PlanPal AI ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our mobile application and web service.
Account Information: Email address, name, and password when you create an account. Passwords are stored only as salted hashes and are never readable by us.
Planner Data: Tasks, priorities, appointments, notes, and expenses you create within the app.
Health Data: With your explicit consent, we access Apple HealthKit data including step counts, walking distance, and mindfulness minutes to display your wellness progress. Health data is treated as a special category of personal data — see Health and Other Sensitive Data.
Location Data: With your permission, we collect GPS location data during walking sessions to track your routes and calculate distance.
Calendar Data: If you connect Google Calendar, we access your calendar events to sync with your planner.
Financial Data: If you connect a bank account, our banking data provider collects your banking credentials directly and shares account balances with us. We never see or store your banking credentials. This feature is currently available only for United States institutions.
Payment Data: Purchases made on the web are handled by our payment provider, and in-app purchases by Apple and our subscription provider. We receive subscription status and identifiers, but never your full card number.
Device Information: Device tokens for push notifications, device model, operating system version, app version, and whether the device is physical or a simulator.
Guest Device Identifier: If you use the app without registering, we generate a random identifier stored on your device and linked to a guest account, so your data persists between launches. It is deleted when you claim or delete the account.
Technical Data: The IP address used at registration, and server and crash logs generated while you use the service.
How We Use Your Information
We use your information to:
Provide and improve our planning and productivity services
Sync your data across devices
Send push notifications about your tasks and appointments
Display health and wellness metrics from Apple HealthKit
Track walking sessions and display route information
Sync with your Google Calendar (if connected)
Generate AI-powered insights and suggestions using our AI model provider
Categories of Recipients
We share personal data with service providers, each only to the extent needed to deliver the feature described. Except where noted, they act as our processors and may not use your data for their own purposes. The categories are:
AI model providers: To provide AI features — task notes, workout parsing, the chat assistant, the daily brief, and workout illustrations. The relevant task, note, message, or exercise text is sent to the provider. Our AI providers do not use this data to train their models.
Text-to-speech providers: To synthesise speech when you use read-aloud features. The text you request is sent to the provider.
The platforms you connect: Apple (HealthKit, and push notifications) and Google (Calendar and YouTube), only where you have connected the corresponding account or granted the corresponding permission. See the integration sections below.
Payment and subscription providers: To take payment on the web, and to process and validate in-app purchases made through the App Store. These providers act as independent controllers for payment and anti-fraud purposes. We never receive your full card number.
Banking data providers: If you connect a bank account, the provider collects your banking credentials directly and shares account balances with us. We never see or store your banking credentials.
Email delivery providers: To send transactional email such as verification and password-reset messages, and to record delivery status.
Push notification providers: To deliver notifications to your device.
Error and crash reporting providers: To diagnose faults in the app. Crash reports may incidentally contain technical identifiers.
Analytics providers: To understand how visitors use our website. See Cookies and Analytics.
Content and data providers: To populate the weather, stocks, news, and reference widgets. We send only the query — for example, a location or a ticker symbol — never your identity.
Hosting and network providers: To host the service and to route and protect traffic.
You have the right to be told the identity of the specific recipients of your personal data. Ask us at the address below and we will name them.
We do not sell your personal data, and we do not share it with advertisers or data brokers.
Google Calendar Integration
When you connect your Google Calendar account, we access and store certain data to provide two-way synchronization between your Google Calendar and PlanPal AI.
PlanPal AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
YouTube Integration
If you enable YouTube integration, we access and store certain data to provide video playback and subscription management features.
Data We Access:
Your YouTube subscriptions (channel names and thumbnails)
Your YouTube playlists and saved videos
Video metadata (titles, thumbnails, durations)
Data We Store:
Subscription and playlist information (to display your content)
Watch history within PlanPal AI (videos you play through our app)
Video metadata for playback features
Data Sharing:
Your YouTube data is NOT shared with any third parties
Your YouTube data is NOT used for advertising or marketing purposes
Your YouTube data is NOT used to train machine learning or AI models
Your data is stored on secure servers with restricted access. All data transmitted between your device and our servers is encrypted using HTTPS/TLS.
Health data accessed from Apple HealthKit is handled in accordance with Apple's HealthKit guidelines and is not shared with third parties for advertising or marketing purposes.
Health and Other Sensitive Data
Step counts, walking distance, mindfulness minutes, and workout activity are data concerning health. In the EEA and the UK this is a "special category" of personal data, which we process only on the basis of your explicit consent (GDPR Article 9(2)(a)).
You give that consent when you grant the app access to Apple HealthKit or to your device's location. You may withdraw it at any time in your device settings, or by deleting your account. Withdrawing consent does not affect processing carried out before you withdrew it. Health data is never shared with third parties for advertising or marketing, and is never used to make decisions about you.
Legal Bases for Processing (EEA, UK, Switzerland)
If data protection law in your country requires us to have a legal basis to process your personal data, we rely on the following:
Performance of a contract (Art. 6(1)(b)) — to create and operate your account, store and sync the planner data you enter, deliver push notifications you have configured, and process your subscription.
Consent (Art. 6(1)(a), and Art. 9(2)(a) for health data) — to access Apple HealthKit, your location, your Google Calendar, and your YouTube account; and to process your content with AI providers. Each of these is off by default and requires an affirmative action by you. You may withdraw consent at any time.
Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent abuse, diagnose crashes and faults, and understand aggregate product usage. We balance these interests against your rights, and you may object as described below.
Legal obligation (Art. 6(1)(c)) — to retain records we are required by law to keep, such as tax records for payments.
International Data Transfers
We operate from the United States, and our servers are located in the United States. If you use the service from the EEA, the United Kingdom, or Switzerland, your personal data is transferred to the United States, and to the providers listed above, some of which process data in the United States and elsewhere.
The United States has not received an adequacy decision covering all such transfers. Where a transfer is not covered by an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum, where applicable) as the transfer mechanism. You may request a copy of the safeguards we rely on by contacting us.
Cookies and Analytics
We use a strictly necessary cookie to keep you signed in and to protect forms against cross-site request forgery. These cannot be disabled, as the service will not function without them.
Our public website also uses Google Analytics, which sets cookies and collects usage data such as pages viewed, approximate location derived from IP address, and clicks on the App Store links. This is not strictly necessary for the service to function.
If you are in the European Economic Area, the United Kingdom, or Switzerland, we ask before we set any analytics cookie. Nothing is requested from Google, and no analytics cookie is set, unless you choose "Accept" on the banner shown on your first visit. If you choose "Decline", or simply ignore the banner, no analytics are loaded at all. Declining costs you nothing: the site works identically either way.
You can change your mind at any time. Withdrawing is as easy as giving consent: the button below forgets your choice and deletes any analytics cookies already set, so you will be asked again on your next visit.
Done — your choice has been cleared.
Outside those countries, analytics load by default. You can prevent Google Analytics from collecting your data by installing Google's opt-out browser add-on, or by blocking the script in your browser. You can also object to this processing by contacting us, and we will exclude you.
Regardless of your choice, our servers keep ordinary access logs (pages requested, timestamps, and approximate location). These are first-party, stored no information on your device, and are used only to operate and secure the service.
Automated Decision-Making
Our AI features suggest tasks, appointments, and summaries. These are suggestions: they are presented to you and take effect only if you accept them. We do not make decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing.
Data Retention
We retain your data for as long as your account is active. Specifically:
Account and planner data — until you delete your account, after which it is removed from our production systems. Encrypted backups are overwritten on a rolling basis.
Guest accounts — retained until you claim the account or delete the guest data from Settings.
Payment records — retained for as long as required by tax and accounting law, even after account deletion.
Crash and server logs — retained for a short period for diagnostics, then discarded.
Your Rights
Subject to the conditions and exceptions in applicable law, you have the right to:
Access the personal data we hold about you, and obtain a copy of it (Art. 15).
Rectify inaccurate or incomplete data (Art. 16).
Erase your data (Art. 17). You can do this yourself at any time by deleting your account in Settings.
Restrict our processing of your data in certain circumstances (Art. 18).
Data portability — receive the data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible (Art. 20).
Object to processing based on our legitimate interests, including analytics (Art. 21).
Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3)). Revoke HealthKit, location, calendar, or email permissions through your device settings or by disconnecting the integration in the app. For analytics cookies, use the Reset my cookie choice button above.
To exercise any of these rights, contact us at the address below. We will respond within one month, as required by Article 12(3), and will not charge a fee unless your request is manifestly unfounded or excessive. We may ask you to verify your identity before we act.
Data Breaches
If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and will inform you directly where the breach is likely to result in a high risk to you.
Children's Privacy
Our service is not intended for children. We do not knowingly collect personal information from children under 13, or, for users in the EEA, under the age of digital consent in their country (between 13 and 16, depending on the member state). If you believe a child has provided us with personal data, contact us and we will delete it.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.
Data Controller and Contact
Young Folks Consulting, LLC, doing business as PlanPal AI, is the controller of the personal data described in this policy. "PlanPal AI" is a trade name; Young Folks Consulting, LLC is the legal entity responsible for your data.
For any question about this policy, to exercise the rights described above, or to request a copy of the safeguards we rely on for international transfers, contact us at:
Young Folks Consulting, LLC
101 West Dilido Drive
Miami Beach, FL 33139
United States [email protected]