Privacy Policy

Planwell is a personal life tracking app for iPhone, built and operated by Sumletter. For anything in this policy, including access and deletion requests, write to ai@sumletter.com. For people in the EEA and the UK, Sumletter is the data controller for the data described here.

Your account. Registration is optional. If you tap Get started, the app creates a guest account, and the only thing we hold about you is a random account identifier. No email, no name, no password.

If you create an account, or later turn a guest account into one, we also hold your email address and a password (stored hashed by our auth provider, never in plain text, and never visible to us), or the account identifier and email Apple or Google share with us when you use Sign in with Apple or Google. You can add an optional display name.

The things you track. Whatever you put into the mini apps you switch on: weight, sleep, mood, water, meals and recipes, workouts, habits and streaks, countdowns, checklists, watchlist, books, job applications, house listings, trips, subscriptions, expenses, and any custom metrics you create, together with the notes and dates attached to them. You choose which mini apps exist for you, and you can turn any of them off at any time.

Apple Health, only if you allow it. Steps, walking and running distance, and sleep analysis. We read these, we never write anything back to Apple Health. Read the Apple Health section for what happens to them afterwards.

Voice and photos. If you dictate an entry, we record that audio and send it away to be turned into text. If you attach a photo (a menu, a receipt, a recipe, a diet plan), the image is sent to the AI so it can read it. Neither the audio nor the photo is stored on our servers.

Analytics and crash reports. Errors the app hits and crash diagnostics from iOS, so we can tell whether a bug is hitting one person or everyone. If you say yes when the app asks, also which screens and features you use, with an approximate location (country and city) that PostHog works out from your connection's IP address. The IP address itself is not stored. Both carry a random account ID, never your email address or name. They are not used for advertising and are not shared with ad networks.

Purchases. If you subscribe, Apple handles the payment. We only learn whether your subscription is active. We never see your card details.

We do not collect your precise (GPS) location, your contacts, or your device identifiers for advertising, and the app does not ask to track you across other companies' apps and websites.

To run the app and give you the features you asked for (performance of our contract with you). To keep the service working and fix what breaks, using crash and error reports (our legitimate interest in a product that does not fall over). Usage analytics runs on your consent, which you can withdraw at any time under Profile, then Data & privacy. To answer your questions in the AI assistant (your request, and our contract with you). Apple Health access and microphone access run on your explicit consent, given through the iOS permission prompt, and you can withdraw either one at any time in iOS Settings.

We do not use your data to train any AI model, ours or anyone else's.

The assistant is useful because it can see what you have tracked. So when you send it a message, we send Anthropic (the company behind Claude) your message plus the slice of your data that is relevant to it: recent entries from the mini apps you have enabled, including any steps, distance and sleep synced from Apple Health, plus any photo you attached. The same applies to the quick add bar, where the AI reads what you typed, dictated or photographed and turns it into an entry.

Anthropic processes this to produce the reply and hands it back. Anthropic does not use it to train their models. Your chat history itself is kept on your phone, not on our servers.

The assistant is not a doctor, a dietitian, a lawyer, or a financial adviser, and it is sometimes wrong. Do not treat what it says as professional advice.

If you grant Health access, Planwell reads your steps, your walking and running distance, and your sleep analysis, and saves a daily summary of them into your Planwell account so your dashboard, your sleep log and the AI assistant can use them. That means this health data leaves your device and is stored with the rest of your account data, and is included in the context sent to Anthropic when you use the assistant.

Health data is never used for advertising or marketing, never used for data mining beyond showing you your own numbers, never sold, and never shared with anyone other than the processors listed below who are working on our behalf to run the app. Planwell does not write anything back into Apple Health.

You can revoke Health access at any time in iOS Settings, under Privacy and Security, Health, Planwell. That stops any new data from coming in. To remove what was already synced, ask us to delete your data.

On Android the same rules apply to Health Connect: Planwell reads only steps, distance and sleep, and only if you allow it. If you also allow reading in the background, the Steps widget on your home screen reads today's steps and distance while Planwell is closed. Those widget reads stay on your phone. You can revoke either in the Health Connect app, under App permissions, Planwell.

We keep this list short on purpose. These companies process data on our instructions, to run the app. None of them may use it for their own purposes.

• Supabase

  Ireland, EU

  Hosts your account and every entry you make, and runs our server side functions. Access is enforced per row, so a request signed in as you can only ever read your rows.

• Anthropic

  United States

  Runs the AI assistant, quick add, and the extraction that reads your photos. Receives your message plus the relevant slice of your tracked data. Does not train on it.

• ElevenLabs

  United States

  Turns your voice recordings into text when you dictate. Receives the audio, returns the transcript.

• PostHog

  Germany, EU

  Error and crash reporting, and product analytics with an approximate location (country and city) if you agree to it. Receives a random account ID, never your email address or name. Your IP address is used for the location lookup and is not stored. No advertising, no ad network sharing.

• Apple

  Per Apple's own policy

  App Store distribution and subscription payments. Apple tells us whether your subscription is active.

• TMDB, OMDb, Open Library, Firecrawl

  United States and EU

  Look up public metadata: a film or show you added, a book you are reading, or a job posting or house listing whose link you pasted. They receive that title or that link, not your account or anything else you track.

Some of these are outside the EEA and the UK. Where that is the case, the transfer relies on the provider's standard contractual clauses or an equivalent safeguard.

Every processor above is bound by a written agreement requiring it to provide the same or equal protection of your data as this policy promises: to process it only on our instructions and only for the purpose listed, never to sell it, never to use it for advertising, and never to train AI models on it.

We may also disclose data if the law genuinely requires it, or to protect someone's safety. If Planwell is ever sold or merged, your data would move with it, and we would tell you before that happens.

Data is encrypted in transit and encrypted at rest by our hosting provider, and every table is protected by row level security so one account cannot read another. No system is perfect, and we are a small team, so we would rather say that plainly than promise you something unbreakable.

We keep your data for as long as your account exists. When you delete your account in the app, your account and your entries are removed straight away. If you ask us by email instead, we remove them within 30 days. Encrypted backup copies age out on the normal backup rotation after that. Analytics and crash events are kept for up to 12 months, and deleting your account in the app deletes them too.

Guest data is never linked to an email address or a name. If you sign out of a guest account without creating an account, you can no longer reach that data, so delete the account in the app first if you want it gone. If you ask us to delete guest data later, we will, as long as you can tell us enough to find it.

You can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask for it in a portable format, or object to us processing it. Email ai@sumletter.com (from the address on your account, if you have registered) and we will handle it within 30 days, free of charge.

If you are in the EEA or the UK, you also have the right to complain to your local data protection authority. If you are in California, we do not sell or share your personal information as those terms are defined under the CCPA, and we do not discriminate against you for exercising your rights.

In the app, go to Profile, then Delete account. You can also find it on the subscription screen. It permanently deletes your account and everything stored under it, and it works the same for guest and registered accounts. There is no hoop to jump through and we will not try to talk you out of it.

Deleting your account does not cancel an Apple subscription. Cancel that in Settings, your Apple Account, Subscriptions.

If you cannot get into the app, email ai@sumletter.comfrom your account's email address and we will delete your account and everything stored under it within 30 days.

Planwell is not built for or directed at children under 13, and we do not knowingly collect their data. If you believe a child has an account, email ai@sumletter.com and we will delete it.

If we change something meaningful, we will update the date at the top and, for anything significant, tell you in the app. Carrying on using Planwell after that means the updated policy applies.

Questions, requests, or anything in this policy that reads wrong to you: ai@sumletter.com. A real person answers.