Privacy Policy

In effect from 2026-10-09

1. Who is responsible

PlanBoxes, run by an individual, is responsible for your personal data. For any privacy question or request: support.planboxes@gmail.com.

2. What we collect

Account data: email address, display name, password (stored only as a hash, from which it cannot be recovered), language, and, if you sign in with Google, the identifier Google gives us.
Author profile: what you choose to publish, such as name, photo, description and links. It is public.
Content you create: plans, images, reviews, replies and messages you send through the Service.
Purchases and subscription: what you bought or subscribed to, amounts, dates and payment status. Card details are handled by the payment provider and never reach us.
Referral data: your referral link, earnings, the link you registered through (if any), and, when you request a withdrawal, the payout method, details and Telegram contact you enter.
Usage data: events such as viewing a plan, saving it, opening the pricing page or paying. They are linked to your account when you are signed in. We do not store IP addresses, browser strings or referrer addresses in these events; we keep only a coarse device type (mobile or desktop).
Technical data: your IP address is used briefly to rate-limit requests and prevent abuse, and in server logs. Error reports are sent to a monitoring service that is configured not to collect personal data by default.
Correspondence: messages you send us at support.planboxes@gmail.com.

3. Why we use it and on what basis

To provide the Service, sign you in, deliver your purchases and process subscriptions (performance of a contract).
To send service messages: email verification, receipts, subscription notices, security and account messages (performance of a contract).
To keep the Service safe, prevent fraud and abuse, enforce our terms and moderate content (legitimate interests, and legal obligations where they apply).
To understand how the Service is used and improve it, with the limited analytics described above (legitimate interests).
To pay referral earnings and keep financial records (performance of a contract, legal obligations).
To respond to you (legitimate interests).

We do not sell your personal data, and we do not use it for advertising.

4. Who receives your data

We use service providers who process data on our behalf. Depending on what you use, they include:

Lava.top: payments for subscriptions, generation packs and, for authors who connect it, plan sales.
Resend: sending emails.
Cloudflare R2: storing uploaded files and backups.
Our hosting provider: the servers that run the Service.
Google: sign-in with Google and, if enabled, machine translation.
AI and translation providers: Google (Gemini), Groq, Mistral, OpenAI, Black Forest Labs and DeepL, as enabled. They receive the text or prompts needed for generation or translation, not your account details.
Sentry: error monitoring.
Telegram: internal notices to our administrators about operations and events, such as a payment, a report or a withdrawal request.

Your public profile, plans and reviews are visible to anyone. If you buy a plan, the author sees the sale but not your email. Authors may choose to publish contact links; contacting them is your choice.

We may disclose data if the law requires it or to protect rights and safety.

5. International transfers

Our providers may process data in other countries than yours. Where the law requires it, we use safeguards such as standard contract terms or the provider’s equivalent commitments.

6. How long we keep it

Account and content: until you delete your account. After you request deletion there is a waiting period of 30 days that you can cancel; then your data is erased.
Sign-in sessions: 30 days.
Usage events: about 180 days; anonymous daily totals are kept.
Data export files: 72 hours.
Payout details: about 90 days after a withdrawal is settled.
Backups: up to 30 days, after which deleted data disappears from them as well.
Some records are kept without your identity, for example payment events and the cost of AI generations, so that our accounts stay correct. Reviews you left on others’ plans and purchase records are kept without your name.
Where the law requires us to keep records, we keep them for as long as it requires.

7. Your rights

Depending on where you live, you may have the right to see the data we hold about you, correct it, delete it, limit or object to how we use it, get a copy in a portable format, and withdraw your consent where we rely on it.

Download your data: in your account, request a data export.
Delete your account and data: in your account settings.
Anything else, or if the tools do not work: write to support.planboxes@gmail.com.

You can also complain to your local data protection authority.

8. Security

Passwords are stored only as hashes, connections use HTTPS, and access to data is limited. No system is perfectly secure, so we cannot promise absolute security. If a breach affects you, we will tell you as the law requires.

9. Children

The Service is not for people under 16. If we learn that we hold data of a child under 16, we delete it.

10. Cookies

See the Cookie Policy.

11. Changes

We may update this policy. The current version and its date are on this page; for material changes we will notify you by email or in the Service.