PlanAlong Privacy Policy

PlanAlong is for parents and legal guardians who are 18 or older. Children do not create accounts and do not use the app directly. A parent creates a family account and may add information about their own children. You must be the parent or legal guardian of any child you add.

From parents / account holders

• Account & identity: your email address (used to sign in) and your sign-in method (Apple or email). We do not use phone numbers to sign in.
• Invite details (optional): if you type a phone number or email to invite someone, we use it only to send that invitation. A phone number you enter for an SMS invite stays on your device — the message is sent from your own messaging app, and we never message your contacts for you. If you invite a co-parent by email, that email address is sent to our servers so we can deliver the invitation. The invitation link stops working after 14 days, and the record is removed when you delete the invitation or delete your account. We do not read or upload your device's contacts.
• Family profile: family name, short name, city, and an optional accent color.
• Home address (optional): if you choose to enable carpool/neighborhood matching. Stored with a per-address opt-in; you can save an address without enabling matching, or skip it entirely.

About children (entered by the parent)

• Required: the child's first name and an age in years. We do not upload your child's date of birth to our servers — a date of birth, if you enter one, stays on your device and is used only to compute the age in years that's shown to others.
• Optional (parent-added): gender, interest tags, a display color, allergies/medical notes, and pickup-authorization notes. These are optional and you control whether to add them.

Activity & coordination data

Plans, RSVPs, groups, trips, itineraries, carpools, shared expenses, memberships, and messages you create or participate in.

Automatically collected

• Usage analytics — product-usage events (e.g., “posted a plan”) with no names, addresses, message content, or other personal identifiers in the event data. Processed in the EU.
• Crash & error diagnostics — to fix bugs; configured to strip user identifiers and request payloads.
• Device/technical — app version and OS.

• To provide the core service: let you coordinate plans, RSVPs, carpools, trips, and expenses with families you connect with.
• To show your child's first name and age in years to the specific families you choose to connect with, so you can coordinate together.
• To improve reliability and usability (aggregate analytics, crash diagnostics).
• To process subscriptions (Plus) and communicate service messages.
• We do not use children's information for behavioral advertising, profiling, or any purpose beyond coordinating activities you initiate.

With other families

When you connect with another family — through a pal connection, a shared group, a shared trip, or a shared plan — that family can see the adult names in your family so chat authorship (“Pat wrote: …”) and “who invited whom” work. They can also see your child's first name and age in years (and any optional fields you chose to share, such as interests) so you can coordinate. Children's information is never disclosed cross-family unless and until you have signed parental consent. They cannot see your address, your child's date of birth, allergies/medical notes, or pickup notes unless you explicitly share them in a specific context.

With service providers (processors)

We use vendors to run the app. They process data only to provide their service to us:

• Supabase — cloud database, authentication, and file storage.
• PostHog (EU) — product analytics. Events only; no PII; no session recording.
• Sentry — crash/error diagnostics, with PII scrubbing.
• Mapbox, OpenStreetMap-Nominatim, the NPI Registry (CMS/HHS), and Recreation.gov (USDA) — venue and address lookup/geocoding. When you search for a place or address, your search text is sent to the relevant lookup provider to return matches.
• Cloudflare — hosting for our website and the shareable invite/plan links you open in a browser.
• Resend — transactional email (consent confirmations, withdrawal confirmations).
• RevenueCat, Apple App Store, Google Play — subscription billing and entitlements.

We do NOT

• Sell your or your child's personal information.
• Share it with advertisers or data brokers.
• Make children's information public.

We may disclose information if required by law, to protect safety, or in connection with a business transfer (with notice).

PlanAlong is intended for parents, and we treat all child information as subject to the Children's Online Privacy Protection Act (COPPA).

• Verifiable parental consent. Before any information about your child is disclosed to another family on PlanAlong, you sign an electronic consent form (§ 312.5(b)(2)(ii)) by typing your full name into the consent screen. The signature is bound to your authenticated PlanAlong account (Apple Sign-In or email magic link), and we keep an audit record of what you signed (form version + a hash of the canonical signed text), when you signed it, the account identifier that signed it, and — where available — the IP and user-agent reported at sign time. You'll also receive a confirmation email with a copy of what you signed.
• Data minimization. We collect only what's needed to coordinate activities — a first name and an age in years, plus anything optional you choose to add. We do not condition your child's participation on providing more than is reasonably necessary.
• Your rights as a parent. At any time you may:
  • Review the information we have about your child,
  • Correct or delete it,
  • Refuse further collection or use, and
  • Withdraw consent — which stops further sharing across families, anonymizes your kid's record on RSVPs and carpool seats, and triggers deletion of the kid record itself from our servers within 30 days.
  • To do these in the app: review and edit a child's information from your family card (tap the child), and withdraw consent or delete your account from Settings → Privacy & child safety. You can also contact privacy@planalong.app. We will verify you are the parent before acting on an emailed request; in-app actions are already authenticated.
• Limits of withdrawal. Withdrawing consent stops PlanAlong from sharing your child's information going forward and deletes it from our servers within 30 days. It cannot recall information that another family already received. Before you withdrew, the families you connected with may have seen your child's name and age, taken screenshots, exported data, or remembered details. PlanAlong has no way to reach into another family's device, mind, or copies; the withdrawal right runs against PlanAlong's servers and our future disclosures, not against what another family already received.
• Receiving families have their own COPPA responsibilities. When you share your child's information with another family on PlanAlong, that family is also a parent under COPPA with respect to the information they receive. They are expected to treat your child's information with the same care they treat their own — not to forward it outside PlanAlong without your consent, not to use it for any purpose beyond the coordination you initiated, and to delete it if you ask them to. PlanAlong reminds receiving families of these obligations when they accept a Pal Pass invite, but cannot enforce them inside another family's account.
• Multiple adults on one account. Any adult on a PlanAlong family account may sign parental consent on behalf of the family. If you share an account with a co-parent and one of you objects to a particular disclosure, both should be present to manage your children's settings — or the objecting parent should contact privacy@planalong.app so we can pause cross-family sharing while you work it out. We are not currently able to mediate between co-parents on the same account; in disputes, withdrawal of consent is your safe default.
• Where to review your child's information. You can review and edit what we have about your child from the family screen in the app — open your family card and tap a child to see and edit everything we've recorded.
• No behavioral advertising to or profiling of children.

We keep personal information only as long as needed to provide the service or as required by law, then delete it.

• You can delete your child's information, or your entire account, at any time. Deletion removes the information from PlanAlong's servers and removes it from the views of families you had connected with.
• Withdrawal of parental consent triggers a same-day stop on cross-family disclosure and deletion of the child record from our servers within 30 days (per § 312.10).
• Stalled signup. If you start adding a child but don't complete parental consent, we delete that partial child information from our servers within 7 days so it doesn't linger un-consented.
• Backups and disaster-recovery copies. Our database provider takes daily backups with a 7-day rolling retention. When you delete data, it leaves these backups within the next 7 days.
• Other coordination data (plans, RSVPs, group events, trips, expenses) follows the per-primitive horizons in our retention policy: short-lived coordination objects archive after the event ends and prune over months; expense records persist for tax/receipt reasons until you delete them.
• What we cannot recall. Once another family received information about your child during the time you were connected, PlanAlong cannot reach into that family's devices or memory. Deletion runs against PlanAlong's servers and our future views; it does not undo information another family already received. See § 5 “Limits of withdrawal.”

If you are a California resident, you may request access to, correction of, or deletion of your personal information, and you have the right to not be discriminated against for exercising these rights. We do not “sell” or “share” personal information as those terms are defined under the CPRA, and we do not sell/share the information of consumers under 16. Contact privacy@planalong.app.

PlanAlong is intended for and offered only to users in the United States. We do not offer the service in the European Union or other regions, and the app is distributed only on the U.S. App Store. If you are located outside the United States, please do not use PlanAlong. Our service providers (listed in § 4) may process data in the United States and, for product analytics (PostHog), in the European Union.

We use industry-standard safeguards (encryption in transit, encryption at rest at our database provider, access controls, and row-level data partitioning per family). Cross-family visibility happens only through the connections you create and the disclosures described in § 4. No system is perfectly secure; we cannot guarantee absolute security.

We may update this policy. We bump Last updated on every change — typo, clarification, vendor list update — and we bump Effective date only on material changes. Material changes are: a new category of personal information collected, a new processor with access to children's data, a new disclosure use, a changed retention horizon, a changed withdrawal mechanism, or a changed verifiable-parental-consent method. For material changes affecting children's information, we will provide 30 days' advance notice in the app and an email to the parent on the account, and we'll obtain renewed parental consent under COPPA § 312.5(c) where required.

Questions, requests, or to exercise your rights: privacy@planalong.app · GoodHive LLC, 1968 S. Coast Hwy #901, Laguna Beach, CA 92651.