Privacy Policy

Last updated: August 28, 2026

DriftPlan is an offline-first planner. The short version: your plans live on your device; an optional account syncs them to our servers; we don't run ads, don't sell data, and don't use third-party analytics trackers.

Data on your device

Without an account, everything you put into DriftPlan — events, tasks, projects, goals, notes, settings — is stored only on your device. We have no access to it. Deleting the app (or using its data-clearing options) removes it.

Data in your account (optional)

Creating an account enables sync, sharing, and backups. Accounts are provided through Firebase Authentication and Cloud Firestore, services of Google LLC; synced data is stored on Google Cloud infrastructure. With an account, we store:

• Account details — your email address, a display name, and an optional avatar photo.
• Your planning data — the events, tasks, projects, goals, calendars, chapters, templates, and (if enabled) local weather history records that you sync.

Your email must be verified before sync and sharing activate.

What other users can see

• Your display name, avatar, and email are visible to signed-in users so collaborators can find you by email. You can restrict who may invite you (Settings → Sharing privacy).
• Shared content is visible to the people you share it with, including tasks attached to a shared project's goals.
• Published template links are public — anyone with the link can view and copy them, along with your display name.

Connected calendars (optional)

You can subscribe DriftPlan to external calendars: Google Calendar, Outlook (Microsoft), or any iCal (.ics) URL. Connections are read-only — DriftPlan fetches your events and never writes to, edits, or deletes anything in the external calendar.

• What we access: the events of the specific calendars you pick (titles, times, locations, descriptions), fetched periodically to keep them current.
• Where it goes: imported events are stored on your device like any other event. If you're signed in, they sync to your account like the rest of your planning data.
• Credentials: in the app builds, the Google/Microsoft access tokens live only on your device and are never synced. In the web app, the connection tokens are kept server-side (the browser can't hold them safely) and are used solely to fetch your calendar data; .ics URLs you subscribe to in the web app are fetched through our server on your behalf.
• Disconnecting: remove a connected calendar in Settings → Calendars at any time, which discards its stored credentials; deleting your account also removes any server-held calendar credentials. You can additionally revoke DriftPlan's access from your Google or Microsoft account settings.

DriftPlan's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: Google Calendar data is used only to show your events inside DriftPlan, is never used for advertising, is never sold or transferred except as necessary to provide the feature or as required by law, is not used to develop or improve generalized AI/ML models, and is not read by humans except in the narrow cases listed under How we protect your data.

How we protect your data

These safeguards apply to everything DriftPlan handles, and specifically to sensitive data such as your Google Calendar and Outlook calendar content and the OAuth credentials that grant access to it.

• Encryption in transit. All traffic between the app, our servers, and third-party APIs (Google, Microsoft, Firebase) uses HTTPS/TLS. OAuth authorization codes and tokens are exchanged over TLS directly with the provider's endpoints.
• Encryption at rest. Account data and any server-held credentials live in Google Cloud Firestore, which encrypts stored data at rest (AES-256) by default. On your device, data is held in the app's private storage area, protected by your operating system's app sandboxing and by device/disk encryption where you have it enabled.
• Least-privilege scopes. DriftPlan requests read-only calendar scopes only — https://www.googleapis.com/auth/calendar.readonly for Google and Calendars.Read for Microsoft. It cannot create, modify, or delete anything in your calendar account, and it reads only the calendars you explicitly select.
• Credential isolation. In the desktop and mobile builds, calendar tokens never leave your device and are never synced. Where our server holds them (the web app), they are stored in per-user collections that our database security rules deny to every client (allow read, write: if false); they are reachable only by our backend calendar service running in Google Cloud Functions, and are never sent to a browser. Pending-consent records are single-use and expire after 10 minutes.
• Authenticated, per-user isolation. Every request to our backend must carry a Firebase ID token that is verified server-side, and each account can only reach data stored under its own user id. Sync and sharing activate only after your email address is verified.
• Secret management. OAuth client secrets and server API keys are held in Google Secret Manager and injected at runtime — never shipped in the app, committed to our source repository, or exposed to client code.
• Data minimization. We fetch only the calendar fields needed to show your events (titles, times, locations, descriptions) for the calendars you picked. Calendar data is not copied into any analytics pipeline, advertising system, or secondary store, and is not used to train machine-learning or AI models.
• Restricted human access. Administrative access to production systems is limited to DriftPlan's operator, through accounts protected by multi-factor authentication, and is used only for maintenance, security, or to fix a fault you report. We do not allow humans to read your Google user data unless (a) we have your affirmative consent for specific data, (b) it is necessary for security purposes such as investigating abuse, (c) it is required to comply with applicable law, or (d) the data is aggregated and anonymized for internal operations.
• Revocation and deletion. Disconnecting a calendar discards its stored credentials; deleting your account purges all server-held calendar credentials and polling state. You can also revoke DriftPlan's access at any time from your Google or Microsoft account security settings.
• Vendors. The processors we rely on — Google (Firebase, Cloud Firestore, Cloud Functions, Secret Manager, Cloud Messaging), Sentry, Resend, and Open-Meteo — receive only the data described in this policy and maintain their own security programs.
• Incident response. If we become aware of a breach affecting your data, we will revoke affected credentials and notify affected users and the relevant authorities without undue delay.

Weather (optional)

If you enable the weather feature, the app sends coordinates (from your device's location, with your permission, or a place you type) to Open-Meteo (api.open-meteo.com) to fetch forecasts. If you're signed in, your local weather history records sync to your account like other planning data.

Push notifications (optional)

If you turn on push notifications in the web app (including when installed to your home screen), a push registration token for that browser is stored in your account, and your upcoming reminders (event/task names and times) are queued in your account so they can be delivered while the app is closed. Delivery goes through Firebase Cloud Messaging (Google) and your browser's push service. Turning the toggle off (or signing out on that device) removes that device's registration; deleting your account removes all of it.

Crash reporting

Builds may include Sentry crash reporting. Crash reports contain technical details (device model, OS version, stack traces) — not your planning data.

Emails

We send account emails (verification links, password resets) and — when you invite someone to a shared plan or event by email — a one-time invitation email to the address you enter, delivered through Resend (resend.com), an email service provider. Recipient addresses are used only to deliver that invitation. No marketing email.

Retention and deletion

Synced data is kept until you delete it or delete your account. You can delete your account in the app (Settings → Delete account, at the bottom of the settings page), which permanently removes your account, profile, planning data, shares you own, and published template links from our servers. Two residuals: content you contributed into someone else's shared project belongs to that share, and records caught mid-sync during deletion may persist briefly in an unreadable state.

Local data stays yours: account deletion optionally keeps your plans on the device as a signed-out app.

What we don't do

• No advertising, and no data sold or rented to anyone.
• No third-party analytics or tracking SDKs.
• No reading of your planning data for any purpose other than providing sync and sharing.

Children

DriftPlan is not directed at children under 13, and we don't knowingly collect data from them.

Changes

We'll post any changes to this policy at the same address with an updated date. Material changes will be announced in the app.

Contact

Questions or requests (access, correction, deletion): support@driftplan.app

See also the Terms of Service.