Privacy

Last updated 25 August 2026.

ontoplano holds a diary, your notes, your goals and the record of your days. That is why this page is specific rather than a template: what you keep here is the sort of thing you would not want read.

What is stored

• Your email address and name, because an account needs a way to be signed in to.
• A hash of your password. Not the password.
• Everything you write: blocks, tasks, goals, diary entries, notebooks, people, habits, ideas, shopping, quotes, and the numbers any plugin you connect pushes in.
• A short history of what happened to your account — signing in, changing a password, exporting, a plan change. You can see the same list an administrator can.
• The address you connected from, alongside those events, for as long as they are kept.
• When you last used the app, to within a few minutes, so whoever runs this instance can see which accounts are in use.

Where it is stored

In one SQLite database on the server that runs this instance. Backups are replicated to object storage.

Who can see it

The person running this instance can, technically — it is their database. There is no way to sign in as your account: the administration pages list accounts and coarse events like a registration or a plan change, and nothing of what you wrote. Nobody else has access.

There is no analytics, no advertising, no third-party script, and nothing is sold to anyone.

Who else is involved

• Mail. Confirmation and password-reset messages go out through an SMTP server this instance is configured with. It sees your address and the text of those messages.
• Payment.If you subscribe, handles the transaction as merchant of record. They see your billing details; this instance never does, and stores only the identifiers it needs to know your subscription is alive.
• Plugins. Anything you connect with an API token sees exactly the scopes you gave that token, and nothing else. You can revoke one at any time from Settings → Integrations.

Taking it with you, and getting rid of it

Settings → Account exports everything as one JSON file, and deletes the account. Deletion is immediate and complete: every row belonging to the account, including its history, in one transaction. There is no thirty-day grace period during which it is still there.

Backups are the exception, and the honest caveat: a snapshot taken before you deleted still contains what you deleted until it rotates out, which happens within 30 days.

Cookies

One, called better-auth.session_token, which is what keeps you signed in. It is not shared, not read by anyone else, and there is nothing to consent to because there is nothing else being done with it. No tracking cookies means no cookie banner.

Asking about any of this

Write to contact@ontoplano.com. It is read by a person.