Who we are
POplanner is run by Damn Square LLC, a company registered in Wyoming, United States. Damn Square LLC decides what happens to the personal data described here. For anything about this page, write to hi@poplanner.app.
We are the controller for the data on this website and for your account. For the business data your company imports into POplanner, such as items, stock, sales and customers, your company is the controller and we process it on your company's behalf. A data processing agreement is available on request.
What we keep and why
| Data | Why | How long |
|---|---|---|
| Your email address, and your name and company if you give them | To create your account and send your sign-in codes. Legal basis: the agreement with your company. | While the account is open, deleted within 30 days after it is closed |
| Sign-in codes | To check that you own the email address. We store a keyed hash of the code, never the code itself. | Until the code is used or expires, within minutes |
| One sign-in cookie | To keep you signed in. It is strictly necessary, so it needs no consent. | Until you close the browser, or the period you chose: 1 to 30 days |
| Work you save to your account: plans, decisions, notes, PO tracker, workspace name and logo, and the figures from the imports you save | So you see the same plan on every device. | While the account is open, deleted within 30 days after it is closed |
| Walkthrough requests: name, work email, company and ERP | To answer your request. Legal basis: your request. | 12 months, unless your company becomes a customer |
| Emails you send to hi@poplanner.app | To answer you. | 24 months |
| Your IP address | To stop abuse of the sign-in form, by counting attempts. | One hour |
Your ERP export is opened and calculated in your own browser. Only what you choose to save to your account is stored with us. We never sell data, never use it for advertising, and never use your company's figures to train AI models.
Your browser also keeps your light or dark setting and an offline copy of your work in local storage. That copy stays on your computer and is removed when you sign out or clear your browser data.
Cookies and tracking
POplanner uses one cookie, the sign-in cookie above. There are no advertising cookies, no analytics and no tracking pixels.
Who helps us run POplanner
We use a small number of service providers for hosting, data storage and sending email. They process data only on our instructions and only to provide their service to us, under a data processing agreement. Some of them are based in the United States. Where personal data from the EU is transferred there, it is protected by the EU-US Data Privacy Framework or the EU standard contractual clauses. We don't sell personal data and don't share it with anyone for advertising.
Security
- Encryption. Every connection uses HTTPS (TLS). Stored data is encrypted at rest.
- No passwords. You sign in with a 6-digit one-time code sent to your email. A code works once, for 10 minutes, and is cancelled after 5 wrong tries. We store only an HMAC-SHA-256 hash of it, never the code itself.
- Rate limits. One code per minute and five per hour for each address, and at most 30 code requests and 20 wrong codes per hour from one network address. The sign-in form gives the same answer for every address, so it can't be used to find out who has an account.
- Sessions. Your session is a signed cookie marked HttpOnly, Secure and SameSite, so scripts can't read it and it is only sent over HTTPS. It ends when you close the browser (at most 3 hours), or after the period you chose, up to 30 days. The server enforces the end date.
- Strict browser rules. A Content Security Policy lets pages run only our own code: no third-party scripts, trackers or ads. Other sites can't embed POplanner in a frame.
- Separate storage. Each person's saved work is stored separately and is only returned to that person when signed in. Removing someone from your team signs them out everywhere. The planner code itself is only sent to signed-in users.
Your rights
You can ask to see, correct, export or delete your personal data, and you can object to or limit how we use it. Write to hi@poplanner.app and we answer within one month. If you are not satisfied with our answer, you can complain to the data protection authority in the country where you live or work.
Changes
When this page changes, we update the date at the top. Customers hear about important changes by email before they take effect.