Plan To Win: Privacy Policy

1. Introduction and Scope

1.1 Who is responsible. Zackery Frank Boyle, carrying on business as Plan To Win, of 4718 Stanley Rd SW, Calgary, Alberta T2S 2R2, Canada ("PTW", "we", "us"), is responsible for the personal information described in this Privacy Policy (the "Policy").

1.2 Privacy contact. Zackery Frank Boyle, proprietor, is accountable for our privacy practices and is our person in charge of the protection of personal information. Contact: hello@plantowin.app · 4718 Stanley Rd SW, Calgary, Alberta T2S 2R2, Canada.

1.3 Products and services covered. This Policy covers the whole Plan To Win family:

Where this Policy says "the Service" it means all of these unless it says otherwise.

1.4 The laws we follow. We write this Policy to meet Canada's federal Personal Information Protection and Electronic Documents Act ("PIPEDA") and Alberta's Personal Information Protection Act ("PIPA"), and we describe additional rights for people in Quebec, the European Economic Area, the United Kingdom and the United States in Section 15. If you live in Washington State, our Consumer Health Data Privacy Policy also applies to your health data.

1.5 Personal information. "Personal information" means information about an identifiable person. It includes information that identifies you directly (like your name and email) and information linked to you (like your logs, journal and quiz answers).

1.6 Consent. By using the Service, and by ticking the "Before you start" step, you consent to the collection, use and disclosure of your personal information as this Policy describes. We ask for separate consent for things that need it (see Sections 3.4, 8, 9 and 15).

2. Information We Collect

2.1 What you give us — the Plan To Win app

2.2 What you give us — the Map of You

• Before you start. The quiz shows a short consent step before it asks you anything. We record that you agreed, when, and to which version.
• Your answers. As you go through the quiz, your written answers are analysed to build your values map. A short excerpt of what you wrote can be stored alongside each value it produced, so your map stays traceable to what you actually said.
• Your reading. The archetype, values, growth edge, gap and suggested first moves the AI writes for you.
• A saved copy. So you can return to your map and reading, we save them under a random reading ID. Anyone who has the link to that ID can view the reading it points to; we do not require sign-in to view a saved reading. If you go on to create a Plan To Win account, that reading can be linked to your account.
• If you choose to go further: creating a full Plan To Win account from the Map of You collects the same account information as Section 2.1, and starts a subscription checkout with Stripe if you choose a paid plan.
• Local device storage. Your progress through the quiz is also kept in your browser's local storage so you can resume it, and a downloaded share card (an image of your Valueprint) is generated on your own device and never uploaded anywhere unless you choose "Get shareable link".

2.3 What your device shares, if you allow it

• Health data from your phone's health app. On Android that is Health Connect; on iOS it will be Apple Health when an iOS app exists. In the Android app, only after you grant permission on your phone, we read steps, heart rate (including resting heart rate), sleep, active calories and weight: only the types you allow, and we request no write access. Steps can sync automatically once allowed; the other types are read when you open the screens that show them. You can turn this off in your phone's settings at any time.
• Time zone, from your browser or phone, so schedules and calendar events are right.
• Google Calendar (optional). If you connect Google Calendar, you give Google permission, separately from signing in, for us to add your Plan To Win tasks to your Google Calendar and to read the titles and times of your upcoming events (the next 30 days) so the app can plan around them. We store the token that lets us do this, and we store the title, date and start and end time of each imported event as a "fixed commitment" in your account; we do not store attendees, descriptions or locations, and we skip all-day, declined and cancelled events. Imported events are removed when you disconnect, and the access we hold is revoked when you delete your account. Events we create carry no Google reminder; the app sends its own. Plan To Win's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Location (optional). If you start a cardio session and allow location, your phone's position is used on your device to show live distance and pace. We store the distance, time and average pace of the session and whether GPS was on; we do not store your route or coordinates.
• App usage on Android (optional). If you turn on Gentle Nudges or the screen-time view and grant "Usage access" in Android settings, the app reads how long other apps have been in the foreground on your phone. Those totals stay on your phone; they are not sent to us. The only thing we record is when you launch one of your chosen Essential Apps from inside Plan To Win.
• Camera (optional). To photograph a meal or scan a barcode (sent for that feature, Section 5), or, for a filming task, to open your camera or record your screen. A screen recording stays on your device.
• Alarms and notifications (optional). If you turn on the Wake-Up alarm, the Android app schedules an exact alarm on your phone, may wake the screen with a full-screen alarm page, and re-sets the alarm after a restart. The time, days and sound you choose are stored in your account; the alarm itself runs on your device. Notifications need your permission on the phone.

2.4 What we collect automatically

• Technical and diagnostic data: device and browser type, app version, the screen you were on, and error messages, saved when the app hits an error so we can fix bugs. This is stored in our own database and is linked to your account while it exists.
• Security data: failed sign-in, verification and reset attempts, the IP address on a password-reset request, one-time codes we email you (stored only as one-way hashes), and your sign-in sessions (which expire after 90 days without use), kept briefly to block abuse.
• Usage counts for AI features (for example, how many calls per month, and an estimate of what your AI use costs us).

Website page-view counter. On plantowin.app (the website, not the app and not the Map of You) we use Vercel Web Analytics to count page views and see which pages are visited. It uses no third-party cookies; a visit is identified by a hash created from the request, which is discarded after 24 hours; and it records the page, the referring site, country, region and city, operating system, browser and device type. We do not combine it with your account, and we do not use it for advertising. We do not include advertising trackers in the app, on plantowin.app, or on the Map of You.

2.5 From other sources

If you sign in with Google, Google gives us your name, email address and account ID. If you subscribe, Stripe gives us your subscription status and a fingerprint of your card (not the number). If you join our waiting list on plantowin.app, that form is relayed to us by Web3Forms, and we hold the email address you gave us. If you come from the Map of You, we hold whatever email address you give us there. We do not buy personal information from data brokers.

2.6 What we do not knowingly collect

We do not ask for your government identification numbers, and we do not collect your payment card number ourselves.

2.7 Live sync across your devices

If you use Plan To Win on more than one device, we keep one small live record on your account so that something you start on one device (a task, routine, break, focus block, workout or timer) can show on your others with a "Continue here" option, and so that a change made on one device refreshes the rest. The record holds what is running (for example a task's name, or the sets of a workout you have open), when it started, and a label for each device, such as its name and type. To stop it on a device, sign out of Plan To Win on that device. Settings > Connections > Your devices shows where you are signed in. This record is part of your account data: it is included in Download my data and is deleted with your account.

2.8 Saved places

You can save up to 12 places, such as Home, Work and the gym. Each has a name, an address or a Maps link, and the travel time you usually need. They are stored in your account settings. They are used on your own device to show a "leave by" card for a task that needs travel, and to build a Maps or Uber link that opens only when you tap it. Plan To Win does not track your location in the background or use GPS for this, and saved places are not shared with anyone. They are included in Download my data and are deleted with your account.

2.9 Walks

A walk you log holds its distance, its minutes, its pace and an optional route note that you write. It is stored with your other logs, counted in your own stats, included in Download my data and deleted with your account. Walks are not shared with anyone.

3. Health and Sensitive Information

3.1 What we mean. Some of what you give us is sensitive: health and wellbeing information (weight, height, sleep, stress, heart rate, calories, mood, food, exercise, data from your phone's health app), habits you are working to quit and your slips, journal and reflection text, your values, identity and Map of You answers, and photos.

3.2 How we treat it. We collect it only to provide the features you use. We treat it with extra care. We do not use it for advertising. We do not sell it. We do not use it to train AI models. We never share it in social features (Section 8). We ask for your express consent for it, on the "Before you start" screen in the app and the equivalent step on the Map of You, and we rely on that consent to process it. You can withdraw consent (Section 14.6).

3.3 The AI and your sensitive information. Text you send to an AI feature, including a Map of You answer, goes to Anthropic (Section 5). What the coach can see is limited by the AI Coach Profile switches in Settings, and your journal is off by default.

3.4 Cycle and period data (planned, not yet in the app). We plan to offer optional cycle and period tracking. It is not part of the app today. Before we launch it we will (a) update this Policy, (b) ask for a separate, opt-in consent on its own screen, not bundled with the Terms, (c) keep it out of the AI coach unless you switch that on for it, and (d) let you delete it on its own. Nothing about cycle or period data is collected until then.

3.5 Other sensitive logs we may add. Any other especially sensitive tracking we may add later (for example digestion logs, or craving and trigger logs for a habit you are quitting) will follow the same rule as cycle data: not collected until this Policy describes it, opt-in on its own screen, off for the AI coach unless you switch it on, and deletable on its own.

3.6 Health-information laws. We are not a health-care provider, and we do not hold your information on behalf of one. PIPEDA and PIPA are the privacy laws that govern our handling of health-related personal information.

4. How We Use Your Information

4.1 Purposes. We use personal information to:

• run the Service and give you plans, tracking, reflection, your Map of You reading and the AI coach;
• show the people you choose to link with what you choose to share with them (Section 8);
• secure accounts, check your age and prevent abuse and fraud, including keeping a free trial to one per person;
• take payment and manage your membership (through Stripe);
• send service emails you need, like password resets, billing notices and important changes (through Resend);
• send marketing email, only as Section 9 describes;
• support you, including fixing bugs you report and relaying our waiting-list form (through Web3Forms);
• provide Coaching, if you are a coaching client;
• understand how the product is used and improve it, in ways that do not identify you publicly;
• keep records of what you agreed to;
• meet our legal duties, and protect people's safety, including the serious-safety notification in Section 7.

4.2 What we do not do. We do not sell your personal information, we do not use it for targeted advertising, and we do not use your journal, reflection, quiz-answer or chat text to train AI models. If that ever changes, we will update this Policy and ask for your consent first.

4.3 Legal bases (for people in the EEA and the UK). Where GDPR or UK GDPR applies: we rely on contract to provide the Service you signed up for; consent for special-category data such as health information, and for marketing; legitimate interests for security, abuse prevention and product improvement (balanced against your rights); and legal obligation for tax and similar records.

5. How the AI Processes Your Information

5.1 What is sent. When you use an AI feature (AI Assistant, goal generation and refinement, reflection, meal or activity suggestions, schedule and plan import, food photo scanning, Essential App suggestions, side quests, Vision Board and Bucket List ideas, identity skill-tree branches, Shuffle, or a Map of You quiz answer or reading), our server sends the relevant text, and any photo or file you used with that feature, to Anthropic, which runs the AI model and returns an answer. Some details: a photo you attach in the chat is sent for that reply only and is not stored; a meal photo is sent to produce a draft and is stored only if you save the meal; a schedule, brief or plan you upload has its text extracted on our server and sent to Anthropic when the app needs help reading it, the file itself is never stored, and what we keep is the plan built from it (project and task names, dates and short notes), your review choices, and a record of what the import created so you can undo it for 7 days (the record itself is deleted after 14 days).

5.2 What the coach also sees. For the coach chat, we add background so it can help you: your phase, XP, streak, today's tasks, your fixed commitments for today and tomorrow (including any imported from Google Calendar), plans you accepted from the coach, a summary of your lifting progress when you ask about training, any plan you added from a health provider, your preferred Essential Apps, your onboarding coaching profile, and, only as far as you allow in Settings > AI Coach Profile, your Valueprint reading, identity work, accepted insights and Work projects (on by default), and recent journal notes and Work Journal excerpts (off by default). Raw "Go deeper" answers and anything that tripped our care screen are never included. Nothing shared with you by a linked person in a social feature is ever read by the AI.

5.3 Web search. The AI can use a web search tool run by our AI provider. The words searched may be passed to a search service.

5.4 Anthropic's role. Anthropic acts as our service provider (processor) under a data-processing agreement. As Anthropic publishes: it does not train its models on the content submitted through its API; it automatically deletes API inputs and outputs from its own systems within 30 days of receipt, except where it retains data longer to investigate suspected misuse of its terms (up to two years) or where the law requires it; and it may process data in the United States. We rely on Anthropic's published terms for these facts and will update this section if they change. We use two Anthropic models (a larger one for the coach and plans, a smaller one for quick tasks such as meal estimates and app suggestions), and a short-lived cached copy of our shared instructions, all within the same terms.

5.5 Staff review of chat excerpts. The founder can see short excerpts (the first 500 characters) of your AI Assistant and goal-refinement messages and the replies, with your account, in our admin panel, to catch bad or broken answers. Messages that trip our care screen are not logged there. These excerpts are kept for 90 days and then deleted.

5.6 Your chat history. The full text of your AI Assistant conversations is saved in your account so you can look back at it. You can delete a conversation in the app, and deleting it removes it. A message that trips our care screen is not saved.

5.7 AI can be wrong. See the Terms and the AI and Coaching Disclosure.

5.8 Coach memory. The coach can remember short facts you tell it about yourself (for example "I work nights") and a two- or three-sentence note about each finished chat, so you do not have to repeat yourself. It asks "Remember this?" before it keeps a lasting fact, keeps only what you said in your own words, and does not keep addresses, phone numbers, email addresses or anything that tripped the care screen. Writing a chat note is an AI request, so the chat is sent to Anthropic for that (Section 5.1). Everything it remembers is listed under Chat history > What I remember about you, where you can delete one item or everything, and you can tell the coach to forget something. If you turn off Settings > Plan & coach > Coach memory, nothing new is remembered and saved memory is not used. Deleting a chat removes what was taken from it, and memory is deleted with your account.

5.9 Looking back at your journal, mood and activity. The coach reads your own journal entries, mood check-ins and activity only when you allow it. The switch Look back when you ask (Settings > Plan & coach > AI Coach Profile) is off by default; the coach asks the first time it would need it, and you can turn it off at any time. When it has looked, its reply shows an "I looked at" receipt of which part of your data it read and the dates it covered. What it read is sent to Anthropic to write that one reply, and it is not saved to coach memory unless you tell the coach to remember it. Entries that sound heavy are not handed over for analysis: the coach answers gently and points to real help instead, and the safety layer in Section 7 still applies. This is reflection support, not medical advice.

5.10 Tool Studio. In Tool Studio you describe a small tool in your own words and an AI writes its code from your instructions; those instructions and the code go through Anthropic like any other AI request (Section 5.1). A tool you keep runs in a sandbox inside the app with no internet access, and it asks your permission before it uses your tasks or your microphone. A tool that listens receives only pitch, note and loudness worked out on your phone, never a recording. Your tools, their earlier versions and the data they save are stored in your account, can be reset or deleted by you in the tool's sheet, are included in Download my data and are deleted with your account. Tools are private to you; there is no sharing yet.

5.11 Plans the coach builds. When you ask the coach to build your day or week, it shows one plan card made from what the app already knows (your wake and bed times, routines, goals, calendar events and setup answers). Nothing is added until you tap Approve, and you can Undo it for 7 days. Each night the app can draft a plan for tomorrow, which is an AI request, and it is applied only when you approve it unless you have switched on "Apply by itself". The switch Let the coach make changes in Settings > Plan & coach pauses all coach changes: the coach can still read your day and talk with you, but it cannot change anything. What the coach changed is listed under History > What PTW did.

5.12 Talking to the coach and hearing it. If you use the microphone in the coach chat or Talk mode, your browser or phone turns your speech into text. Depending on your device, that speech recognition may be done by Google or Apple under their own privacy terms. We do not receive or store the audio; we receive only the text you send to the coach. Replies are read aloud with a voice that is already on your device, so we do not send the reply to a speech service. Your chosen voice style, speed and pitch are saved on your device and in your account.

5.13 Send to PTW (sharing text or a screenshot). You can share text or a screenshot from another app to Plan To Win. It stays on your phone and is shown to you first; you can edit the text, hide numbers, emails and links, or cut off parts of a screenshot. Nothing goes to the AI until you tap Ask the coach; then the text you kept, or the screenshot after any parts you cut off, is sent to Anthropic to be read, the same way as a message or photo you send the coach. A shared screenshot is not stored by Plan To Win: it is used for that one reply and is not kept in your coach history, while text you send is kept in your history like any message and you can delete it there. A shared message can include other people's names or details; only what you keep is used, and the coach is told to use only a first name and what your plan needs, and never to save other people's phone numbers or addresses.

5.14 Plans, habits and Life setup. When you build a plan for a goal, our instructions to Anthropic include rules for small daily habits, so the plan can come with habits you can tick off. If you use Life setup to describe your day, what you tell it is sent to Anthropic to draft a day for you to review, and nothing is added to your schedule until you accept it. The questions-only path in Life setup does not use the AI. You can edit or remove any habit or plan item afterwards.

6. Who We Share It With

6.1 Our service providers. We share information only as needed, with the companies below. Each acts on our behalf, and none may use it for its own advertising.

6.2 Other sharing. We may also share information: (a) in a business sale, merger or financing, where the other party must protect it as this Policy does; (b) to comply with the law, a court order or a lawful request, or to protect rights and safety; (c) where we reasonably believe it is necessary to prevent serious harm to someone; (d) with the people you choose to link with, exactly as Section 8 describes; and (e) with your permission.

6.3 De-identified information. We may use information that has been aggregated or de-identified so it cannot reasonably identify you, to understand and improve the Service.

6.4 Our own team. The founder, and any administrator the founder authorises, can see account and profile details, task names and activity numbers, AI Coach Profile answers, error logs, bug reports, the AI chat excerpts in Section 5.5, serious-safety notices, notes we keep about your account for support, and how much AI use your account has cost us, in our admin panel, to run the Service, support you and keep people safe. If someone reports you, or you report someone, in a social feature, the founder sees the report, both people's names and emails, and a copy of the reported text (Section 8.4). The admin panel does not show your journal or reflection text. If you are a coaching client and your coaching consent is confirmed, your coach can see what the AI and Coaching Disclosure describes.

7. The Serious-Safety Notification

7.1 What it is. If our systems detect signs that you may be in serious danger (for example self-harm or danger happening now) in a reflection or in the AI chat, the app shows you help and resources and stops the exercise, and we may notify the PTW team so a person can reach out to you. The notice contains your account and the time only, and not what you wrote.

7.2 Details. So the description is complete: the notice also says which part of the app it came from (for example, the AI chat or a guided reflection). It goes to the founder by email and appears in our admin panel, where it can be marked handled with a private note. We send at most one notice per person in any 24 hours. We only send it if you have accepted the current consent screen, including Box 3. When a notice really was sent, the app tells you so on the screen, and it does not say so otherwise. What you wrote in that moment is not saved by the reflection features and is not logged in our admin panel.

7.3 What we do not promise. We cannot monitor in real time, we do not promise anyone will see or act on a notice, and we are not an emergency service. If you are in immediate danger, contact your local emergency number. See the AI and Coaching Disclosure.

7.4 How long it is kept. Notices are kept for 12 months after they are marked handled, or until you delete your account, whichever comes first.

8. Social Features

8.1 What they are. Social features let you link, by invitation code, with a partner or friends you already know. There is no public profile, no directory and no way to find strangers. At the time of this version they are in an invite-only test.

8.2 What a linked person sees. Someone you are linked with sees:

• the display name you choose in Social; if you have not set one, your username; otherwise your first name. Never your full name or email;
• your profile photo, unless you switch "Show my photo to people I'm linked with" off in Social > Who sees what. It is on by default, shown only while the link is active, and never to invite previews, former links, people you blocked, or anyone else;
• exactly the things you choose to share on that link: free/busy times (never what you are doing), a shared grocery list, goals you mark shared, a weekly summary if you turn on the accountability buddy, plans you make together (date nights, meetups, pacts), the one agreed number for a challenge you both join, and workout plans you send;
• a one-tap cheer you send on something they shared with you.

8.3 Never shared. Your journal, reflections, Valueprint and values, identity work, AI chats, health numbers, body measurements, diet, money, location, contacts, habits you are quitting, XP, streaks and LifeScore are never shared with anyone through a social feature, and no AI feature ever reads what a linked person shared with you.

8.4 Blocks, mutes and reports. You can mute or block anyone you are linked with. A block is silent: the other person sees only that the link ended. If you report someone, we store your reason and note, a copy of the text you reported as it stood at that moment, and both accounts, and the founder reviews it. The person you report is not told who reported them. Reports are kept for 12 months after they are closed, then deleted.

8.5 Cheers. When you cheer something a linked person shared, we record who cheered, whom, which item and which day (no text), so it is not sent twice. Cheers are deleted when the link ends or either account is deleted.

8.6 When a link ends. When a link ends or an account is deleted, shared items the link owned are removed. Each remaining person keeps their own final numbers from finished challenges, and the other side shows as a former member.

8.7 Your controls. Social > Who sees what lets you change your display name, your photo setting and the name shown in notifications, and review each link's sharing; you can end a link at any time.

9. Marketing Emails and CASL

9.1 Separate consent. Marketing email is separate from the Terms and the "Before you start" step, on both the app and the Map of You. We will not make it a condition of using the Service. We follow Canada's Anti-Spam Legislation ("CASL").

9.2 When we send it. We send marketing email (for example the beta invitation and product news) only where you have signed up for it or otherwise given us your express consent.

9.3 What each email contains. Each marketing email says who it is from, gives our mailing address, and has a working unsubscribe link. We honour an unsubscribe within 10 business days.

9.4 Service emails. Password resets, billing notices, safety and legal notices are not marketing and may be sent even if you have unsubscribed from marketing.

9.5 Records. We keep a record of when and how you consented to marketing email, and when you unsubscribed. Deleting your account also removes you from our marketing list.

10. Where Your Information Is Stored (Cross-Border Processing)

10.1 Our providers run servers in several countries. Your information may be stored or processed outside your province and outside Canada, including in the United States. While it is elsewhere it is subject to the laws of that place, including laws that may let courts, law-enforcement or national-security authorities there access it.

10.2 Where. Our database (shared by the app and the Map of You) and our application hosting are both located in the United States. Our AI provider, Anthropic, may also process data in the United States. Our other providers process email and payments in the countries they operate from.

10.3 Our safeguards. Our main service providers, including Anthropic, Vercel, Neon, Stripe and Resend, each maintain their own data-processing terms covering the personal information they handle for us, including contractual safeguards for information that leaves Canada.

10.4 More information. You can ask us for more information about our policies and practices on service providers outside Canada at the contact details in Section 17.

11. How Long We Keep Your Information

11.1 Retention table.

11.2 When you delete your account. We delete your account and its data from our database, including your profile, plans, logs, journal, reflections, mood check-ins, notifications, preferences, AI chat history and log excerpts, safety notices, consent records, coaching records, imported-plan records, your social profile, links, cheers and what you shared, and all photos we hold (profile picture, home background, Vision Board, food-scan photos and bug-report screenshots). Some things are handled differently:

• Map of You readings that belong to your account are deleted.
• Bug reports you sent are deleted, including screenshots.
• Error logs are kept without any link to your account, until the retention period above. The technical error message can still contain details from your session.
• Stripe: deleting your account cancels any active subscription immediately and deletes your Stripe customer record. Stripe keeps payment and invoice records as the law requires.
• Billing: subscription and payment event records are kept, without your name, as part of our financial records, and the one-way free-trial hashes above are kept.
• Social: your links end; the people you were linked with keep their own final numbers from finished challenges and see you as a former member; a report you made is deleted; a report someone made about you is kept for the period above without any link to your account.
• Google Calendar: we revoke the calendar access we hold and delete the imported events.
• Backups: your data may remain in provider backups for a short period, as described in Section 11.1.
• Legal records such as invoices and tax records are kept as the law requires.
• Marketing list: you are removed from our marketing list.

11.3 We do not keep your information longer than we need it for the purposes in this Policy, unless the law requires it.

11.4 Your deletion receipt. When your account is deleted we send one email to the address the account had. It lists what was deleted, what each outside service we use (Stripe, photo storage, our email provider and Google) did, and what is kept after deletion. Some records are kept for a limited period for security and legal reasons, as Section 11.1 describes; we will state the exact periods here once they are confirmed. Copies held by our providers age out on their own schedules: for our AI provider, confirm with the provider and see its policy (Section 5.4).

12. Security and Breach Notification

12.1 Our safeguards. We use reasonable measures for the sensitivity of the information. Passwords are hashed and never stored in plain text. Connections are encrypted (HTTPS). Access to admin tools is limited to the founder and people the founder authorises. Password-reset links are single-use, expire in 30 minutes, and are stored only as a hash. Login and reset attempts are rate-limited.

12.2 No system is perfect. We cannot guarantee absolute security. Please choose a strong password and keep it private, and protect your device with a screen lock, since the app keeps some of your data on the device (Section 16.1).

12.3 If there is a breach. We keep a record of every breach of security safeguards involving personal information, whether or not it must be reported, for as long as the law requires (at least 24 months). If a breach creates a real risk of significant harm to you, we will tell you as soon as feasible, and we will report it to the Office of the Privacy Commissioner of Canada and, where it applies, the Information and Privacy Commissioner of Alberta, as the law requires. If you are in the United States, we will also give any notice required by the US Federal Trade Commission's Health Breach Notification Rule and by the law of your state.

13. Children

Plan To Win is for people aged 18 and older. We do not knowingly collect information from anyone younger, on the app, the website, or the Map of You. If we learn we have, we will delete it. If you think a child has given us information, email hello@plantowin.app.

14. Your Rights and Choices

14.1 Access. You can see and edit your profile and most of your data in the app. You can ask us for a copy of the personal information we hold about you and how we use it.

14.2 Download your data. Go to Settings > Account & Security > Download my data for a complete export as a .zip file (up to three downloads a day). It holds your data as JSON and as CSV spreadsheet files, a list of your photos with a link to each, and a README that says what is in it and what is left out. It leaves out security details such as password hashes and tokens, internal tags, other people's identities in social records, the founder's internal notes about the account, and private coach notes. Photos are included as links, not embedded. In the Android app the file is saved to your phone and opens your phone's share sheet. You can also email us.

14.3 Correct. You can change most information in the app. Email us to correct anything you cannot change yourself.

14.4 Delete your account. Settings > Delete Account. It asks for your password, or, if you signed up with Google, for a one-time code we email you. Section 11.2 says what is deleted.

14.5 Cancel, unsubscribe and turn things off. Cancel your subscription in Settings > Membership. Unsubscribe from marketing using the link in any email. Turn off what the AI coach can see in Settings > AI Coach Profile. Turn off health-data sharing in your phone's settings, Google Calendar sync in Settings, and what you share with a linked person in Social > Who sees what.

14.6 Withdraw consent. You may withdraw consent at any time, subject to legal or contractual limits, by emailing us or using the settings above. We may then be unable to give you some features, and withdrawing does not affect earlier processing. If you withdraw consent to the core documents you cannot continue to use the Service (Terms, Section 3.4).

14.7 Time to respond. We aim to respond to a request within 30 days, and no later than the law allows. We may ask you to verify your identity first. We do not charge a fee for a reasonable request, unless the law allows one, and if we do we tell you first.

14.8 If we refuse. We will tell you why and how to complain.

15. Rights by Region

15.1 Canada (PIPEDA and provincial laws, including Alberta PIPA). You have the rights in Section 14, including access, correction and withdrawal of consent, and the right to challenge our compliance. See Section 17 for how to complain.

15.2 Quebec (Law 25). If you live in Quebec, you have additional rights, including, in some cases, to receive your information in a commonly used technological format, to ask us to stop disseminating it or de-index it, and to be told when a decision is made about you solely by automated processing. We handle sensitive information on the basis of your express consent. Our person in charge of the protection of personal information is named, with their contact details, in Section 1.2. You can also complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

15.3 European Economic Area and United Kingdom (GDPR and UK GDPR). If GDPR or UK GDPR applies to you, you have the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent, and the right to complain to your supervisory authority (in the UK, the Information Commissioner's Office). The legal bases we rely on are in Section 4.3. International transfers are described in Section 10.

15.4 United States. We do not sell your personal information or share it for cross-context behavioural advertising. Depending on the state you live in, you may have the right to know what we collect, and to delete, correct and limit the use of sensitive personal information. Send a request to the contact in Section 17. If you live in Washington, our Consumer Health Data Privacy Policy applies to your health data and is linked from our homepage; it explains the rights you have under Washington's My Health My Data Act and how to use them.

15.5 Elsewhere. If you live somewhere not named above, contact us and we will do our best to honour rights equivalent to those in this section.

16. Cookies, Local Storage and Similar Technologies

16.1 The app, the website and the Map of You use browser local storage and similar technology to keep you signed in, resume your progress, and remember your preferences (for example your theme, celebration and display settings, and the layout of the desktop floating hub). When you are offline, the app also keeps a queue of what you logged until it syncs, plus drafts and session state. This lives on your device until you sign out or clear it, protected only by your device's own lock; the app does not cache your account data for offline use beyond that queue. These are needed for the app to work.

16.2 We do not use advertising cookies anywhere in the Plan To Win family. The website plantowin.app uses Vercel Web Analytics as described in Section 2.4; it uses no third-party cookies. Our website, the app and the Map of You load typefaces from Google Fonts, and the app loads a few scripts and icons from jsDelivr, which can see the IP address of a visitor's device when the browser requests the files, the way any web resource works.

16.3 If we add any other analytics or advertising technology, we will update this Policy and ask where the law requires. You can clear local storage in your browser, which will sign you out.

17. Contact and Complaints

17.1 Contact us. Questions, requests or complaints about privacy: hello@plantowin.app · 4718 Stanley Rd SW, Calgary, Alberta T2S 2R2, Canada. We will investigate a complaint and respond.

17.2 Regulators. If you are not satisfied, you have the right to complain to:

• the Office of the Privacy Commissioner of Canada (priv.gc.ca);
• the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca);
• if you live elsewhere, your provincial, state or national privacy regulator.

18. Changes to This Policy

18.1 We may update this Policy. The "Last updated" date at the top always shows the current version.

18.2 If a change is material we will tell you in the app and by email at least 14 days before it takes effect where we can, and ask you to accept again on the "Before you start" screen (Terms, Section 3). If you do not accept, you cannot continue to use the Service, and if you are a paying subscriber the Terms explain your pro-rata refund.

18.3 If we want to use your personal information for a new purpose, we will ask for your consent first where the law requires it.