Privacy & your data

Planning without an account

When you open the plan creator, we create a temporary identity and an essential first-party session cookie. Your unfinished plan, optional name and place, and possible times are saved privately on our server. Unfinished drafts expire after 30 days without changes and are removed by scheduled maintenance; interruptions can delay cleanup. Completed plans and photos follow the retention rules below.

Returning in the same browser can restore your draft and plans. Clearing cookies or losing your session can remove your access; it does not delete server records. Signing in is optional for this planning flow. Contact support from Settings for help with your data. Known campaign labels from the link that brought you here can be associated with your draft and plan to understand which campaigns lead to plans and replies. These records do not include location history or advertising profiles.

After sharing a plan, you can save it with Google. If you already have an account, we ask before moving this browser’s plans, replies, messages and photos to it. Existing account answers and privacy restrictions take priority when they overlap. Shared invitation links keep working. This does not subscribe you to marketing or reminder emails. The temporary transfer cookie expires after one day and is removed after a successful transfer.

What you share

We store your display name, and your email when you verify an account. We also store the groups and ideas you create, plan details, time-zone choices, availability replies, attendance, membership requests, hosting offers and history, and messages you send in plan conversations. If you add them, we store event photos and your personal decision to save a completed event as a memory. We record your confirmation that you are 18 or older, the terms version you accepted, and the acceptance date until you delete your account. We do not collect a birth date or identity document for this confirmation. Guests receive a temporary identity so they can return to their replies.

Information comes from you, your Google account if you use Google sign-in, other participants who include you in shared plans, and technical records generated when you use the service. Support emails contain your address and whatever you choose to send us. Our hosting providers also process connection information such as IP addresses and browser details for delivery and security.

Who can see it

Authorized service administrators can view account names, email addresses, registration and last sign-in times, and summaries of recorded usage actions to operate and improve OurNextPlan. Access is restricted to specifically authorized accounts.

To improve our activity picture library, administrators can also review titles of plans created in the last 90 days that have no matching picture, together with counts and creation dates. This report does not include descriptions, locations or guest lists, and does not keep a separate copy after a plan is deleted. Picture selection uses a prepared library; your plan content is not sent to an AI image service.

Group members can see their group’s wishlist and active plans. Event photos are visible only to the plan host and people who have replied to that plan through their authorized account. An invitation can open its proposal during the active planning period, but it does not grant access to the private group board, event photos, or the plan conversation. Display names are self-reported. Share invitations and meeting details only with people you intend to include.

Plan conversations

Messages are visible to the plan’s group members and guests who have replied and still have access. Opening an invitation alone does not reveal the conversation. Messages show your display name and sending time. You can remove your own messages; the current host can remove messages from the plan’s conversation.

Removing a message clears its text and leaves a “Message removed” marker. Messages are deleted when their plan or group is deleted, or when the author deletes their account. They are not part of the usage analytics or artwork report. No email or push notification is sent for chat messages.

How the service uses it

We use this information to sign you in, save and display your plans, coordinate replies and hosting turns, and protect the service from abuse. First-party events record actions such as creating a plan, replying, confirming, and exporting a calendar file to understand whether groups use the product. A link copy or calendar download does not prove that a message was delivered or an activity happened.

If you choose “Email me about OurNextPlan product updates”, we store that separate marketing preference and its timestamp. We use the address only for OurNextPlan product news and new-feature updates; you can turn it off in Settings at any time. Accepting the Terms of use or signing in does not subscribe you.

The current app does not include advertising pixels or cross-site advertising trackers. We do not sell participant data or share it for cross-context behavioral advertising. Browser tracking preferences do not disable the session information required to use your account.

We record a first-party visit marker for signed-in sessions once per browser tab and UTC day to understand daily visitors and return rates. It does not store an IP address, email address or page content. The administration report shows aggregate counts; it does not turn visit records into a marketing list. Contact us if you want to object to this processing.

In production, Vercel Web Analytics provides an additional aggregate view of page traffic and performance. It is separate from the first-party usage report. Query strings and identifiers from plans, groups and invitations are removed before an event is sent, and administration pages are excluded. No custom analytics event contains account, email, message or plan content.

Why we may process your data

Pb Duck Oy is the controller responsible for this processing. We use account information, plans and replies to provide the service you request under our Terms of use. Required account information is needed to create and maintain an account; a guest can reply without providing an email address.

Our legitimate interests are keeping the service secure, resolving support issues and understanding whether people successfully make and repeat plans. Limited first-party usage records support that last purpose; they are not used to target ads or score individuals. You can object to processing based on legitimate interests by contacting us. We also process information where necessary to meet an applicable legal obligation, such as responding to a data protection request. Agreeing to our terms is not consent to advertising or a marketing mailing list.

Service providers and storage

Supabase provides authentication and database hosting. Vercel serves the app. Google’s email service currently delivers sign-in codes. These providers process the information needed to operate the service, including technical request and delivery information. The current database is hosted in Stockholm; other provider processing can take place in other countries.

If you choose Google sign-in, Google shares your account identifier, email address and basic profile information with our authentication provider, Supabase, to sign you in or link your account. We do not request access to your Gmail messages, contacts or Google Calendar. You choose the display name your friends see in OurNextPlan.

Essential cookies keep you signed in for future visits on this browser by default. In Settings, you can turn off “Keep me signed in on this device” to use session cookies. Clearing cookies, browser limits or session revocation can end a sign-in earlier. Browsers that restore sessions may retain session cookies, so always sign out on a shared device. This browser tab can retain an unfinished draft, request identifiers, and an invitation you created. Signing out clears this app’s drafts and saved invitation links from the current browser tab. Private plans are not cached for offline use. Calendar files you download are separate copies controlled by you and your calendar provider.

How long information stays

After a confirmed event ends, the host and each participant who replied can independently save it as a personal memory. Saving an event for yourself does not save it for anyone else. Participants who do not save it lose access to the event and its photos 14 days after it ends. If nobody saves it, hourly maintenance deletes the event, its conversation and its photo files after that 14-day period. A saved memory remains available to the participant who saved it until it is removed through the relevant account or group controls. Signing out does not delete saved memories.

A saved memory may be shown on your home page once a week. We keep your recent selections and dismissals so that a hidden memory stays hidden and the same memory is not shown too often. On home page visits, we remove this selection history when it is over 90 days old.

Optional usage events older than 90 days, unfinished photo uploads older than two hours, and request-rate records older than one day are removed by hourly maintenance. Cleanup runs can be delayed by service interruptions. These periods do not apply to saved memories or downloaded calendar files.

Friendship rhythm is optional. A host can confirm whether a meetup happened; we use its scheduled date as the date reference. The group owner’s rhythm choice and in-app suggestion preferences are private and are not shared through invitation links. You can turn suggestions off on the group page. Minimal confirmation dates and the group’s rhythm remain until the group is deleted, even if an unsaved event expires. This does not retain its photos or conversation. Guest choices stay with the plan when you save it to your Google account. Related usage events stay in our first-party reporting for up to 90 days; we do not send group or plan identifiers to external analytics.

Our current Supabase Pro service provides a seven-day daily-backup recovery window. Supabase API and database logs have a seven-day accessible history; Vercel Pro runtime logs have a one-day accessible history with our current configuration. These are provider backup and log-access windows, not a guarantee that every provider-held record is erased at the end of that period. Email records and support correspondence are separate from these windows. Contact us if you need help understanding what remains after deletion.

Our retention period for ordinary support correspondence and minimal request-handling records is 12 months after an issue is closed. Cleanup is handled through manual reviews, not an automatic mailbox rule. A specific legal obligation or an active dispute may require a limited record for longer; we document the reason and review that exception. Unnecessary attachments and working export files are removed sooner.

Your controls

You can change your display name in Settings, update your replies, and leave groups. Hosts can revoke proposal invitations. Group admins manage membership. Use Delete account in Settings to remove your account and its associated replies and groups you own. Before deletion, Settings lists your owned groups. Deleting them also removes their plans and other members’ access. Ideas you contributed to groups owned by someone else remain under that group owner’s name. Hosting a plan is separate from owning its group.

Shared content remains until removed through the app or account controls. Operational records and provider backups may remain beyond an in-app deletion under the applicable provider retention processes. Removing an account cannot remove calendar files, messages, or screenshots someone has already saved.

Questions or privacy requests

Contact Pb Duck Oy at ournextplan@sorsamuli.online to ask about your information or request assistance with access, correction, or deletion. We may need to verify that the request concerns your account. Do not send a password or sign-in code.

Tell us whether you want access, a copy, a correction, deletion, restriction or to object to processing. Use your account email where possible. We ask only for proportionate information to verify your identity; we do not routinely ask for an identity document. You can contact us even if you cannot sign in.

We respond without undue delay, normally within one month. If a request is complex or numerous requests require an extension, we explain the reason within that first month; an extension may be up to two additional months where the law permits. Requests are normally free, and we explain any lawful limitation or refusal and the available complaint route.

Depending on the law that applies to your information, you may also request a portable copy, restriction of processing, or object to processing. You can complain to your local data protection authority, including Finland’s Office of the Data Protection Ombudsman at tietosuoja.fi. We do not use your information to make solely automated decisions with legal or similarly significant effects on you.

Changes

We will update this page when these practices change and revise the date above. Material changes affecting existing users will be communicated before they take effect.