PlancyAI_Privacy_Policy

PlancyAI

Privacy Policy

Prepared for publication with the PlancyAI mobile application, website, dashboard, and related services.

1. Introduction

This Privacy Policy explains how Ilia Melnikov as individual developer ("PlancyAI", "we", "us", or "our") collects, uses, stores, shares, transfers, and deletes personal data and other information when you access or use the PlancyAI mobile application, website, dashboard, and related services (together, the "Service").

PlancyAI is a voice-first AI notes application that helps users capture voice and text notes, transcribe audio, generate AI summaries and structured details, organize notes by projects, search saved notes, extract action items, set reminders, and export selected content where supported.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, you should not use the Service.

This Privacy Policy is intended to be available through a public, non-editable URL and inside the App, as required for apps distributed through Google Play and other app stores.

2. Scope and Controller

This Privacy Policy applies to personal data processed by Ilia Melnikov in connection with the Service. For users in jurisdictions that use the concepts of "controller" and "processor", Ilia Melnikov is generally the controller of personal data processed for operating the Service, managing accounts, providing support, securing the Service, enforcing usage limits, and complying with legal obligations.

When you choose to connect third-party services such as Google Sign-In or Google Sheets, those third-party services may also process your data under their own privacy policies and terms.

3. Worldwide Availability

PlancyAI may be made available to users in multiple countries and territories worldwide through app stores or other distribution channels. This Privacy Policy applies globally, including to users in Armenia, the European Union, the European Economic Area, the United Kingdom, the United States, and other jurisdictions where the Service is available, unless mandatory local law requires a different or additional disclosure, right, or legal standard.

4. Information We Collect

We collect information only to the extent necessary to provide, secure, improve, and support the Service, or where otherwise described in this Privacy Policy.

4.1 Account and Authentication Data

When you create or access an account, including through Google Sign-In, we may collect and process:

• email address;
• name or display name provided by your Google account or other authentication provider;
• account identifier;
• authentication tokens or session information needed to keep you signed in securely;
• subscription, plan, usage-limit, and entitlement status;
• account settings and preferences.

We do not request additional Google account data unless it is necessary for a feature you explicitly choose to use.

4.2 Voice Recordings and Audio Data

When you record voice notes or use voice-based features, we may process:

• voice recordings created by you in the App;
• audio files and related technical metadata, such as creation time, duration, and processing status;
• audio data transmitted for speech recognition, transcription, or AI processing;
• microphone recording state and related diagnostic events needed to operate recording features.

Voice recordings may contain personal data about you or other people if you include such information in your recording. You are responsible for ensuring that you have the right to record, upload, process, or store any voice or information relating to other people.

4.3 Notes, Transcripts, Summaries, and User Content

When you use the Service, we may process content you create, submit, record, edit, import, or generate through the App, including:

• text notes;
• audio transcripts;
• AI-generated summaries;
• AI-generated details or structured note fields;
• comments and edits;
• action items, TODOs, reminders, due dates, and status labels;
• project names, project assignments, markers, tags, categories, filters, and archive/done states;
• search queries and search results generated inside the App;
• prompts or instructions sent to AI systems to provide the requested functionality;
• outputs generated by AI systems in response to your content.

We refer to this information collectively as "User Content". User Content is processed to provide the core functionality of PlancyAI.

4.4 AI-Generated Content and Automated Processing Data

PlancyAI uses AI and speech recognition technologies to provide features such as transcription, summarization, note structuring, action item extraction, smart search, and suggested next steps. To provide these features, User Content may be sent to our backend systems and to third-party AI or speech recognition service providers.

AI-generated outputs may be incomplete, inaccurate, or inappropriate for a particular purpose. You should review AI-generated summaries, transcripts, classifications, action items, and suggestions before relying on them.

4.5 Search, Filters, and App Interaction Data

When you use search, filters, project navigation, TODO lists, reminders, or other in-app features, we may process:

• search terms and voice search transcripts;
• filters, selected projects, dates, status labels, and sorting preferences;
• screen navigation and feature interaction events;
• processing status, error status, and queue/worker status relevant to your request;
• usage counters used to enforce free or paid plan limits.

4.6 Google Sign-In Data

If you use Google Sign-In, we process the Google account information needed to authenticate you and maintain your account. This may include your email address, name, profile identifier, and authentication tokens required for sign-in.

We use Google Sign-In data only for authentication, account management, security, and user-facing features that are visible in the App.

4.7 Google Sheets Integration Data

If you choose to connect Google Sheets, PlancyAI may request access to the Google Sheets scopes needed to export selected notes, summaries, details, action items, and related metadata to a spreadsheet you choose.

When Google Sheets export is enabled, we may process:

• Google account authentication and authorization tokens needed for the integration;
• spreadsheet identifiers selected by you;
• selected note content and related metadata exported to the spreadsheet;
• export status, error messages, and diagnostic data needed to complete or troubleshoot export.

We do not use Google Sheets data for advertising, retargeting, data resale, creditworthiness decisions, or unrelated purposes. Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Current Google Sheets implementation details: Google Sheets integration is optional and user-initiated. A user may connect a Google account, select a spreadsheet, switch the connected account, and export selected PlancyAI note data to the spreadsheet chosen by the user. The integration is used only to provide the export functionality requested by the user.

Google API scopes requested: Google Sign-In scopes: openid, email, profile. Google Sheets export scope: https://www.googleapis.com/auth/spreadsheets. Google Drive/Picker scope, if used only to allow the user to select a spreadsheet: https://www.googleapis.com/auth/drive.file and/or https://www.googleapis.com/auth/drive.metadata.readonly. The exact scopes used by the App are limited to those necessary to authenticate the user, allow the user to select a spreadsheet, and export selected PlancyAI data to that spreadsheet.

Whether Google Sheets content is stored on PlancyAI servers: Based on the current implementation, the contents of Google Sheets are not stored on PlancyAI servers. PlancyAI may process and/or store only Google authentication or authorization tokens, the selected spreadsheet identifier, export status, error messages, and technical diagnostic metadata needed to provide, maintain, secure, and troubleshoot the Google Sheets export feature.

4.8 Local Vault / Device File Export Data

If you choose to export notes to a local folder, vault, file storage location, or other destination on your device, the App may create files containing selected notes, summaries, transcripts, comments, action items, and metadata.

Once exported outside the App, those files may be accessible through your device file system, file manager, backup tools, cloud sync apps, or third-party applications you choose to use. You are responsible for securing exported files and managing access to them.

4.9 Notifications and Reminder Data

If you enable notifications, reminders, due-date alerts, review reminders, or action item notifications, we may process:

• reminder times;
• due dates;
• notification preferences;
• action item and TODO status;
• deep link information used to open the relevant note or TODO item;
• notification delivery or failure status where available.

Notification delivery may depend on your device settings, operating system permissions, battery optimization settings, and network availability.

4.10 Technical, Device, and Service Data

To operate and secure the Service, diagnose issues, enforce usage limits, and prevent abuse, we may collect technical and service data, including:

• IP address;
• approximate region inferred from IP address;
• device type, operating system version, app version, language, and locale;
• device identifiers or installation identifiers where necessary for security, diagnostics, fraud prevention, or service operation;
• request date and time;
• request status, error codes, and latency;
• speech recognition requests and processing status;
• AI processing requests and processing status;
• account-related operations;
• usage counters and quota events;
• crash, error, diagnostic, and performance data;
• security logs and abuse-prevention signals.

We do not collect precise geolocation data unless a future feature expressly asks for permission and this Privacy Policy is updated accordingly.

4.11 Communications and Support Data

If you contact us for support, privacy requests, bug reports, AI-output reports, or other inquiries, we may process your name, email address, message content, attachments, screenshots, diagnostic files, and any other information you choose to provide.

4.12 Payments and Subscription Data

If paid features are enabled, payment and subscription processing may be handled by Google Play, Stripe, or another payment provider, depending on the platform and purchase flow available to you.

We may process subscription status, plan type, renewal status, trial status, transaction identifiers, invoices, payment status, and billing-related events. Full payment card details are processed by the relevant payment provider and are not intentionally stored by PlancyAI.

Current payment providers and launch status: At launch, paid subscriptions are not sold inside the Android App. Stripe may be used for eligible web-based billing flows available through the PlancyAI website or dashboard. If Android in-app purchases are introduced in the future, they will be processed through Google Play Billing or another payment flow permitted by applicable platform rules. PlancyAI does not intentionally store full payment card details.

Android in-app billing implementation status: Google Play Billing is not currently enabled in the Android App at launch. The Android App does not currently process paid subscriptions or in-app purchases.

5. Data We Do Not Intentionally Collect

Unless a feature is later enabled and clearly disclosed, PlancyAI does not intentionally collect:

• precise GPS location;
• phone contacts or address book data;
• SMS or call logs;
• health or fitness data;
• government identification numbers;
• biometric identifiers;
• advertising ID for third-party behavioral advertising.

If future versions of the App introduce features that require any of these categories, we will update this Privacy Policy and, where required, provide in-app disclosure and obtain permission.

6. How We Use Information

We use collected information for the following purposes:

• to provide the core functionality of the Service;
• to record, store, transcribe, structure, and display notes;
• to generate AI summaries, details, action items, and suggestions;
• to provide smart search and voice search;
• to organize notes by projects, statuses, filters, and other user-selected categories;
• to operate reminders, TODO lists, notifications, and deep links;
• to authenticate users and manage accounts;
• to enforce free and paid usage limits;
• to provide subscriptions, billing status, trials, and plan entitlements where applicable;
• to operate Google Sign-In and optional Google Sheets export;
• to export selected content to local storage or user-selected destinations;
• to provide support and respond to privacy requests;
• to monitor performance, diagnose errors, and improve reliability;
• to detect, prevent, and investigate fraud, abuse, misuse, security incidents, and technical problems;
• to comply with legal obligations and enforce our terms.

7. Legal Bases for EU / EEA / UK Users

If you are located in the European Union, the European Economic Area, or the United Kingdom, we process your personal data on one or more of the following legal bases:

• Performance of a contract: where processing is necessary to provide the Service, including account access, note capture, transcription, AI processing, search, reminders, exports, usage limits, and subscriptions.
• Consent: where required for optional permissions or integrations, such as microphone access, notifications, Google Sheets access, or other optional features.
• Legitimate interests: where processing is necessary to secure the Service, prevent abuse, investigate incidents, improve reliability, understand product usage, and support users, provided those interests are not overridden by your rights and freedoms.
• Compliance with legal obligations: where processing is necessary to comply with applicable laws, regulatory obligations, tax, accounting, audit, or legal requirements.

8. AI Processing and Service Providers

PlancyAI uses AI, speech recognition, and related backend services to provide transcription, summarization, classification, note structuring, TODO extraction, smart search, and other user-facing features.

To provide these features, relevant User Content may be transmitted to third-party providers, which may include:

• OpenAI;
• Anthropic;
• other AI, speech recognition, infrastructure, or model-routing providers configured through our backend systems: LiteLLM-compatible model-routing infrastructure and other AI, speech recognition, hosting, infrastructure, logging, monitoring, or security providers used only where necessary to provide, secure, monitor, troubleshoot, or improve the Service.

Transmission is limited to what is necessary to process your request, provide the Service, maintain security, troubleshoot errors, and enforce usage limits.

We do not use your User Content for advertising personalization. We do not intentionally sell User Content. We do not intentionally use User Content to train generalized AI models, except as follows: not applicable. PlancyAI does not intentionally use User Content to train generalized AI models. We also do not intentionally opt in to third-party provider model training using User Content unless this Privacy Policy is updated or the user has expressly consented where required by applicable law.

Provider-specific data processing, retention, model-training opt-out, and data-processing agreement status: Where available, PlancyAI uses business, enterprise, or API-based AI services and provider settings that restrict the use of User Content for provider model training. Provider-specific retention periods, security measures, subprocessors, data-processing terms, and opt-out settings are governed by the applicable agreements, policies, and technical configurations of each provider. PlancyAI will use commercially reasonable efforts to select provider configurations that limit training use, restrict access, and protect User Content.

9. Google API Services and Limited Use

If you use Google Sign-In or connect Google Sheets, our access to and use of information received from Google APIs will comply with the Google API Services User Data Policy, including the Limited Use requirements.

This means that we will:

• use Google user data only to provide or improve user-facing features that are visible and prominent in the App;
• not transfer Google user data except as necessary to provide or improve those user-facing features, for security purposes, to comply with applicable law, or as otherwise permitted by the Google API Services User Data Policy;
• not use Google user data for serving ads, retargeting, personalized advertising, data brokerage, resale, creditworthiness decisions, or unrelated purposes;
• restrict human access to Google user data except where you have given permission, where needed for security or abuse investigation, where required by law, or where data is aggregated for internal operations in accordance with applicable law;
• take reasonable steps to protect Google user data in transit and at rest.

10. Data Sharing and Disclosure

We may share personal data only as described in this Privacy Policy and as necessary to operate the Service. We may disclose data to:

• AI and speech recognition providers that process User Content for transcription, summarization, classification, search, and related features;
• cloud hosting, database, backend, infrastructure, storage, logging, monitoring, and security providers;
• authentication providers, including Google Sign-In;
• Google APIs, when you choose to connect Google Sheets or other supported Google integrations;
• payment processors and app stores, where paid features, subscriptions, or billing are enabled;
• email and customer support providers used for transactional emails, support, privacy requests, or account notifications;
• professional advisers, auditors, insurers, legal advisers, or compliance consultants where necessary;
• competent authorities, courts, regulators, or law enforcement where required by law or necessary to protect rights, users, systems, or safety;
• successors or parties involved in a merger, acquisition, restructuring, financing, asset sale, or similar transaction, subject to applicable law.

Current infrastructure / hosting providers: Cloud hosting, database, backend, website, and reverse-proxy infrastructure providers used to operate PlancyAI. Provider names and regions may change as the Service evolves, but providers are used only to operate, secure, monitor, and support the Service.

Current logging / monitoring / crash reporting providers: No third-party analytics SDK is currently used. PlancyAI may use internal server logs, application logs, platform-native crash or error diagnostics, and provider-level monitoring where necessary to operate, secure, troubleshoot, and improve the Service.

Current email provider: Gmail SMTP / Google Workspace email infrastructure, used through transactional email tooling for welcome emails, account notices, support, privacy requests, and service notifications.

Current payment provider, if any: Stripe may be used for eligible web-based billing flows if enabled. Google Play Billing is not enabled in the Android App at launch.

We do not sell personal data in the traditional sense of exchanging it for money. We do not share User Content for third-party behavioral advertising.

11. Data Storage and International Transfers

Ilia Melnikov is an individual developer based in Armenia. Our service providers, infrastructure, AI providers, and other processors may be located in Armenia, the United States, the European Economic Area, the United Kingdom, or other jurisdictions.

Your data may therefore be transferred to, processed in, and stored in countries other than your country of residence. Where required by applicable law, we use appropriate safeguards for international transfers, which may include Standard Contractual Clauses (SCCs), data-processing agreements, data minimization, encryption, access controls, pseudonymization, and other technical and organizational measures.

Primary server / hosting region: Primarily the United States, with possible processing in Armenia, the European Economic Area, the United Kingdom, or other regions where our service providers operate.

International transfer mechanism details: Where required, PlancyAI relies on Standard Contractual Clauses, data-processing agreements, provider contractual terms, data minimization, encryption, access controls, pseudonymization, and other supplementary technical and organizational measures.

12. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Our current retention approach is:

Where technically feasible, an automated process may delete or de-identify certain request-body records older than 30 days. No additional retained copies are intentionally kept after deletion through this automated process, except where retention is required by law, security, backup integrity, fraud prevention, or the establishment, exercise, or defense of legal claims.

13. Account Deletion and Data Deletion Requests

If you create or maintain an account with PlancyAI, you may request deletion of your account and associated data through:

• Web deletion resource: https://plancy.ai/dashboard/profile Website > Dashboard > Profile > Delete Account
• Email request: hello@plancy.ai.

If account deletion is requested, we will take reasonable steps to delete or de-identify personal data associated with your account, subject to exceptions permitted by law and described in this Privacy Policy.

Deleting your account may result in permanent loss of access to your account, subscription status, settings, notes, transcripts, summaries, action items, reminders, exports, history, and other account-linked information.

We may retain limited information after account deletion where necessary to:

• comply with legal, tax, accounting, audit, or regulatory obligations;
• detect, prevent, or investigate fraud, abuse, security incidents, or technical problems;
• enforce our terms or protect our rights, users, systems, and Service integrity;
• complete deletion workflows and prevent accidental or malicious loss;
• maintain records of deletion requests;
• establish, exercise, or defend legal claims;
• retain data that has been irreversibly anonymized or aggregated.

Uninstalling the App from your device does not automatically delete your account or server-side data. To delete your account and associated data, you must use the deletion paths described above.

If you connected Google Sheets or another third-party service, you may also need to revoke PlancyAI's access through your Google account or the relevant third-party service settings.

14. User Controls and Permissions

Depending on your device and App version, you may control certain data processing through in-app settings and operating system permissions, including:

• microphone access;
• notification permissions;
• Google Sign-In;
• Google Sheets connection and disconnection;
• local file or folder access for exports;
• TODO extraction and reminder settings;
• search and project organization features;
• account deletion and privacy requests.

If you deny or revoke a permission, some features may stop working or work with limited functionality.

15. AI Output Reporting and Safety

PlancyAI may generate AI outputs such as summaries, structured details, action items, and suggestions. If you believe that an AI-generated output is offensive, unsafe, inaccurate, or otherwise problematic, you may report it through:

• in-app reporting path: Settings > Help & Support > Report AI Output or Contact Support;
• Help & Support: Settings > Help & Support; if a dedicated report button is not available in your App version, contact hello@plancy.ai and include the relevant note, screenshot, or description of the issue where appropriate;
• email: hello@plancy.ai.

We may use user reports to investigate issues, improve safety, refine filters, debug AI behavior, and prevent misuse.

16. Tracking, Advertising, and Profiling

PlancyAI does not use advertising SDKs for third-party behavioral advertising. PlancyAI does not use cross-app tracking for advertising purposes. PlancyAI does not use User Content for advertising personalization.

Current analytics SDK status: No third-party analytics SDK is currently used.

Current crash reporting SDK status: No third-party crash reporting SDK is currently used at launch. PlancyAI may process internal crash, error, diagnostic, and performance logs where necessary to operate, secure, troubleshoot, and improve the Service.

Current advertising SDK status: None. No advertising SDK is currently used.

If we introduce analytics, crash reporting, advertising, or tracking technologies in the future, we will update this Privacy Policy and make any required disclosures or consent flows available.

17. Background Processing

The App may perform background or foreground processing where necessary to provide user-facing features and maintain reliable operation, including:

• recording voice notes through a foreground recording service where supported;
• processing audio after recording stops;
• running transcription, summary, and TODO extraction jobs;
• sending reminders and notifications;
• exporting selected data to Google Sheets or local device storage;
• retrying failed processing jobs when connectivity or quota becomes available;
• checking backend availability and usage limits;
• maintaining widget recording state and notification state.

The exact behavior may depend on your device, operating system, permissions, battery settings, and App version.

18. Data Security

We use reasonable technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access. These measures may include:

• encryption in transit using HTTPS/TLS;
• access controls and authentication;
• separation of production and development environments where applicable;
• logging and monitoring for security and reliability;
• data minimization and limited retention for certain logs;
• restricted access to production systems;
• incident investigation procedures.

Encryption at rest status: Data is encrypted in transit using HTTPS/TLS. At-rest encryption is provided where supported by the operating system, device storage, database, hosting infrastructure, and service providers used by PlancyAI. Exported local files are controlled by you after export and may not be encrypted by PlancyAI outside the App.

Backend access control model: Role-based and least-privilege access for authorized team members and service accounts. Production access is restricted to operational, support, security, troubleshooting, and legal-compliance needs, and credentials or tokens are protected using reasonable technical and organizational measures.

Security audit / assessment status: No independent third-party security audit has been completed at launch. Internal security review, release testing, and operational monitoring are performed as part of the development and release process. A third-party assessment may be conducted in the future as the Service grows.

No method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

19. Children and Minors

PlancyAI is not directed to children and is not intended for use by individuals below the minimum age required under applicable law to use digital services or consent to personal data processing without parental or guardian authorization.

We do not knowingly collect personal data from children in violation of applicable law. If we become aware that we have collected personal data from a child or minor without required consent, we will take reasonable steps to delete such data.

Minimum age / target audience setting for Google Play: Google Play target audience: 13+. The Service is not directed to children under 13, and users below the age of digital consent in their jurisdiction may use the Service only with any required parent or legal guardian authorization.

Parents or legal guardians who believe that a child has provided personal data to us may contact us at hello@plancy.ai.

20. Your Privacy Rights

Depending on your location and applicable law, you may have rights to:

• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• request data portability, where applicable;
• withdraw consent where processing is based on consent;
• opt out of certain types of processing where applicable;
• lodge a complaint with a competent data protection authority.

To exercise your rights, contact us at hello@plancy.ai or use the privacy request mechanism available at https://plancy.ai/dashboard/profile or hello@plancy.ai.

We aim to acknowledge privacy requests within a reasonable period and respond within the timeframe required by applicable law, generally within 30 days unless a different period applies.

21. Additional Information for United States Residents

If you are a resident of a U.S. state with privacy laws that apply to PlancyAI, you may have additional rights, such as the right to know, access, correct, delete, obtain a copy of personal data, or opt out of certain processing activities.

We do not sell personal data for money. We do not share User Content for third-party behavioral advertising. If any state-specific "sale", "sharing", or targeted advertising disclosure becomes applicable, we will update this Privacy Policy and provide the required opt-out mechanisms.

U.S. state privacy law applicability assessment: PlancyAI does not currently knowingly sell personal data for money or share User Content for third-party behavioral advertising. PlancyAI will assess the applicability of U.S. state privacy laws as the Service grows and will provide any required state-specific notices, rights, or opt-out mechanisms where applicable.

22. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted at https://plancy.ai or another public privacy policy URL made available in the App and app store listing.

If we make material changes, we may provide notice through the App, website, email, or other appropriate means. Your continued use of the Service after the updated Privacy Policy becomes effective means that you acknowledge the updated Privacy Policy, to the extent permitted by applicable law.

23. Contact Information

Ilia Melnikov

App: PlancyAI

Legal Address: Armenia, Yerevan, Arabkir, Vratsakan Str., 21/1 Building, 57 Apt.

Website: https://plancy.ai

General Contact Email: hello@plancy.ai

Privacy Requests Contact: hello@plancy.ai

Data Protection Officer / EU Representative, if applicable: Not appointed at launch. Privacy requests should be sent to hello@plancy.ai unless appointment of a Data Protection Officer or EU representative becomes required by applicable law.

UK Representative, if applicable: Not appointed at launch. Privacy requests should be sent to hello@plancy.ai unless appointment of a UK representative becomes required by applicable law.