Privacy Policy

Planless ("the Service") is operated by Forgepath Software Development Services ("we", "our", or "us").

This policy explains how we collect, use, store, and share information when you use the Planless website or the Planless mobile app.

The same Planless account and this policy apply to the website and the mobile app. Deleting the account in one place deletes it in the other.

The website lets you plan trips, save itineraries, and manage an account in the browser.

The mobile app uses that same account for trip sync, maps and transit lookups, weather, push alerts, and store purchases.

We may collect the following information:

Turning that toggle off, or clearing the fields, deletes the stored preference fields.

Those entries are saved to your Planless account so they are still there if you reinstall the app.

The website does not ask for your phone or computer location.

Planless does not use a product analytics tool, and we do not build a profile of the pages or features you use.

Card numbers are entered on the Lemon Squeezy or PayMongo page, and Planless does not store the full card number.

In the app you can sign in with Apple (iPhone) or Google. On the website you can sign in with email and password or Google.

Email and password. On the website you can create an account with an email address and a password. We store that sign-in and send the confirmation and password-reset messages. We do not keep a separate copy of your password.

Google. When you sign in with Google, we receive the email address on that Google account, plus the name and picture Google shares. Your Google password stays with Google.

Apple. When you use Sign in with Apple on an iPhone, Apple can provide an email address, which may be a private relay address, and a name. Your Apple password stays with Apple.

Trip planning uses the places you enter. We turn those places into map coordinates and ask map and routing providers for routes, nearby places, photos, and transit.

The mobile app can send coordinates for directions, transit, nearby search, and weather. During a live trip it can also send latitude and longitude with the notification registration so we can choose weather and crowd alerts.

Coordinates and place queries can be sent to:

A place or activity name can also be sent to YouTube when the website looks up a travel video.

The mobile app can register a Firebase Cloud Messaging token on the account. That registration includes the token, whether the phone is iOS or Android, the alert switches, and any live-trip context described above.

That token is sent to Firebase Cloud Messaging to deliver weather and crowd alerts the account has turned on.

You can turn the alerts off in the app. Deleting the account deletes the notification registration immediately.

The website does not ask to send browser notifications.

We use information to:

If the GDPR or UK GDPR applies to your use of Planless, the bases below are the ones this policy relies on.

We rely on these bases:

You can turn saved travel preferences off on the account page, and you can turn push alerts off from the app. You can also email support to withdraw that consent or to object to processing that relies on legitimate interests.

Supabase provides authentication, the database, and profile-photo storage. It holds the account email, sign-in, profile, trips, preferences, budgets, plan records, notification tokens, and photos you upload.

Vercel hosts the website and the API. Its request logs can include an IP address and the path that was requested.

Groq, Google Gemini, Together AI, and OpenRouter generate itinerary text. They receive the trip prompt, including destinations, dates, party size, budget, interests, and dietary notes. That prompt is the trip content.

Google Maps Platform turns places into map coordinates and returns places, directions, photos, and some translation of route text.

HERE returns mobile transit routes for the coordinates the app sends.

Mapbox returns mobile walking, driving, and cycling directions for the coordinates the app sends.

NAVITIME returns Japan transit routes for the coordinates the app sends.

Open-Meteo returns a weather forecast for a latitude and longitude. The weather request sends the coordinates.

Purchases in the app are processed by Google Play and the Apple App Store, and on the web by Lemon Squeezy and PayMongo, each under their own policies.

Lemon Squeezy and PayMongo take card details on their own payment pages. We keep the customer or subscription id, plan, and payment status they send us. We do not store the full card number.

Firebase Cloud Messaging, a Google service, delivers mobile push alerts using the device token.

Brevo sends the subscription confirmation email. That message can include the recipient name, email address, plan, billing interval, and subscription end date. Supabase sends the separate sign-up confirmation and password-reset messages.

Featurebase supplies the changelog widget on the website. We do not send your account email to Featurebase.

YouTube receives a place or activity name when the website looks up a travel video.

When hotel links are shown, Travelpayouts receives the destination, travel dates, and how many people are traveling.

Stay22 and Travelpayouts can change hotel and activity links on the website.

Klook partner links are created for some activities. The request is used to build an outbound activity link.

We do not sell personal information.

We share information with the processors named in this policy so they can perform the service described for each of them.

We also share information with public authorities when the law requires it.

Your account, trips, preferences, budgets, purchase records, notification settings, and profile photo are deleted right away when the account is deleted.

Optional travel preferences are also deleted when you turn "Remember my travel preferences" off or clear those fields.

Cached trip text expires within 24 hours.

Anti-abuse counters are kept for up to 30 days.

Hosting logs are kept by our host for a limited period.

Payment records are kept by Lemon Squeezy, PayMongo, Google Play, and Apple for as long as tax law requires. Our own copy is deleted with the account.

You can delete your account from the website or from the Planless app. The website and the app use the same login. Deleting your account in one place also deletes it in the other.

On the website:

In the Planless app:

The same steps, and what is deleted, are on Delete your account.

If you cannot use the website or the app, email support@planless-travel.online and ask us to delete the account. Include the email address on the account. We will delete your account within 7 days and reply to confirm.

Deleting your account does not cancel a Google Play or App Store subscription. Cancel it in the store.

If your website plan renews by card through Lemon Squeezy, cancel it from Manage billing on your account page before you delete. Deleting your account does not stop that renewal. PayMongo website plans are renewed by you, so they do not charge you again on their own after the account is gone.

You may:

Anything that is not shown on the account page, including a copy of the whole account, is handled by email to support. The product can export an itinerary file, and it does not offer one download that contains every category of account data.

If Philippine data privacy law applies, you can complain to the National Privacy Commission. If the GDPR or UK GDPR applies, you can complain to the data protection authority where you live.

Planless isn't intended for children under 13 (or 16 where local law requires a higher age). If we learn an account belongs to a child, we delete it.

A trip can include how many children ages 2 and older are traveling with you. That count can be saved in optional travel preferences. The form asks for the count, not a child's name, email address, or separate account.

If you believe a child created a Planless account, email support@planless-travel.online and ask us to delete it.

Supabase signs you in and stores your account so you can see your own information. Vercel hosts the site and serves it over HTTPS.

No method of transmission or storage is completely secure.

Our service providers may process data outside the Philippines, including in the United States. We use providers that offer standard data protection terms for international transfers.

The Service links out to hotels, activities, maps, and other third-party sites. Those sites apply their own privacy practices.

The website uses essential cookies to keep you signed in. Those cookies are set when you sign in and are removed when you sign out.

When hotel links are shown, we may use Travelpayouts for travel links. A travel link can include the destination, travel dates, and how many people are traveling. The website loads a Stay22 script from scripts.stay22.com and a Travelpayouts script from emrld.ltd. Those scripts can set their own cookies and can change some hotel and activity links on the website. The Planless app does not load them.

We may update this Privacy Policy from time to time. The date at the top of this page is the latest revision. Continued use of the Service after an update is acceptance of the revised policy.

For privacy requests, contact our privacy contact at support@planless-travel.online.

Forgepath Software Development Services

Email: support@planless-travel.online