Privacy Policy

1. What we process and why

• Accounts and connections: Google account identifier, verified email, profile name and picture URL when provided; account timestamps, device identifiers, device names, app versions, sessions and client authorizations. We use these to sign you in, secure your account and connect your devices and clients.
• Age and consent: age eligibility, country and privacy choices, and, where required, a parent’s contact details and verification or consent records. These help us apply age-appropriate safeguards and manage permissions.
• Task content: tasks remain on your device. For web editing and authorized MCP clients, our server processes and relays task data and commands in transit. We do not store your task tree in our server database or offer our own cloud task-storage service. The web editor holds tasks and unsaved changes in browser memory.
• Push messages: authorized MCP clients can send messages to your selected device through Google Firebase Cloud Messaging when push notifications are enabled for that device. Google receives the notification title, description, full message text, delivery identifiers and, when supplied, an image download link. Our server stores encrypted device delivery tokens; it does not store full message text or external image links in its database or application logs. Your device downloads external images directly from the supplied host, which receives your network address and applies its own privacy and retention rules. Images uploaded to PlanTree are stored separately as described below.
• Uploaded images: authorized MCP clients can upload images with a title and description to your private Files. We store the original image, its title, description, format, size and creation date with your account. Reading requires your signed-in browser or an authorized device belonging to your account; knowing the URL alone does not grant access. You can delete images in Files. Account storage limits apply.
• Purchases: Google Play and Apple process payments. We use subscription status and purchase-verification information to provide paid access. Google Play verification can store an encrypted purchase token and subscription metadata on our server. We do not receive your full payment-card details.
• Operations and support: request timing, status, security/error events and information you send to support help us operate, protect and troubleshoot PlanTree. Network addresses are processed to deliver and protect connections. Our configured server application and access logs exclude task payloads and authentication credentials.

Where GDPR applies, core service processing is based on performance of the service contract, security and troubleshooting on our legitimate interests in protecting and maintaining the service, and legally required processing on applicable legal obligations. Optional analytics and crash reporting are based on your separate choices. You can withdraw either consent in Settings → Privacy without losing core features. Accepting these terms or this policy is not a substitute for that consent.

2. Analytics and crash reports

Our Android and iOS apps use Google Analytics to understand app use and Firebase Crashlytics to diagnose crashes. These services process app interactions, app-instance or installation identifiers, device and operating-system information, and crash diagnostics as relevant to each service. Google Analytics can also derive approximate location from network information.

Analytics and crash reporting are disabled by default. Eligible users can enable them separately after reading what each service collects and why. You can refuse both and continue using PlanTree, or change either choice in Settings → Privacy. Withdrawal stops future collection and transmission; it does not itself erase information already sent. We do not enable these services for children or while age eligibility is unknown. PlanTree contains no advertising.

See Google’s Privacy Policy, how Google uses data from apps, and Firebase privacy information for provider processing details.

3. Hosting, backups and third parties

PlanTree’s primary application server is hosted by OVHcloud in France. Account, authorization and related service records are also stored in Kazakhstan to meet local data-storage requirements. The service relays remote task operations between your devices and authorized clients. Encrypted transport protects connections; the relay server can process the transmitted content.

If you enable Google Drive backup, your app saves task backups to your own Google Drive account. Those copies are governed by Google’s policies and your account settings. You control their retention and deletion separately from your PlanTree account.

When you authorize an AI assistant or another MCP client, data requested through its permitted tools is sent to that provider. Its own policy governs retention and further use. Revoking access does not erase copies it has already received.

Google provides sign-in, push delivery, analytics, crash reporting and optional Drive storage. Google Play and Apple provide store billing under their respective policies, including Apple’s Privacy Policy. These providers may process data outside Kazakhstan and your home country, including in the United States. Information may also be disclosed where legally required. Contact us about processing locations and applicable transfer arrangements.

4. Cookies and browser storage

The website uses cookies for sign-in, login security and client authorization. The configured browser session lasts up to 30 days and ends when you sign out. Blocking these cookies prevents connected features from working.

The landing-page demo stores sample-task completion choices in your browser’s local storage until you clear site data. The web editor does not save your real task tree in browser local storage. The mobile analytics described above does not add Google Analytics to this website.

5. Retention

Account and authorization records are kept while your account exists, without a fixed inactivity expiry, unless they expire, are revoked or are deleted earlier under the service’s cleanup rules. Confirmed account deletion removes the linked records from the live database. Task content is processed transiently for relay operations.

Uploaded images remain until you delete them in Files or delete your account. Signing out, a lower plan or a lower storage limit does not delete them. Server backups may retain uploaded images and their metadata for the normal 14-day retention. External image hosts control the availability and retention of external push images. Signing out or deleting your PlanTree account does not revoke those external links. Images stored by the previous version of our service retain their original 26-hour expiry and routine cleanup; removing their app session, device, push registration or account makes those legacy links unavailable. Server backups may retain encrypted delivery tokens and legacy images for their normal 14-day retention. Removing server records does not retract notifications or message copies already delivered to a device.

Existing server backups may temporarily retain deleted account records until their rotation removes them. Operational logs and support correspondence currently have no fixed automatic deletion period; deletion requests and applicable legal requirements are handled separately.

Google Analytics retention depends on the Analytics property settings and data category. Firebase states that Crashlytics retains crash reports and associated identifiers for 90 days before beginning deletion from live and backup systems. Deleting your PlanTree account does not automatically delete Google Analytics or Crashlytics records. App stores and connected providers apply their own retention rules.

6. Deletion and your rights

To delete your account, open Settings → Delete account and confirm. This permanently removes your profile, sign-in identity, sessions, registered devices, MCP authorizations and linked subscription records from the live server database, signs you out and closes your server connections.

This server action does not erase phone-local tasks, your Google Drive backups, previously shared AI-client data, separate analytics/crash records or existing server backups. Remove local data and Drive backups separately and use the relevant provider’s deletion controls for its copies. Cancel subscriptions separately in Google Play or Apple’s subscription settings.

Email support@plantree.app for access, correction or deletion requests, including if you cannot sign in. We may need to verify your identity. Depending on applicable law, you may also request portability, restriction or objection, withdraw consent where processing is based on it, and complain to your data protection authority. Requests are handled within the timeframe required by applicable law.

7. Children and updates

PlanTree supports age-appropriate use. Age eligibility is established before optional data collection or access to connected features. Analytics and crash reporting remain off for children and users whose age eligibility is unknown. Where required, verified parent or guardian consent is obtained before a child’s personal information is collected for online features. Connected third-party services remain subject to their own age requirements. A parent or guardian can review the child’s information, withdraw permission or request deletion by contacting support@plantree.app about a child’s information or a deletion request.

Policy updates will appear here with an effective date. Material changes will be communicated as required by applicable law.