Privacy Policy

Updated October 28, 2026

PLANYEAR is a year-planning dashboard. This page says, plainly, what data it stores, where, who handles it and how to delete it.

Who runs PLANYEAR

PLANYEAR is run by Oleksandr Latkun, Tulchyn, Ukraine, who decides how your data is used (the data controller). Contact: contact@planyear.online.

What is stored

• Account. Your email address. If you sign in with email, also a hash of a sign-in value that your browser derives from your password: the password itself never leaves your browser. If you sign in with Google, also your Google account ID and the name Google shares (see Google user data). The server also records when the account was created and last signed in, and how much storage it uses.
• Signed-in devices. For each device you are signed in on, the server keeps a hash of its sign-in token, when it signed in and when it was last used (to the day), and whether it is this website or a copy of the dashboard opened from your computer. A device is signed out after 180 days without use (30 days for a copy on your computer), when you sign out there, or when the sign-in password is changed or reset.
• Dashboard content. Everything you enter yourself: tasks, notes, goals, wishes with photos, assets, receipts, graphs and settings. It reaches the server only encrypted — see Encryption.
• Your encryption key, locked. The key that encrypts your data is stored on the server only in encrypted form: once locked with your password and once with your recovery key. Neither the password nor the recovery key is ever sent to the server, so the locked copies are useless without them.
• Previous versions. The server keeps encrypted snapshots of changed and deleted data for 14 days (at most 30 per item), so they can be restored after a mistake. A photo you replace or remove is deleted from storage 14 days after the dashboard notices it is no longer used. Our hosting provider’s own recovery copies are described under Where it is stored.
• Messages you send us. If you write to us from Settings → Feedback, the message is stored in the EU with your account email, the interface language, the page that was open, your browser and window size. It is emailed to us through Resend so that we can read and answer it. Unlike your dashboard content it is not encrypted: you send it to be read. It is deleted together with your account.
• Storage limits. In its first 7 days an account can hold 5 MB of data, 5 MB of history and 200 MB of photos. After that, the limits are 20 MB, 20 MB and 1 GB.

Unless a shorter period is given above, all of this is kept for as long as the account exists. Accounts are not deleted for inactivity.

There is no advertising, and the dashboard itself has no analytics or tracking. Data is not sold or shared for advertising.

Encryption

Everything you enter in the dashboard is encrypted in your browser before it is sent, with AES-256-GCM and a random key of your account. The server stores only ciphertext. Photos are encrypted the same way, each on its own. Your account’s key is protected by your password (PBKDF2-SHA-256, 600 000 iterations) and by a recovery key you save when encryption is set up. If you sign in with email, it is the password you sign in with: your browser turns it into two independent values, one that signs you in and one that unlocks the key, and only the first is sent. If you sign in with Google, you set a separate encryption password. We never receive the password or the recovery key. This means we cannot read your plans, finances or notes from the database — and neither can our hosting provider or anyone who obtains a copy of it.

• What stays visible to the server:
  • your email address and, with Google sign-in, your Google account ID and name;
  • the names of the storage slots your data is kept in (for example, that there is a board for 2026), their size, when they change, and a random identifier of the device that changed them;
  • how many photos are stored as separate files, their sizes and when they were added;
  • when the account was created and last signed in, and when each signed-in device was last used.
• What encryption does not protect against. The dashboard’s code is delivered by this website. If that code were altered — by us, or by someone who broke into our hosting — it could read your data in the browser after decryption. Encryption also cannot protect a device that is itself compromised. It protects the stored data.
• Your devices. A device where you have opened the dashboard keeps a decrypted copy, your decrypted photos and the key, so it does not ask for the password again. Signing out removes them once every change has reached the server.
• If you forget your password, the data opens with the recovery key, or on a device where the dashboard is already open. With email sign-in, a password reset by email brings back sign-in but not the data: sign in with the new password on such a device, and it locks the key with that password. If you set the same password as before, your data opens as it did, without the recovery key. With Google sign-in, such a device sets a new encryption password in Settings.
• If you lose both the password and the recovery key and no device has the dashboard open, your data cannot be recovered — not by us, not by anyone. You can then delete it and start over.
• Choose a strong password. The locked key and a hash of the sign-in value are on the server, so someone holding a copy of the database could try to guess the password. That is why it must be at least 10 characters, and a phrase of several words is far harder to guess than a short word.

Where it is stored and who handles it

• Cloudflare runs this website, sign-in, the account database, photo storage, live updates between your devices, and the hourly and daily jobs (exchange rates, clean-up). Your account record, your encrypted data and photos, and the messages you send us are stored in the European Union (Cloudflare’s EU jurisdiction), and each account is kept in its own isolated database. Requests are answered by the Cloudflare data centre nearest to you, which may be outside the EU. Cloudflare keeps recovery copies of the stored data for up to 30 days. We use them only to repair the service after a failure, never to bring back a deleted account.
• Your browser keeps a decrypted local copy for speed, your decrypted photos, the key that decrypts them, the sign-in session and the language you pick on the site (IndexedDB, localStorage). Signing out removes the copy and the key once every change has reached the server. A device signed out before its changes could be sent keeps its copy, its decrypted photos and the key until someone signs in there. If your account is deleted, each signed-in device erases its copy the next time it is opened online. The demo needs no account: its made-up data and whatever you change in it stay in that browser tab (sessionStorage), never reach the server and are gone when the tab is closed. The site uses no cookies.
• Resend sends our email: password-reset and account-deletion links to you, your feedback messages to us, and our replies when you write to us. It keeps sent messages for 30 days.
• Our mailbox is at Google (Gmail). Mail you send to contact@planyear.online is forwarded there by Cloudflare Email Routing, which passes each message on and keeps a delivery log (sender, recipient, subject and the delivery result) that we can see for up to 30 days. The feedback messages that Resend delivers arrive there too. We keep your messages and our replies as long as we need them to answer you. After you delete your account, we delete them within 30 days.
• Google sign-in is used only if you choose it (see Google user data).

Cloudflare, Resend and Google are US companies, and data they handle for us may be processed outside the EU.

Logs and abuse protection

Cloudflare processes your IP address to deliver every request to this site, data.planyear.online included. Its traffic and security statistics for the site keep request details for up to 31 days, with IP addresses in samples of blocked or suspicious requests. Our server’s own error logs are kept for up to 7 days. They contain no IP addresses, passwords, sign-in tokens or dashboard content, though an error may name the account number it happened in.

To limit abuse:

• Sign-up, sign-in, password-reset and account-deletion attempts are counted per IP address (per /64 network for IPv6), and reset requests also per email address. Each counter is stored only as a keyed hash that changes daily, and for at most 48 hours.
• For each new account we keep, for 30 days, a keyed hash of the network it was created from and of the wider network around it. It is not the address, and it cannot be turned back into it without our server’s secret key. We use it only to find and remove accounts created in bulk.
• We count sign-ups per network operator (for example, Kyivstar) per day, without any address, for 30 days.

We also log requests to delete an account, the deletions themselves and every action we take on an account with our administration tools (for example, restoring its data after a failure). Each entry holds what was done, the date and a tag of the account made with our server’s secret key, never your email address, and is kept for 180 days.

Visit statistics

The public pages count visits with Cloudflare Web Analytics. These are the home page in every language, the articles and this policy; never the dashboard, the demo or error pages. Such a page loads a small script from Cloudflare (from its cloudflareinsights.com domain). The script reports:

• the page’s path;
• the site you came from;
• your country, browser, operating system and device type;
• how fast the page loaded.

Query strings are not recorded. The script uses no cookies and stores nothing in your browser. According to Cloudflare, it does not identify visitors by IP address or by fingerprinting their browser. We see the statistics only in aggregate: Cloudflare keeps the full data for 7 days and a reduced sample (about a tenth) for 6 months. If a page is opened from a link that carries sign-in data, the page removes that data from the address and does not count the visit.

Third-party services

Exchange rates and the oil price are fetched once an hour by this site’s own server (Cloudflare) from the open-source currency-api (served by Cloudflare Pages and jsDelivr) and from OilPriceAPI, and published as one public file at data.planyear.online — the same file for the dashboard and the demo. Your browser downloads it from Cloudflare like any other part of this site, without your account, a token or a cookie. The rate services never see your IP address.

Holidays for most countries come from the open-source date-holidays project (licensed CC BY 3.0). The data is built into the site, so the browser contacts no one for it.

Google user data

If you choose to sign in with Google, PLANYEAR asks Google for your email address and name. With them, Google shares your Google account ID and a link to your profile picture. PLANYEAR stores the account ID, the email address and the name. It uses the ID and the email address only to sign you in and to email you about your account. It keeps the name with your sign-in record and does not use it for anything else, and it never reads or stores the picture. PLANYEAR keeps no Google access token, so it cannot act in your Google Account. You can remove its access at any time in your Google Account, under third-party connections.

Use and transfer of this information adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Deleting your data and your account

• Delete all data (Settings → Data) empties your dashboard on every device and keeps the account and your settings (language, country, currencies and the like). Snapshots of what was removed stay for 14 days, and removed photos are deleted 14 days later.
• Delete account (Settings → Account) emails a one-time link to your account’s address. The link works for 60 minutes, and opening it deletes nothing until you confirm: with your password if you sign in with email, or, with Google sign-in, in a browser where you are signed in with Google, by typing your email.
  • Confirming deletes at once your sign-in, email address, name, signed-in devices and the locked encryption key. Your dashboard data, its snapshots, photos, settings and the messages you sent us follow within minutes.
  • Every device is signed out and erases its copy the next time it is opened online.
  • The address can then be used for a new, empty account.
• What remains for a limited time:
  • Cloudflare’s recovery copies of your account (your encrypted data, your account record with your email address, name and sign-in records, and the messages you sent us), for up to 30 days. We never use them to restore a deleted account, and our tools refuse to.
  • Emails sent through Resend (deletion and reset links, your feedback messages), kept by Resend for 30 days.
  • Your messages and our replies in our mailbox, which we delete within 30 days.
  • A record that an account number was deleted, with the date and without your email address, for up to 7 months, so that devices still signed in learn that it is gone.
• To keep a copy first, use Settings → Data → Export. It saves everything, photos included, to a file.
• If you cannot receive email at your account’s address, send us a message from Settings → Feedback while signed in, or write from that address to contact@planyear.online.

Changes and contact

If this policy changes, the date above will change. Questions: contact@planyear.online.