Privacy Policy

Effective 2026-10-13 · Last updated 2026-10-13

This translation is provided for convenience. If it differs from the Korean original, the Korean original prevails. Korean original

Projectteamforyou (프로젝트팀포유, “we”) runs Pladay — the website pladay.com, the web app / PWA and the Android, Windows and iOS apps built on it (the “service”). We follow the Korean Personal Information Protection Act and the EU/UK GDPR.

1. What stays on your device

Pladay is local-first. Without an account, everything stays in your browser storage on your device and is never sent to our servers. Modules you set to “This device only” never leave the device, even when you are signed in.

• With bring-your-own AI (on-device AI, local Ollama, your own API key) requests go straight from your browser to that provider; your key stays on the device.
• Voice typing that uses your browser’s speech recognition may be processed by the browser maker (e.g. Google, Apple) under their policy.
• PIN locks for sensitive modules (PBKDF2 hash), your consent records and display settings are stored on the device only.

2. What we process when you sign in

• Account: email, optional name, scrypt password hash or the sign-in provider’s ID, email, name and avatar URL (Google, Naver, Microsoft), language — to run your account (contract, GDPR Art. 6(1)(b)).
• Synced content: tasks, lists, habits, focus sessions, notes, boards and the life-module records you choose to sync; photos (re-encoded, EXIF/location removed), voice memos and videos — to sync and back up across your devices (contract).
• Security & usage: hashed session IDs, user agent, sign-in and security events (audit log), AI usage counts, a 90-day change journal for sync — legitimate interests (Art. 6(1)(f)). IP addresses are used in memory for rate limiting only and are not stored.
• Anonymous counters: a hash of a random on-device visitor ID and whether the app is installed (web/Android app), kept 2 days — to count visits and installs.
• In-app feedback (optional, also possible without an account): the text you write, a screenshot only if you pick one yourself, app version, screen size, language, current screen name, browser type and what prompted the card (e.g. 10 tasks done), plus your account ID when signed in or a hash of your IP address when not (the raw IP is not stored) — to answer you, improve the service and prevent abuse (legitimate interests).
• Paid plans (optional): see section 4.
• Optional features you switch on: calendar connections (OAuth tokens encrypted with AES-256-GCM), public share links, capture webhooks and what you send through them, connected apps (Google Drive, Slack, Notion …) — contract / consent.
• Calendar read-in (Pro, optional): the ICS/webcal address you paste is stored encrypted (AES-256-GCM); our server fetches that calendar and caches its events for 10 minutes to show them next to your tasks. Remove the address at any time to stop it.
• Goals, savings goals, gifts & occasions ledger, gratitude journal, time-capsule letters: ordinary records you type yourself; they sync when you are signed in unless set to “This device only”. The gifts ledger holds names and amounts you enter about other people — used only to keep your record, never to contact anyone, advertise or profile. A time capsule’s “seal” is an in-app lock, not encryption. Savings goals are not connected to any bank account.
• Routines, bills, job hunt, school timetable, pantry, watchlist, debt payoff, party planner, home inventory and weekly meal plan: ordinary records you type yourself (for example bill amounts and due dates, companies you applied to, guest names, loan balances, things you own and where they are). They sync when you are signed in unless set to “This device only”, and their due dates can become to-dos. Receipt photos in the inventory stay on your device. The document vault (passport, licence, insurance and warranty expiry dates, photos and PDFs) is device-only by default, never sent to AI or integrations, and never asks for document numbers.
• Attachments and growth records: photos, videos and voice clips you attach to notes, tasks, diary pages and module records are kept as your photo / video / voice memos (or, in private and device-only modules, with that record only). Like other media they stay on your device and are uploaded to our storage only when you are signed in and the module syncs, counting toward your plan's storage. An attachment is a link between your own records; public links to a note or task never include attached media. Pet growth records (weight, size, milestones, photos and videos) are ordinary records.
• Feature requests and votes (optional, sign-in required): the title and details you post, which module it is for, your votes and the time — to collect and prioritise ideas, show their status and our reply, and prevent abuse (legitimate interests, GDPR 6(1)(f)). Requests are public but shown as “Member”: your name, e-mail and account ID are never shown to other people; only you see that a request is yours. Questions: projectteamforyou@gmail.com.
• Brainstorming and Plan & build (specs, backlog, roadmap, sprints, business canvas, user research, decision log, launch checklists): ordinary records you type yourself. They sync when you are signed in unless set to “This device only”, and dates (milestones, reviews, launch items, interviews) can become to-dos. Research notes may describe interview participants — we recommend codes instead of names and asking for their consent; Pladay processes them only to show them to you. When you tap “Suggest ideas”, only the session question, technique and the ideas on the board are sent to the AI engine you chose.
• PDF archive: when you tap “Save as PDF” or import a file, we store the PDF, a preview image of its first page, its title, source (a link to the original record), page count and size, and the document's text so you can search it. PDFs are made on your own device and never sent to a server for conversion. Like other files they are kept on your device and, when you are signed in, uploaded to our storage to sync between your devices, counting toward your plan's storage. PDFs made from sensitive, private or device-only records, and PDFs over 8 MB, stay on this device only. “Open in AllofPDF” only downloads the file or hands it to your device's share sheet; Pladay sends nothing to AllofPDF.
• File to PDF conversion: the default conversion runs entirely on your device — the file is never uploaded. Only when you choose “High-fidelity conversion (server)” (paid plans) is that file sent to Pladay’s own conversion server (Railway, US). It is processed in memory, deleted as soon as the conversion finishes and never stored, backed up or used for AI training; we keep no file name or content, only how many conversions you made this month (legal basis: performance of the contract).

We do not sell personal data, build advertising profiles or use third-party ad trackers. In-app house ads are counted only as totals (impressions and clicks).

3. Sensitive data (health, menstrual cycle, sex life, medical records)

Cycle and contraception, intimacy, medical records (visits, prescriptions, test results, vaccinations, family history), blood-pressure and blood-glucose logs and the alcohol, smoking, anxiety, therapy and sobriety trackers may be sensitive data. We handle them as follows:

• Separate explicit consent on first use (GDPR Art. 9(2)(a)); if you decline, only that module is unavailable.
• Device-only by default; a module syncs to our servers (USA) only after a second confirmation for that module. Turning sync off deletes the server copy.
• Never used for automatic AI briefings, pattern insights, search, the day story, share cards or note archives. Only when you ask that module’s AI co-pilot yourself is your question and a summary sent to the AI engine you picked.
• Withdraw anytime in Settings → Privacy & sensitive data: sync is switched off for every sensitive module and server copies are erased.
• General wellness logs (steps, sleep, weight, meals, water, workouts, medication) sync when you are signed in unless you set the module to “This device only”. Step counting (motion sensor) and Bluetooth heart-rate straps are processed on the device only.
• Pladay is not a medical device and does not diagnose or treat anything.
• The baby log a parent keeps about their child (feeds, sleep, diapers, growth) and the symptom log with its trigger tags are handled like sensitive data: device-only by default, excluded from automatic AI context, insights, search and integrations; the next-feed reminder appears as a blank “Pladay” notification.
• The quit tracker (smoking, drinking and other habits you are quitting, cravings) and emergency info (emergency contacts, blood type, allergies, conditions, medicines read from the medication module, insurance, home and pet details) are handled as sensitive data: separate consent on first use, device-only by default, excluded from automatic AI context, insights, search and integrations; emergency info can be locked with a PIN and is shown, printed or saved as an image only on your device. Pladay gives no medical advice.
• Children's growth records (height, weight, head circumference, developmental milestones and the photos and videos you attach to them) are part of the baby log and handled as sensitive data: device-only by default — their photos and videos included —, WHO growth percentiles are calculated on your device and never sent anywhere, excluded from automatic AI context, insights, search and integrations, and sharing or exporting the growth album asks you first.

3a. Family sharing

Family sharing is optional. A Pro user can create a family and invite up to 5 more people by a link or by e-mail. Joining is free.

• What other members see: your display name, role (owner, admin, member, child), avatar colour and join date. The owner and admins also see your e-mail address, so they can manage invitations.
• What is shared: only shared lists, the to-dos in them (title, notes, dates, who it is for, who added and completed it) and shared birthdays/anniversaries, plus a feed of the latest changes (the newest 300 are kept). Reminders and “My Day” pins on a shared to-do stay personal.
• What can never be shared: your personal lists and every other module. Health, cycle, sex-life, medical, baby-log, money and diary records cannot enter the family space — our server refuses them and the database rejects them as well.
• Invitations: a link works once and expires after 7 days; we store only a hash of its secret. For an e-mail invitation we send the invitee’s address to our mail processor (Resend) to deliver it, and it can only be accepted by an account that has verified that address. Nothing is shared with the invitee until they accept.
• Leaving, removal and deletion: when you leave or are removed, access ends at once and the shared data is erased from your devices. When the owner deletes the family, all shared data is deleted from our servers (encrypted backups roll off as described in “How long we keep data”). If the owner deletes their account, the family passes to the longest-standing adult member; with no adult left it is deleted. Family events are written to our security log with hashed user IDs.
• Legal basis: performance of the contract (GDPR 6(1)(b)); for an invitee’s e-mail address, the inviter’s and our legitimate interest in delivering the invitation (GDPR 6(1)(f)).
• The “child” role only limits what a member can change; the rules in “Children” still apply to every account.
• Questions about family sharing: projectteamforyou@gmail.com.

4. Payments

If you buy Pladay Pro, the payment is handled by a payment processor; we never see or store full card numbers.

• Korean-card period passes (PortOne · NHN KCP) — one-time card payments with no billing key. We keep the order, amount, pass period, payment and refund status, and the time Pro features were first used after the payment (to apply the 7-day withdrawal rule).
• PortOne (Korea Portone Corp.) and its partner card processors — card payments and recurring billing in Korea. We keep the subscription, amount, date, status, card brand and last digits, and an encrypted billing key so renewals can be charged.
• PayPal — payments from other countries. We keep the PayPal subscription ID, amount, date and status.
• Google Play (Google LLC) — purchases made inside the Pladay app installed from Google Play. Google processes the payment under its own privacy policy; we receive the purchase token, order ID, product, subscription state and expiry to unlock Pro.
• Purchase records are kept for 5 years and complaint/dispute records for 3 years as required by the Korean E-Commerce Act.
• Student price: we e-mail a one-time code to the school address you enter and keep only a SHA-256 hash of that address and the verification expiry (one year); the address itself is not stored.

5. Processors and international transfers

These providers process data for us. Most are in the United States; transfers happen over encrypted connections (TLS) when you use the service and rely on our controller–processor agreements and, for EU/UK users, the providers’ Standard Contractual Clauses or Data Privacy Framework commitments. If you do not want any transfer, use Pladay without an account and with on-device AI — signed-in sync cannot work without these servers.

When you push a task to a calendar you connected (Google, Microsoft, Naver) or create a public share link, data goes only where you direct it. Public links can be revoked at any time.

6. How long we keep data

• Account, synced content and files: deleted immediately when you delete your account (Settings → Account → Delete account).
• Email sign-ups that were never verified and hold no data: deleted after 14 days.
• Sessions: 30 days after last use (90 days at most). Change journal: 90 days. AI usage counts: 30 days.
• Security audit log (event type, time, pseudonymous user ID): 1 year; for deleted accounts only a hash of the user ID is kept.
• Anonymous visit counters: visitor hash 2 days (only the totals are kept).
• Password-reset links: valid 30 minutes; verification links: 48 hours; deleted when used or 1 day after expiry.
• Encrypted database backups: daily 30 days, monthly 12 months (including the encrypted copies e-mailed to our operations mailbox, deleted on the same schedule). Data of a deleted account can remain in these encrypted backups for that period (at most 12 months), is used only for disaster recovery, and accounts known to have been deleted are deleted again if a backup is ever restored.
• In-app feedback: screenshots 180 days, text and context 2 years; feedback from an account is deleted with the account.
• Paid-service records: 5 years (contracts, withdrawals, payments) and 3 years (complaints, disputes) under the Korean E-Commerce Act.
• Data on your device: until you delete it or clear your browser data (we cannot access it).
• Feature requests and votes: while the service runs. When you delete your account, your votes are deleted and your requests stay without any link to you (others voted on them); write to us to have a request removed.

7. Your rights

You can access, correct, delete, restrict or object to the processing of your data, withdraw consent and take your data with you (portability):

• In the app: Settings → Data → Export (JSON, CSV, Markdown, ZIP); edit or delete anything; Settings → Account → Delete account (immediate and permanent); Settings → Privacy & sensitive data → Withdraw consent; switch sync off per module.
• By e-mail: write to projectteamforyou@gmail.com. We verify your identity and answer within 10 days. A legal representative or someone you authorise can ask on your behalf (with a power of attorney).
• EU/UK users may complain to their data protection authority. Korean users can contact the bodies listed in the Korean version (e.g. Personal Information Infringement Report Center, 118).
• We make no automated decisions with legal effect; AI results are suggestions you review.

8. Children

Accounts are for people aged 14 or older (the Korean age of digital consent). If your country sets a higher age, you need a parent’s or guardian’s consent. If we learn that we hold data of a child under 14, we delete it. When a parent records a child’s name, birth date, feeds, sleep or growth in the baby log, it stays on the parent’s device by default and reaches our servers only if the parent turns on sync for that module.

9. Cookies and device storage

• Strictly necessary cookies only: __Host-ordo_sid (sign-in session, HttpOnly, Secure, up to 30 days) and ordo_lang (language, 1 year); ordo_ref (30 days) only when you open an invite link.
• No advertising or tracking cookies. Cloudflare Web Analytics counts visits without cookies.
• App data and settings live in IndexedDB and localStorage; clearing site data removes them from the device (synced data stays in your account).

10. Location

Device location (GPS) is requested only when you start an activity recording (running, cycling, hiking) yourself, and only while the recording screen is on. Routes stay on your device by default; only summaries such as distance and time sync to your other devices. If you turn on “route sync”, routes are stored in your account over an encrypted connection — turn it off or delete the activity at any time to remove them from our servers. We never use location for ads or analytics or share it with third parties. Photos are re-encoded before saving, which removes EXIF location data. Places you type yourself (a trip, a clinic name) are ordinary records.

11. Security

• TLS everywhere (HSTS) and a strict Content Security Policy.
• scrypt password hashes; sessions and tokens stored only as hashes; OAuth tokens and billing keys encrypted with AES-256-GCM.
• Files reachable only through short-lived signed URLs; database backups encrypted with AES-256-GCM (the key is never sent with them).
• Least-privilege admin access with an audit log, sign-in rate limits, dependency security checks.

12. Contact and privacy officer

Controller: Projectteamforyou (프로젝트팀포유), Republic of Korea · Business registration 495-25-02209 · 1166-68 Yebong-ro, Sangun-myeon, Bonghwa-gun, Gyeongsangbuk-do.

Privacy officer: 이유상 (CEO) · projectteamforyou@gmail.com · +82 70-7620-7256.

13. Changes

This policy is effective from 2026-10-13. We announce changes in the app 7 days in advance (30 days for important changes that affect you negatively). This translation is provided for convenience; if it differs from the Korean original, the Korean original prevails.