Planit

Privacy Policy

Planit — Go do something.

Last updated: October 14, 2026

Overview

Planit shows events in Copenhagen without an account. Some features use information on the device; optional announcements also use a persistent, accountless installation record on the Planit server.

Information used for event discovery

When location access is granted, the app sends coordinates to the Planit API to find nearby events and sort them by distance. Search terms and selected filters are sent to answer event requests. The app does not create an account or associate these requests with an announcement installation. API request logs can contain a request path and network address; the current service does not provide a guaranteed log-retention period.

Google Maps loads map data under Google's privacy practices. Expo also distributes app updates under its own privacy practices. The app does not send a name, email address, or phone number to Google for event discovery.

Saved events and local reminders

Saved events, reminder choices, theme, and other ordinary settings are stored on the device. Saved-event reminders are scheduled locally. Android may require separate Alarms & reminders access for precise reminder timing. Those local reminders do not require announcement registration.

Optional announcements

After the first introduction is completed or skipped, Planit requests operating-system notification permission once. Granting permission enables Copenhagen announcements; denying permission leaves them off. Existing announcement preferences are preserved. Announcements can be turned on or off in Settings > Notifications, independently of saved-event reminders. When announcements are enabled, Planit obtains an Expo push address for the installed app. The Planit API stores that address with a persistent installation ID, the Copenhagen city, installed build variant (production, preview, or development), and the announcement on/off preference. A server-generated private installation credential is stored in the device's protected storage; only its hash is stored on the server. The credential authorizes preference changes, test pairing, recovery confirmation, and recording an announcement open. No account, name, email address, phone number, advertising ID, or contact list is needed.

If device storage loses that credential while a push address remains registered, the app may check for an earlier registration when notification permission is already granted. Recovery requires a short-lived, one-use proof sent to the phone holding that address. Successful recovery turns announcements off for both the old and restored installation until the user explicitly opts in again. The server stores a hash and issuance details for that proof. An administrator can issue a single-use, ten-minute test-pairing code and give the paired phone a label stored on the server; that phone may receive an explicitly selected test even while general announcements are off.

The server stores authored announcements and a delivery record for each selected recipient, including the address used while needed for sending or receipt checks, attempt time, provider ticket or bounded error, and any first recorded open. A test delivery is marked separately and does not contribute to broadcast counts. An open is sent to the Planit API using the private installation credential when an announcement is tapped and the app can reach the server. Opens are best effort; the counts do not establish that all received notifications were viewed. Linked event IDs remain on historical announcements if the event is later removed.

Planit sends notification content and the recipient's push address through Expo Push Service, which passes the notification to Apple or Google for device delivery. An Expo acceptance result confirms acceptance for processing, not arrival on the device. Expo's and the platform provider's own privacy practices apply to that delivery. Optional Expo server authentication credentials stay on the API and are not included in the mobile app.

Turning announcements off updates the local choice immediately. If the device is offline or server synchronization fails, the app shows a pending update and retries; notifications already handed to a platform may still arrive, and the server can continue selecting the installation until it receives the opt-out. The device-save and server-update states are shown separately. Saved-event reminders are controlled by the 1 day before and 1 hour before choices; both off disables them.

Storage and retention

Local preferences can be removed when the app is uninstalled, but protected storage behavior depends on the operating system and reinstall path. The Planit database keeps installation, pairing, recovery, announcement, delivery, and open records without a fixed deletion schedule. A periodic background cleanup removes historical delivery address copies after they are no longer needed for sending or receipt checks; accepted delivery copies become eligible after a receipt check or the 24-hour receipt window. Recovery proof hashes become eligible when consumed, expired or locked; recovery address copies become eligible after the one-day request limit. Cleanup runs in batches, so removal can lag eligibility. The current installation address remains while needed for future notifications or pairing. Expired pairing codes are removed when a new code is created. A server may retain API request logs separately. The policy does not promise a fixed log or provider retention period.

Children, changes, and contact

Planit does not knowingly collect personal information from children under 13. Changes to this policy appear in the Last updated date above. Questions can be sent to sanderbushkrogh@gmail.com.

Sander Bush Krogh Copenhagen, Denmark