At Planify, protecting your personal data is a priority. This page transparently details how your data is processed across every feature: collaborative projects, tasks and kanban boards, calendar, notes, friend system, real-time notifications, activity log and mini cloud file storage.
Upon registration: first name, last name, email address, username and password (bcrypt-hashed, 12 rounds — never stored or logged in plain text). A unique collaborator ID is generated automatically for your account.
Profile data: optional avatar, bio, language and theme preferences.
Invitations and memberships: project concerned, offered role (Owner, Admin, Member, Viewer), recipient, status and invitation expiry date.
Notifications: event type, title, message and technical metadata (for example the related project or task identifier).
Activity log: action type, author, related project or task, timestamp and metadata describing the change.
Calendar events: title, description, dates, colour and optionally associated project.
Collaboration relations: collaborator ID, collaboration requests sent/received and status (pending, accepted, declined).
Mini cloud files: original name, MIME type, size, folder, random storage name (UUID) and uploader identifier.
Avatar: the cropped image is stored in the database as a base64 string (5 MB max), not as a separate file.
Technical data: IP address, browser type (User-Agent), operating system and application logs, kept for security and diagnostics (see section 6).
Anti-abuse fingerprint: a SHA-256 hash of your IP address and User-Agent is recorded on uploads, alongside the raw IP address, to detect multi-account storage abuse (see section 5).
Authentication tokens: issued refresh tokens are stored in the database to allow revocation, then purged on expiry (7 days).
No payment data, precise location, advertising identifier or sensitive data within the meaning of the GDPR (health, origin, political or religious opinions, sexual orientation, biometric data) is requested. Please do not enter such information in your content.
How We Use Your Data
2
Provide, operate and improve Planify's features (projects, tasks, calendar, notes, files, dashboards, search).
Authenticate your identity, maintain your session and secure your account.
Manage roles, permissions and invitations within projects.
Display content only to authorised people (project members, accepted collaborators, invitation recipient).
Send notifications related to your projects and collaborations, in-app and in real time.
Enable real-time communication via WebSocket between project members.
Maintain an activity log for traceability of actions within projects.
Prevent fraud and abuse: storage quotas, rate limiting, technical fingerprint, blocking of abusive uploads.
Diagnose errors and technical incidents through application logs.
Comply with our legal obligations and respond to requests to exercise your rights.
We never sell or rent your data to third parties and never use it for advertising purposes.
No automated decision-making or profiling producing legal effects concerning you is carried out based on your data.
Collaborative Features
3
Planify is a project management tool: the content you create (projects, kanban boards, tasks, checklists, labels, milestones, comments, notes, emoji reactions, calendar events) is stored on the server to be displayed to the members of the relevant project.
Each project enforces roles: Owner, Admin, Member (create and edit) and Viewer (read-only). Access controls are verified server-side on every request.
Project invitations are addressed to a specific person: the recipient is identified by search or collaborator ID, the invitation expires after 7 days and is visible only to the sender and the recipient.
The activity log records actions performed within a project (create, update, delete, member additions, uploads…) with their author and timestamp; it can be viewed by project members (see section 12).
Dashboards display statistics computed on the fly from your data (tasks per status, progress, deadlines). No data is sent to an external analytics tool.
Global search only covers projects and tasks you have access to and runs server-side.
The collaborator network is optional: it lets you find other users via a collaborator ID and see their public information (first name, username, avatar) once the request is accepted.
No project content is public: all application pages (except the landing page, login, registration and this policy) require authentication.
If you are invited to a project, you can leave it or decline an invitation at any time; contributions you already created remain attached to the project, unless your account is deleted (see section 7).
Per-Project Mini Cloud
4
Each Planify project has a dedicated storage space (mini cloud) to centralise your team's files.
You can upload documents, images, archives, audio/video files and code files — up to 500 MB per file. Only MIME types allowed by the server are accepted.
Storage is limited to 5 GB per project and 10 GB per user account across all projects; these quotas are checked server-side on every upload.
Files can be organised into hierarchical folders and subfolders. Each file keeps its original name, size, MIME type, uploader and folder.
Only project members (Owner, Admin, Member) can upload; Viewers can only browse and download.
Files are stored on the same private server as the database, outside any public directory, under a random UUID filename.
Every download requires authentication and a project access check — no file is reachable through a public or shareable URL without being logged in.
Deleted files are permanently removed from the server; no recycle bin is kept. Deleting a project or your account also deletes the corresponding files.
No automatic antivirus scan is performed on uploaded files: only upload files whose origin you trust.
Anti-Abuse & Multi-Account Protection
5
To ensure a fair service, we compute a technical fingerprint from your IP address and User-Agent.
The fingerprint is stored as a non-reversible SHA-256 hash. The raw IP address is also stored in the same table, solely for this security purpose (it is not used for advertising profiles).
We track the total volume uploaded per fingerprint to detect storage abuse across multiple accounts from the same device.
Beyond 10 GB uploaded per fingerprint (matching the per-account quota), uploads are automatically blocked for that device.
This measure only applies to uploads; browsing, reading and downloading are not affected.
In case of unjustified blocking (shared IP, corporate proxy…), contact us at contact@infoblue.fr for manual unblocking.
This data is never shared with third parties and is used only to prevent abuse. You may request its deletion (see “Your Rights”).
Storage & Security
6
Your data is stored in a SQLite database and a files directory on a private server (VPS) operated by Infoblue. Access is restricted to the application processes and the server administrator.
The server disk is not encrypted at the application level: confidentiality relies on system access control (accounts, file permissions, firewall) and on encryption in transit.
Passwords are hashed with bcrypt (12 rounds) — they are never stored or logged in plain text.
Browser ↔ server communications are encrypted in transit via HTTPS/TLS (Let's Encrypt certificates, HTTP to HTTPS redirect).
Access tokens expire after 15 minutes; refresh tokens after 7 days and are rotated on each use. The frontend also logs the session out after 8 hours of inactivity.
We apply rate limiting on sensitive endpoints (login, registration, refresh) to prevent brute-force attacks.
Mini cloud files are stored outside any public directory, under a random UUID filename — the original name is never exposed in the download URL.
Each upload is protected by a dual software lock (per-project and per-user) to ensure quotas cannot be exceeded even under simultaneous uploads across multiple projects.
A quota of 5 GB per project and 10 GB per account is strictly enforced server-side, regardless of the client.
Application logs are kept for 14 days (access) and 30 days (errors), then deleted automatically.
Your Rights (GDPR)
7
Right of access: you can view your personal data at any time from your account settings.
Right of rectification: you can edit your personal information (name, email, bio, avatar, language, theme…) in settings.
Right to erasure: deleting your account (button in settings, `DELETE /api/users/me`) immediately removes your account, the projects and tasks you created and their associated content (tasks, comments, checklists, milestones, files, activity log); your assigned tasks are unassigned, and your tokens, notifications, invitations and collaborations are cascade-deleted.
Right to portability: you can download a JSON export of your data from settings (`GET /api/users/me/export-data`): profile, projects you belong to (with milestones, labels and members), tasks you created or are assigned (with checklists and labels), notes, calendar events and accepted collaborators.
Right to restriction: you can ask us to temporarily suspend processing of your data, for example while a rectification request is being reviewed.
Right to object: you can object to the processing of your data for purposes other than providing the service.
Right to withdraw consent: where processing is based on your consent (for example the collaborator network), you can withdraw it at any time without affecting prior processing.
Post-mortem directives: you may define instructions regarding the retention, deletion and disclosure of your data after your death (article 85 of the French Data Protection Act).
Right to lodge a complaint: you may contact the competent supervisory authority (CNIL in France — www.cnil.fr).
To exercise these rights, contact us at the address below; we respond within 30 days. Identity verification may be requested in case of reasonable doubt.
Cookies & Local Storage
8
Planify uses a single strictly-necessary cookie: `refreshToken`, set by the API on login. It is HttpOnly (unreadable from JavaScript), Secure in production, SameSite=Lax, scoped to `/api/auth` and expires after 7 days (or on logout).
A preference cookie, `sidebar_state`, remembers whether the sidebar is open or closed. It contains no personal data.
Local storage: the JWT access token (`accessToken` key, valid 15 minutes), the session cache (`auth-storage`), the language (`planify-language`) and the theme (`theme`).
No advertising, analytics or audience-measurement cookie and no third-party tracker is used. No consent banner is therefore required: only strictly necessary or preference trackers are set.
No cookie is set on the public pages (landing, login, registration, this policy) before you log in.
This data stays on your device; you can clear it at any time by clearing the site's storage, which logs you out.
Third-Party Sharing
9
We do not share, sell or rent your personal data to any third parties.
Your data may be shared only when required by law (court order, legal obligation) or to respond to a rights request.
Project members can see your name, username and avatar as part of collaboration; accepted collaborators and invitation recipients see the same information.
The instance administrator (read-only admin console, protected by separate credentials) can view accounts, projects, activity logs and storage volumes for operation and support purposes.
Technical processors: the VPS host and Let's Encrypt certificate authority (TLS certificates) only. No emailing, payment, CRM or external cloud provider is involved.
No third-party analytics, advertising or tracking tool is integrated. Libraries and fonts are served by the application itself (fonts self-hosted at build time): no request is sent to Google Fonts or any third-party CDN while you browse.
Sentry error monitoring, present only in the admin console, is enabled only if the operator configures a DSN; it then receives technical error data only, never your project content.
If a new third-party integration were to process your data, this policy would be updated before it goes live.
Collaborator Network
10
Planify offers an optional collaborator network to help you find other users.
A unique collaborator ID is automatically generated for each account. You can share it to receive collaboration requests.
When a user sends you a collaboration request, your name and username are visible to them.
Accepted collaborators can see your first name, username and avatar.
You can decline a collaboration request at any time.
Your collaborator ID and collaborator list are included in your data export.
Notifications & Real Time
11
Notifications are generated by the application itself (project invitation, task assigned to you, comment, collaboration request, etc.) and stored in the database with a title, a message and technical metadata.
They are delivered in real time over a WebSocket connection authenticated with your access token; if you are offline, they remain available in your notification inbox.
You can mark a notification as read; notifications are deleted along with your account.
No email, SMS or browser push notification is sent at present: all notifications stay inside the application.
Notifications are never used for advertising and are never shared with third parties.
Activity Log
12
The activity log keeps track of the actions performed within your projects: action type (create, update, delete, member added, upload…), author, related project or task, timestamp and metadata describing the change.
It is visible to project members and to the instance administrator, solely for traceability, support and dispute resolution.
It contains neither the full content of your files nor your passwords.
It is deleted along with the project, task or account it relates to (cascade deletion).
Server technical logs (access, errors) are separate from this business log; their retention periods are stated in section 13.
Data Retention
13
Account and business data (projects, tasks, checklists, labels, milestones, comments, notes, reactions, calendar events, files): kept as long as your account exists, then deleted when the account is deleted.
Refresh tokens: deleted on logout and purged on expiry (7 days maximum).
Notifications: kept until your account is deleted.
Invitations: expire after 7 days (“expired” status), then are deleted with the relevant project or account.
Activity log: kept for as long as the project, task or account it relates to exists.
Mini cloud files: immediately and permanently deleted when the file, project or account is deleted — no recycle bin is kept.
Application logs: 14 days for application logs, 30 days for error logs.
Anti-abuse fingerprints: kept for as long as needed to prevent abuse; deletion available on request at contact@infoblue.fr.
Sessions and rate limiting: counters are held in server process memory and reset when it restarts.
Backups: where applicable, they are managed by the server operator and follow the same lifetime as the data they contain.
Data Controller & Hosting
14
Data controller: Infoblue — contact@infoblue.fr.
Hosting: private server (VPS) administered by Infoblue, where the database and files are stored. The VPS runs without any external database or external storage.
Planify is self-hosted: if you use an instance operated by a third party, its administrator becomes the data controller for that instance and may access your data for operation and support, within the limits described above.
Legal basis: performance of the contract (provision of the service), legitimate interest (security, abuse prevention, service improvement) and legal obligation where applicable.
Transfers outside the European Union: none. Data remains on the operator's server, located within the European Union.
Minors: the service is not intended for persons under 15 without the consent of a parental authority holder.
Data breach: in the event of a breach likely to result in a high risk to your rights and freedoms, we notify the CNIL within 72 hours and inform you as soon as possible.
This policy may be updated to reflect technical, functional or legal changes; the last-updated date is shown at the top of the page. Any substantial change is announced within the application.
Governing law: Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act.
Contact
15
For any questions regarding this privacy policy or your personal data, contact us:
Infoblue — contact@infoblue.fr
We commit to responding within 30 days.
Questions about your data?
Our team is available to answer any questions you may have about your personal data.