo, your profile’s cover photo, your moments and the photos and videos in your posts.

Copies of your photos and videos in other people’s posts are not deleted: they stay until their author deletes the post or we remove it (see ‘5. Who sees your data in Planeet’).

9.2 What stays, under ‘Deleted user’

• Your expenses and your payments. Outstanding balances with you stop counting: what people owed you, or what you owed them, disappears from the balances. Debts between the others do not change.
• Your messages in plan and group chats.
• Your private chats: the other person keeps the conversation.
• Your votes, which still count, and the polls you created.
• The tasks you shared.
• The attachments (files and links) you added to plans that still have other people in them.

9.3 Your plans and your groups

If there are other people, they pass to someone else: a plan, to the co-organiser or, if there is none, to the longest-standing participant; a group, to another member. A plan that carries on keeps its cover photo, even if you uploaded it. If there was nobody else, they go to the bin, like the ones you delete, and are deleted after 30 days or, if they have unsettled debts, up to 2 years later (see ‘8. How long we keep it’).

The reports you appeared in are no longer linked to your account. Server logs, error reports, analytics and the emails you sent us are deleted automatically within their periods (see ‘8. How long we keep it’).

10. Your rights

In short: You can ask to see, correct, delete or take your data with you, and object to a use or restrict it, by writing to privacy@planeet.app. We reply within one month at most.

• Access: knowing what data of yours we process and getting a copy.
• Rectification: correcting data that is wrong. You change your profile yourself in the app.
• Erasure: having us delete your data. To delete the whole account, see ‘9. Deleting your account’.
• Portability: getting the data you gave us in a format a computer can read, to take it to another service. We send it to you in a file by email.
• Objection: objecting to the uses based on legitimate interest.
• Restriction: asking us to stop using your data for a while, for example while we check whether it is correct.
• Withdrawing your consent: the location and notification permissions are removed in your phone’s settings. Withdrawing it does not change what was done before.

To exercise any of them, write to privacy@planeet.app from your account’s email, so that we know it is you. We reply within one month at most.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD), at www.aepd.es/en.

11. Minimum age

In short: To use Planeet you must be at least 14 years old.

To have a Planeet account you must be at least 14 years old. When you create the account we ask for your date of birth and, if you are under 14 years old, the account is deleted straight away.

12. Security

In short: Your data travels encrypted, each person can only access what they are allowed to and photos and videos are uploaded without metadata.

• Connections between the app, the website and our servers are encrypted.
• The database decides, row by row, what each person can see or change depending on who they are (what is technically called ‘row-level security’).
• Your session is stored encrypted on your phone.
• Photos and videos are uploaded without metadata: nothing about where they were taken, with which phone or when. Attached documents are not: they are stored unchanged.

13. Analytics and cookies

In short: The website does not set cookies or load analytics. The app measures what is used without linking it to your account, without profiles and without following you outside Planeet.

The planeet.app website does not set cookies or load analytics. Only the report and deletion forms load Turnstile, by Cloudflare, to check that you are not a robot; Turnstile does not use tracking cookies.

The app counts which screens and features are used, across about 160 event types (for example, ‘a plan has been created’), to know how much each feature is used. The events carry no identifiers, amounts or text. Along with them go the phone’s model and operating system, the app version, the language and the time zone.

Everything goes with a random identifier, which is renewed after 13 months and when you sign out. It is not linked to your account, it is not combined with anything and it cannot be used to follow you outside Planeet. PostHog also receives your IP: it uses it to work out your approximate country and city, and discards it without storing it. No personal profiles are created and the screen is not recorded. It is kept for 1 year, in PostHog.

14. Changes to this policy

In short: If something important changes, we let you know in the app or by email.

If we change something important in this policy, for example if we process a new piece of data or use it for something new, we let you know in the app or by email. The ‘Last updated’ date, at the top, says when it last changed.