Privacy policy

The controller responsible for data processing at plan.bar (www.plan.bar) is:

Sebastian Ortmann
Brahmsweg 16
71111 Waldenbuch
Germany

Email: datenschutz@plan.bar
Phone: +49 172 5809168

No data protection officer has been appointed, as there is no legal obligation to do so.

plan.bar is a web app for planning events together. We only process personal data as far as necessary to run the app, keep it secure and finance it. The database, files and server functions are located in Frankfurt am Main (EU). We do not use tracking cookies; audience measurement works without cookies.

Depending on the processing, the legal bases under the GDPR are:

• Art. 6(1)(b) – performance of the user relationship (contract)
• Art. 6(1)(f) – legitimate interests (security, troubleshooting, statistics)
• Art. 6(1)(a) – consent (push notifications, personalised advertising)
• Art. 6(1)(c) – legal obligation (e.g. retention, answering requests)

The app is hosted by Vercel Inc. (USA); the server functions run in Frankfurt. Database, login, file storage and real-time updates are provided by Supabase Inc. (USA) with a data centre in Frankfurt. Both are bound by contract as processors (Art. 28 GDPR).

Each request involves technically necessary data: IP address, time, requested address, browser and device information. To prevent abuse, we count requests per IP address (rate limiting); we delete these entries after one day. The legal basis is Art. 6(1)(f) GDPR (secure and stable operation). The providers' logs are deleted according to their retention periods.

For an account we process your email address, password (stored only as a hash), display name, username, optionally a profile picture, and login times. This data is required to use plan.bar (Art. 6(1)(b) GDPR) and is stored until you delete your account. You can delete your account and data yourself at any time under More → Account, where you can also export all your data as a file.

Instead of email and password you can also sign in with Google (Google Ireland Limited) or Facebook (Meta Platforms Ireland Limited). plan.bar then redirects you to the provider and, after you agree, the provider sends us your email address, your name, where applicable your profile picture and an identifier of your account. In this case we do not store a password. The provider learns that you are signing in to plan.bar; its privacy policy applies (policies.google.com/privacy, facebook.com/privacy/policy). The legal basis is Art. 6(1)(b) GDPR. The link ends when you delete your account; you can also remove access at any time in your Google or Facebook account.

Via an event link you can view an event without an account. For this we create an anonymous session and store your participation with the role “guest” (Art. 6(1)(b) GDPR). We automatically delete anonymous guest accesses 90 days after their last use.

With “Start for free” you can also try plan.bar without an account and plan an event of your own (test mode). For this, too, we create an anonymous session without an email address (Art. 6(1)(b) GDPR). If you create an account, we move your test event into it. Otherwise we automatically delete the session and its event 7 days after it started.

Everything you enter in an event (e.g. description, dates and date polls, tasks, packing list, costs, polls, chat messages, location, photos and videos) is stored so that the event can be provided to all participants (Art. 6(1)(b) GDPR). Only the participants of the respective event can see this content. Photos and videos are kept in private storage and can only be accessed via short-lived, signed links.

If you enter data about other people or upload photos showing others, please make sure you are allowed to do so. We process this data on the basis of our and your legitimate interest in organising the event together (Art. 6(1)(f) GDPR). Data subjects can contact us at any time.

Content is deleted when you remove it, when the organiser deletes the event, or when the organiser's account is deleted.

In the location module we use Geoapify GmbH (Germany) for address search and map tiles based on OpenStreetMap. The search term as well as your IP address and browser information are transmitted to Geoapify. Geoapify is bound as a processor. The legal basis is Art. 6(1)(b) GDPR.

In the app we inform you about new entries, messages and assignments in your events (Art. 6(1)(b) GDPR). You only receive push notifications if you allow them in your browser (Art. 6(1)(a) GDPR). For this we store a push subscription (your browser's endpoint and keys). Push notifications are delivered via your browser vendor's service (e.g. Google, Apple, Mozilla), which may process the content of the notification and your IP address. You can turn off push at any time under More → Account or in your browser settings; the subscription is then deleted.

For confirmation, password and invitation emails we use an email service provider as a processor. Your email address and the content of the message are processed (Art. 6(1)(b) GDPR). If you write to us, we process your request in order to answer it (Art. 6(1)(b), (c) or (f) GDPR).

For login, registration, password reset, joining events and test mode we use Cloudflare Turnstile by Cloudflare, Inc. (USA) to prevent automated access. Turnstile runs invisibly in the background. Cloudflare processes your IP address, TLS characteristics and your browser's user agent solely to detect bots, not for profiling or advertising. The legal basis is Art. 6(1)(f) GDPR (protecting accounts and the service). Details: Turnstile Privacy Addendum

In addition, we count how many visitors reach each step of registration (e.g. "form submitted", "account created"), together with the browser type (such as the Instagram in-app browser), the referring site and the utm values from the address (e.g. utm_campaign) that show which campaign you came from. The same applies to purchases. We do not store your IP address, email, user ID or click ids such as fbclid in this count, and we store nothing on your device for it. The legal basis is Art. 6(1)(f) GDPR (improving registration and evaluating our campaigns). We delete these counts after 180 days.

To understand which pages are used, we use Vercel Web Analytics. It records the page visited, referrer, device type, browser and country. No cookies are set; the IP address is only used as a hash that changes daily, so you cannot be recognised across several days. The legal basis is Art. 6(1)(f) GDPR (improving the service).

To detect and fix technical errors we use Sentry by Functional Software, Inc. (USA) with storage in the EU. When an error occurs, the error message, technical trace, browser, device and affected page are transmitted, and for some requests also loading times. IP addresses are not stored and no screen recordings are made. The legal basis is Art. 6(1)(f) GDPR.

On the free plan we finance plan.bar through advertising from Google AdSense (Google Ireland Limited, Ireland; Google LLC, USA). Google acts as an independent controller; Google's controller-to-controller data protection terms for advertising apply.

You can change or withdraw your choice at any time under More → Privacy → Consents. Users with a Pro subscription, Event Pass or Fest Pass see no ads. Google's privacy information: policies.google.com/privacy

When you arrive through a plan.bar ad on Facebook or Instagram, Meta adds a click id (fbclid) to the address. Only then do we ask whether we may measure the ad's results. Without your consent we store nothing on your device for this and send nothing to Meta. We then only store your choice itself (cookie pb_ad_consent, 12 months).

If you agree, we keep the campaign parameters from the address (utm_source, utm_medium, utm_campaign, utm_content, utm_term and fbclid) in the pb_attr cookie (90 days, read only by plan.bar) and in your browser's session storage. When you then start test mode, create an account or buy Pro, an Event Pass or a Fest Pass, our server sends an event to Meta's Conversions API. It contains the kind of event (test start, registration, or a purchase with amount and currency), the time, the plan.bar page address, a hash of your email address when we have one, a hash of your user id, IP address, browser identifier and the click id. To report a purchase we keep your IP address and browser identifier from the start of checkout and delete them once the purchase is reported. We do not report subscription renewals. We do not load a script from Meta, and we do not show Meta ads on plan.bar itself.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time here or under More → Privacy → Consents. We then delete the pb_attr cookie and send nothing further. Events already sent are not affected.

We and Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, are joint controllers for collecting and transmitting this data to Meta (Art. 26 GDPR), based on Meta's controller addendum (facebook.com/legal/controller_addendum). Under it, Meta provides you with the essential information and handles your rights towards Meta, but you can also contact us. What Meta does with the data afterwards is Meta's sole responsibility. Meta may transfer data to the USA; Meta is certified under the EU-US Data Privacy Framework. Meta's information: facebook.com/privacy/policy

Paid plans (Pro subscription, Event Pass, Fest Pass) are sold by Paddle.com Market Limited (United Kingdom) as reseller (“Merchant of Record”). Paddle processes your name, email address, payment and billing data under its own responsibility; we only receive the customer and subscription ID, the plan booked, its status and term (Art. 6(1)(b) GDPR). An adequacy decision of the European Commission exists for the United Kingdom. Privacy information: paddle.com/legal/privacy

Without consent we only store what is technically required (§ 25(2) no. 2 TDDDG):

• Supabase login cookies so that you stay logged in
• Session data for guest access (session storage, ends when you close the tab)
• Settings in local storage, e.g. recently opened sections, contacts already seen, and whether you have dismissed the push notification hint

This includes your choice on ad measurement (cookie pb_ad_consent). We only set the pb_attr cookie with campaign parameters with your consent (see no. 14). Google only sets cookies for personalised advertising with your consent (see no. 13).

Vercel, Supabase, Cloudflare, Sentry, Google and Meta are companies based in the USA or with a parent company there. Even if data is stored in the EU, access from the USA cannot be ruled out. Transfers are based on the adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

• Account data and your own content: until you delete it or delete your account
• Event content: until the entry or event is deleted
• Anonymous guest accesses: 90 days after last use
• Test mode without an account: 7 days after starting, including the test event
• Campaign cookie pb_attr (only with consent): 90 days or until you withdraw; session storage until you close the tab
• Your choice on ad measurement (pb_ad_consent): 12 months
• IP address and browser identifier for reporting a purchase to Meta: until the purchase is reported
• Registration-step and purchase counts including utm values: 180 days
• utm values on the account (only collected with consent): until the account is deleted
• Rate-limit entries: 1 day
• Push subscriptions: until deactivated or after repeated delivery failures
• Requests by email: until resolved, unless a retention obligation applies

You have the right to

• access your data (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)

To do so, contact datenschutz@plan.bar. You can also export and delete your data directly under More → Account.

You can also lodge a complaint with a data protection supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

The information for your account and events is needed to use plan.bar. Without it we cannot provide the service. We do not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR.

We update this privacy policy when the service or the legal situation changes. The version published here applies.