Privacy policy

What we collect

• Account. When you sign in with Google or Microsoft we receive your name and verified email address. We do not receive your password.
• Your plans. Everything you enter: plan names, tasks, dates, owners (names or email addresses you type), labels, notes, comments, baselines and progress history, and who a plan is shared with.
• Settings. Your preferences, such as notification switches and display options.
• Billing. Payments are processed by Creem. We receive your subscription status and plan, not your card number.
• Messages. If you use the contact form or email us, we keep what you send and our reply. Your IP address is used to check the form is not abused and a short-lived, non-reversible fingerprint of it is kept for rate limiting.
• Technical data. Our hosting provider processes request logs (such as IP address and browser type) to deliver and secure the service.

How we use it

• To run the service: sign you in, save and show your plans, apply sharing, and enforce plan limits.
• To send emails you can control: sharing invitations, @mentions, assignments, replies and an optional weekday digest of due and overdue tasks. Every message has an unsubscribe link and the switches are in Settings.
• To take payment and manage your subscription.
• To answer your messages and keep the service secure.

We do not sell your data and we do not show advertising.

Public links

If you publish a read-only link to a plan, anyone who has the link can see a copy of it: task names, structure, dates, dependencies, progress, labels and assignee names. Email addresses, comments and Jira details are not included, and you can hide people entirely. Those pages are marked so search engines do not index them. You can update or remove the link at any time.

Cookies and local storage

• A session cookie keeps you signed in. It is essential and lasts up to 7 days.
• Your browser's local and session storage remember small things, such as that you are signed in (so the marketing page does not flash), your chosen plan during checkout and the plan a link opened.
• We do not use advertising or third-party analytics cookies.

Who else handles data

• Cloudflare: hosting, our database and the bot check on the contact form.
• Google and Microsoft: sign-in.
• Creem: payments, invoicing and sales taxes as seller of record.
• Resend: sending email.
• Atlassian (Jira): only if a plan links a ticket. A shared read-only service account reads the ticket title and status, and anyone who can open the plan can see them.
• Google Fonts: the public pages load fonts from Google, which receives your IP address when it does.

These providers process data on our behalf or under their own terms. We share only what each needs.

How long we keep it

We keep your account and plans while your account is active. You can delete plans yourself, and you can ask us to delete your account and the data tied to it. Backups and logs expire on their normal cycle. We may keep records we must keep for tax or legal reasons.

Your choices and rights

Depending on where you live, you may have the right to access, correct, export, delete or restrict the use of your data, and to object to some uses. You can export your plans to Microsoft Project XML or Excel yourself. For anything else, write to [email protected] (or use the contact form, topic "Privacy request"). We may need to confirm it is you. If you are unhappy with our answer you can complain to your local data protection authority.

Security

Connections use HTTPS, sessions are signed and HTTP-only, and plans are only readable by the people they are shared with and by anyone holding a public link you created. No system is perfectly secure, so please use a strong sign-in method and keep public links to people you trust.

Children

GenuinePlan is not meant for children under 16 and we do not knowingly collect their data.

Changes

If we change this policy we will update the date above and, for material changes, tell signed-in users. Questions: [email protected].