Your space stays yours.

Positive Planner is operated by Growth Experts Pty Ltd (ABN 61 698 216 401, ACN 698 216 401). Positive Planner is intended for people aged 13 and over. This policy explains how we handle your account and planner information.

Planner and account data

Your account, tasks, habits, onboarding answers, preferences, companion progress, reward history and subscription status are stored in our dedicated Neon database. The application and API run on Vercel. Your device keeps an offline copy of planner data so you can continue working without a connection.

Clerk handles sign-in and account security. Authentication processes device/browser details, IP addresses and approximate location derived from IP addresses to protect sign-ins and identify unfamiliar devices. This does not request GPS access.

Walking is optional

When you enable walking in the installed app, Positive Planner requests read access to steps through Apple HealthKit or Android Health Connect. It reads aggregated daily totals, not raw health histories. Daily totals and earned milestones are synchronized to your account. Walking totals are shown in the installed apps; earned XP contributes to your account's Pip progress across devices. We do not request access to heart rate, sleep, location or other health measurements. Declining step access does not stop you using the planner.

Private reflections and activities

Journal text is encrypted on our server with a separate application key. This is not end-to-end encryption: the service decrypts entries when you open or export them. Offline journal drafts are encrypted on the device. General planner caches contain tasks, habits, mood choices, optional tags and activity metadata; protect your device with a screen lock.

Mood choices, journal tags and activity history stay within your account. They are not shared with friends or sent to AI. Soundscapes use bundled original audio and never record your microphone. Widget storage contains an account binding, Pip level, remaining-item count and freshness time. Optional reminders use generic text rather than private task titles.

Friends are your choice

Social features require explicit opt-in and a chosen public name. Mutual friends see that profile, Pip, curated encouragement and only goals you explicitly share. Your journal, mood, email and questionnaire answers remain private. You can unshare, remove, mute, block or report a connection. Reports are retained for moderation. Removing access takes effect on the next authorized refresh.

Optional device notifications

When available, remote Friends notifications require your explicit choice and device permission. A device registration token is sent to our API and Apple or Google for delivery. Tokens are encrypted on our server; installation proof is kept in protected native storage. Notification payloads use generic text and an opaque event reference, without friend names, email, task content or journal entries. Opening one checks your current account before showing Friends. You can turn these off in Settings, remove a registered device, or revoke permission in device settings. Already-queued generic alerts may still arrive while removal completes. Daily and task reminders are separate.

Calendars are optional

Google and Microsoft connections are separate from signing in. The app imports events from calendars you select and creates a dedicated calendar for task time blocks. Calendar tokens are encrypted on the server. The app does not send invitations or change meeting attendees.

Payments and sign-in

Web payments are processed by Stripe. Installed-app subscriptions use Apple or Google billing through RevenueCat. Positive Planner stores entitlement status, not payment-card details. Clerk handles account sign-in, sessions, email verification and password recovery. Google and Apple sign-in share the profile information you approve with Clerk.

Your controls

You can disconnect calendars, revoke health permissions in your phone settings, export your planner, and request account deletion from Settings. Readable journal export is a separate explicit action. Manual backups restore only to their original account and do not copy subscriptions, rewards or another person’s data. Cancellation retains Plus until the paid period ends, then your account continues on Free with unlimited tasks, three active habits, Pip, cloud sync and offline use. Other habits and their history are preserved and paused. Deleting an app account does not replace managing an Apple or Google subscription through the store.

Retention and deletion

We keep account information while providing the service. Deletion may take time while connected services are disconnected. Limited deletion markers and processing records are retained to prevent delayed provider events from recreating a deleted account. Payment providers may retain their own transaction records. The limited retained records contain account identifiers, deletion/cleanup timestamps and status, and webhook-processing identifiers; they do not contain planner or journal content and currently have no automatic expiry. Deleting your planner account does not automatically cancel an Apple or Google subscription; cancel store renewal before requesting deletion. If cleanup is pending, account data remains until cleanup succeeds.

You can request deletion without reinstalling the app: email ray@rayguden.com. We verify account ownership before deletion. See all deletion steps and retained data. Exports, manual backups and copies on other devices are not remotely erased. Support emails are separate from the app database; tell us if you also want that correspondence reviewed for deletion.

Service providers and overseas processing

We use Clerk for sign-in, Vercel and Neon to run the service and store account data, Stripe for web payments, and RevenueCat with Apple or Google for installed-app subscriptions. These providers may process information outside Australia, including in the United States and India, and in other countries where they and their subprocessors operate. Optional calendar and notification services receive the information needed to provide the features you enable.

Provider information: Clerk, Vercel, Neon, Stripe and RevenueCat.

Measurement

Journal text, mood choices, questionnaire answers, health values and sensitive calendar content are excluded from product analytics. Health data is not sold or used for advertising.

Campaign measurement on the website and Android starts automatically where permitted. Existing opt-outs are preserved. Where permission is required, measurement remains off until you allow it. We also respect Global Privacy Control signals. When enabled, Google and Meta receive limited installation, registration, app activity and subscription events, permitted installation or campaign identifiers, and basic browser or app details. Advertising scripts run only on public marketing, signup and checkout pages. They do not run inside your planner. Generic Android installation and app-open events can be recorded before sign-in. You can turn measurement off in Settings → Data & account, or open the Privacy choices page without signing in. Withdrawal stops new optional measurement on this device; an offline account update is retried when you reconnect. Requests already in progress may finish. Withdrawal does not erase events already delivered.

On iPhone, restricted app analytics is on by default when available and can be turned off in Settings. Firebase receives generic app events and a Firebase app-instance identifier, without your account ID, email, Apple's Identifier for Vendors (IDFV), or an advertising identifier. Signed-out app-open and usage events can be recorded before sign-in; this choice applies to your installation. In supported app versions, Meta also receives app-open and verified free-trial events, its own installation identifier, and basic app, device and network information for restricted campaign measurement. We do not send Meta your account ID, email, planner content or health data. We do not request Apple's tracking permission or collect its advertising identifier; Meta receives the device's actual tracking-permission status. Turning app analytics off stops the app from recording new optional events with either provider. Events recorded before you turned it off may still finish uploading or retry. When available, we receive Apple's privacy-preserving advertising reports. We keep limited details such as the ad network, download type and any conversion signal Apple provides, along with a receipt marker to prevent duplicate counting. We use these records for campaign reporting and store them separately from account data. When enabled, Apple Ads attribution can also associate an Apple campaign with subscription activity in RevenueCat. Essential subscription billing uses RevenueCat's own customer and transaction identifiers separately from this optional measurement choice. No planner text or health data is used for advertising measurement.

RevenueCat and Stripe verify subscription payments. Free trials, collected payments, renewals and refunds are recorded separately. Advertising identifiers in completed delivery records are cleared after 30 days, and inactive installation and checkout attribution is cleared after 90 days. Financial records, consent choices and duplicate-processing markers are retained separately. Google and Meta process permitted measurement data under their own policies: Google privacy policy and Meta privacy policy.

Contact

To ask for access to or correction of your information, or to make a privacy complaint, email ray@rayguden.com. Tell us which account and request you need help with; do not email passwords or payment-card details. You can also export planner data or request account deletion in Settings.

Positive Planner is a general planning and wellbeing app, not a medical device. It does not diagnose, treat, cure or prevent medical conditions. Consult a qualified healthcare professional for medical advice, diagnosis or treatment.