Privacy Policy
Last updated: November 10, 2026
0. Data Controller
Shamsheer Syed
Auerstr. 2, 65929 Frankfurt am Main, Germany
Email: plantowin.de@gmail.com
Shamsheer Syed is the data controller responsible for your personal data. See also the Imprint.
1. Introduction
Plan to Win ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our productivity and task management productivity platform ("the Service"). Please read this policy carefully.
We process your personal data only where we have a valid legal basis under the GDPR (Art. 6). Using the Service does not in itself constitute consent to data processing — specific consents are obtained through clear, affirmative action (checkboxes, cookie banner).
2. Data Collection Summary
| Category | Type of Data | Required? | Can User Delete? |
|---|---|---|---|
| Account Data | Email, password hash, name | Yes (contractual) | Yes — account deletion removes within 30 days |
| Tasks & Content | Task names, progress, notes | Yes (contractual) | Yes — immediately on request |
| Analytics | Anonymous usage metrics | Optional (consent) | Yes — aggregated, no personal data retained |
| Marketing emails | Email address | Optional (consent) | Yes — on unsubscribe or consent withdrawal |
| Cookies / Local Storage | Auth tokens, preferences, security flags | Essential required; others optional | Yes — via cookie settings |
3. Information We Collect
3.1 Personal Information You Provide
We collect information that you voluntarily provide when you:
- Register for an account: Name, email address, password
- Complete your profile: Productivity goals, timezone, preferences
- Send a voluntary contribution (optional): The payment itself happens with your bank or PayPal; we do not receive or store your card or bank login details
- Contact us: Name, email, message content
- Use Google OAuth: Name, email, profile picture from Google
3.2 Productivity Data
As you use the Service, we automatically collect:
- Task data: Tasks created, descriptions, due dates, completion status
- Project data: Project names, collaborative spaces, shared lists
- Focus data: Focus session duration, breaks taken, audio preferences
- Habit data: Habits tracked, streaks, consistency metrics
- Journal entries: Content of your reflection journals (encrypted)
- Finance data: Income and expense entries (if using Finance Tracker)
3.3 Usage Data
We automatically collect information about how you interact with the Service:
- Device information: Browser type, operating system, device type
- Log data: IP address, access times, pages viewed, referrer URL
- Cookies and tracking: Session cookies, authentication tokens, preferences
- Feature usage: Which features you use, how often, for how long
4. Legal Basis for Processing (GDPR Art. 6)
We process your data based on the following legal grounds:
- Contractual necessity: To provide the Service, operate your account, and fulfill our terms of service.
- Legitimate interest: For security, fraud prevention, service improvements, and analyzing usage trends to make our product better.
- Consent: For optional features such as marketing emails, non-essential cookies, and push notifications. You can withdraw this consent at any time.
- Legal obligation: Where required for compliance with applicable laws (e.g., tax records, law enforcement requests).
5. How We Use Your Information
We use the information we collect for the following purposes:
5.1 To Provide and Improve the Service
- Create and maintain your account
- Sync your tasks and projects across devices
- Track your productivity progress and insights
- Allow personalization based on user settings and tracked progress (not automated decision-making)
- Improve and optimize our application performance
5.2 To Communicate With You
- Send task reminders and notifications (if enabled)
- Notify you of project updates and team activity
- Send account updates and security alerts
- Respond to your support requests and inquiries
- Send marketing communications (with your consent, unsubscribe anytime)
5.3 To Ensure Security and Prevent Fraud
- Authenticate your identity and prevent unauthorized access
- Detect and prevent fraudulent activity
- Monitor for security vulnerabilities
- Enforce our Terms of Service
6. Data Storage and Security
6.1 How We Protect Your Data
We implement industry-standard security measures to protect your information:
- Encryption in transit: All data transmitted using HTTPS/TLS encryption
- Password security: Passwords hashed using bcrypt with salt rounds
- Secure cookies: Authentication tokens stored in HttpOnly, Secure cookies
- Database security: Hosted on secure cloud infrastructure (Supabase)
- Access controls: Role-based access to data and features
- Regular updates: Security patches applied promptly
- Monitoring: 24/7 security monitoring and incident response
6.2 Where We Store Your Data
Your data is stored on secure servers within the European Union to comply with GDPR requirements. We use Supabase (hosted on AWS in EU regions) for database storage and Vercel (with EU edge locations) for frontend hosting.
6.3 Data Retention
We retain your data for as long as:
- Your account is active
- Necessary to provide the Service
- Required by law (e.g., tax records for 7 years)
- 90 days after account deletion (in case you wish to reactivate)
After 90 days of account deletion, your personal data is permanently removed from our systems. Anonymous, aggregated data may be retained indefinitely for statistical purposes.
7. Your Rights Under GDPR
If you are a resident of the European Economic Area (EEA), you have the following data protection rights:
🔠Right to Access
Request a copy of all personal data we hold about you. We'll provide this in a structured, machine-readable format (JSON/CSV) within 30 days.
âœï¸ Right to Rectification
Correct any inaccurate or incomplete personal data. You can update most information directly in your account settings.
ðŸ—‘ï¸ Right to Erasure ("Right to be Forgotten")
Request deletion of your personal data. We will comply unless we have a legal obligation to retain it. You can delete your account from account settings.
📦 Right to Data Portability
Receive your data in a portable format (JSON/CSV) and transfer it to another service. Available from account settings → Export Data.
â›” Right to Object
Object to processing of your personal data for direct marketing purposes. You can unsubscribe from marketing emails or adjust notification preferences anytime.
To exercise any of these rights:
- Delete your account and everything in it: how to delete your account
- Email us at: plantowin.de@gmail.com
- Use account settings for most data management tasks
- Data Protection Officer: plantowin.de@gmail.com
We will respond within 30 days (extendable by 2 months for complex requests, with notice). If we cannot fulfil your request, we will explain why in writing.
âš ï¸ Right to Lodge a Complaint with a Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority at any time (GDPR Art. 77), without prejudice to any other administrative or judicial remedy. In Germany the lead authority is:
Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)
Husarenstraße 30, 53117 Bonn, Germany
Web: www.bfdi.bund.de
EU residents may also contact their local authority. Full list: edpb.europa.eu.
9. Third-Party Service Providers
We may share your data with trusted third-party processors solely to operate the Service. All providers comply with GDPR and use contractual Data Processing Agreements (DPA).
Supabase (EU Region)
Purpose: Database, authentication, user data storage
Privacy policy: Supabase Privacy Policy
Vercel
Purpose: App hosting and performance delivery
Privacy policy: Vercel Privacy Policy
Google OAuth (Optional)
Purpose: Sign-in verification
Privacy policy: Google Privacy Policy
Google Cloud (Cloud Run)
Purpose: Running the application server (API)
Privacy policy: Google Cloud Privacy Notice
Email delivery provider
Purpose: Sending one-time codes, verification links and reminder emails. Only the recipient address and the message itself are passed on; messages are not used for advertising.
10. Data Sharing and Disclosure
We do NOT sell, rent, or trade your personal data, and we never use it for advertising or for profiling for advertising. There are no ads in the Service, and we do not pass your data to anyone for their own purposes. We share data only in these limited circumstances:
- ✓With your consent: When you explicitly authorize us to share data
- ✓Service providers: Third parties who help us operate the Service (as listed above)
- ✓Legal requirements: When required by law, court order, or government request
- ✓Business transfers: In case of merger, acquisition, or sale of assets (users will be notified)
11. Children's Privacy
The Service is not intended for children under 13 (or under 16 in the EU depending on local laws). We do not knowingly collect data from minors. If a parent believes a child has created an account, please contact us to delete it at plantowin.de@gmail.com.
If we discover we have collected personal information from a child without parental consent, we will take steps to delete that information as quickly as possible.
12. International Data Transfers
Your data is primarily stored and processed within the European Union. If we transfer data outside the EU, we ensure appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs) approved by the EU Commission
- Adequacy decisions recognizing equivalent data protection laws
- Binding Corporate Rules for multinational service providers
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify you of any material changes by:
- Posting the updated policy on this page
- Updating the "Last updated" date at the top
- Sending you an email notification (for significant changes)
We will notify you by email of any material changes at least 30 days before they take effect. Continued use of the Service after that date constitutes acceptance only of changes that do not require fresh consent. Where new consent is needed, we will ask you explicitly.
14. Data Breach Notification
In the unlikely event of a data breach that affects your personal information, we will:
- Notify affected users within 72 hours (as required by GDPR)
- Describe the nature of the breach and data affected
- Explain steps we're taking to address the breach
- Report to relevant data protection authorities as required
15. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Shamsheer Syed
Auerstr. 2, 65929 Frankfurt am Main, Germany
Email: plantowin.de@gmail.com
Privacy requests (access, correction, deletion, objection) go to this address. See also the Imprint.
This policy describes how Plan to Win processes your personal data. We rely on the legal bases set out in Section 4. Consent-based processing (analytics, marketing) requires an explicit, freely-given action and can be withdrawn at any time without affecting prior lawful processing.