Privacy Policy

This Privacy Policy explains what information Tumalo Creek Holdings, Inc. ("Company", "we", "us") handles when you use the PlanTonic app for macOS (the "App"), its optional hosted plan-generation feature (the "Assistant"), visit https://plantonic.app (the "Website"), or contact us. We designed PlanTonic so that we handle as little of your information as possible.

The short version

• The App has no accounts, no analytics, and no crash reporting. Your plans are files on your Mac. We never see them unless you send us one.
• If you connect Claude or another app to PlanTonic, it can read and change the plan you have open, and what it reads goes to the service behind it, such as Anthropic for Claude, when you ask it to work on the plan.
• The Assistant is off until you allow it. When you use it, the short description you type is sent to our service to generate a plan. We do not store what you type or the plan we send back.
• We keep only a count of the Assistant plans you have used, against a random identifier the App creates or against your App Store purchase, never your name or email address, and a record of any blocked attempts (not what you typed).
• The Website uses Google Analytics and Microsoft Clarity only if you accept analytics cookies, and lets Google Ads measure and personalize our ads only if you accept advertising cookies. You can change either choice at any time.
• The only other personal information we receive is what you send us yourself, for example when you email support or send a bug report or feature request from the App.

The App

Your plans. Plans you create are stored as files in locations you choose. They stay on your Mac or in storage you control, such as iCloud Drive if you put them there. The App does not upload them anywhere, including to the Assistant. The exceptions are the ones you ask for through a connected app, described under Claude integration below.

Purchases. The App is a free download from the Mac App Store; the free trial, the unlock and any subscription are in-app purchases. Apple processes your purchases and handles your payment and identity under Apple's privacy policy. We do not receive your name, email address, or payment details from Apple. Apple provides us aggregated sales and usage statistics that do not identify you.

No tracking. The App contains no advertising, analytics, or tracking technology and does not request permission to track you.

Bug reports and feature requests. Once you have taken the trial, bought the unlock or subscribed, you can send us a bug report or a feature request from the App's Feedback menu. We receive what you type, your email address only if you give one, the PlanTonic and macOS versions, and your Mac’s processor type and language. If the App shows you an unexpected error and you choose to report it, the report also includes the error message and technical details of where in the App it occurred. To confirm the report comes from a copy of PlanTonic that holds a purchase, the App also sends the signed record of that purchase and its random identifier, and signs the request with its key, as described under The Assistant below. We store reports in Linear, the issue tracker we use to plan and fix PlanTonic, under Linear's privacy policy, and use your email only to follow up about your report. To have a report deleted, contact us.

The Assistant

The Assistant turns a short description of your project into a plan. It is optional. The App asks your permission before it is used for the first time and sends nothing until you allow it. It is currently available only in the United States.

What the App sends. Each time you ask the Assistant for a plan, the App sends our service the description you typed (up to 2,000 characters) and a random identifier the App created when it was installed. The identifier is not linked to your name, email address, Apple ID, or device, and we have no way to find out who you are from it. Once you have taken the trial, bought the unlock or subscribed, the App also sends the signed record of that purchase that Apple issues, so our service can confirm it and count your Assistant plans against it. That record contains a transaction number, the product, and its dates, but not your name, email address, or Apple ID. We also ask Apple for the purchase's current status, for example whether it has been refunded, and keep the answer for up to 30 days. The App also signs each request with a key it creates in your Mac's Secure Enclave, where the key stays, so our service can confirm that requests come from a copy of PlanTonic that holds the purchase. We keep the public part of that key and which purchase it belongs to for 12 months after the App last registered it. Delete My Assistant Data removes the link to your purchase.

How a request is handled. Our service runs on Amazon Web Services in the United States. Your description is first checked by an automated safety filter (Amazon Bedrock Guardrails). If it passes, the plan is written by one of two services, whichever ours is set to use, and streamed back to your Mac: Anthropic's Claude, through Claude Platform on AWS, or an OpenAI model on Amazon Bedrock. Amazon Web Services and, when Claude writes the plan, Anthropic process these requests on our behalf, as our service providers. Anthropic handles them under its commercial terms and data use policies. On Amazon Bedrock the model runs within Amazon Web Services and OpenAI does not receive your description or the plan; if Amazon Bedrock's automated abuse detection flags a request, Amazon Web Services may keep it for up to 30 days to check for abuse, and does not share it with OpenAI.

What we keep, and for how long. All of it is deleted automatically:

• We do not store your descriptions or the plans we generate. They exist only for as long as it takes to handle your request. The service that writes a plan may keep the request for a limited time, as described under How a request is handled.
• Plan count. We keep a count of the Assistant plans each identifier or purchase has used, so we can apply its allowance. It is deleted 12 months after it was last used.
• Purchase record. For the trial, the unlock or a subscription, we keep the transaction number, product, and dates from its record. It is deleted 12 months after a subscription ends or, for the trial and the unlock, 12 months after you last use the Assistant.
• Blocked requests. If the safety filter blocks a request, we record that it happened, the kind of content the filter detected and how confident it was, and the length of what you typed, together with your identifier. We do not record what you typed. These records are kept for 90 days.
• Automatic pause. If one identifier has five requests blocked within 24 hours, the Assistant pauses for that identifier for 24 hours. This happens automatically; no one reviews your requests.
• Service logs. Our service keeps operational logs for 30 days. They never contain what you typed.

Network information. Amazon Web Services processes technical information such as your IP address to deliver the service, to limit how often it can be called, and to restrict it to the United States. We do not store your IP address with your usage records or use it to identify you.

Why we process this information. We process your description to provide the plan you asked for, and your identifier and blocked-request records to apply the free limit and protect the service from abuse, which is our legitimate interest in keeping it available and safe.

Deleting or exporting your Assistant data. In the App's Settings you can delete everything our service holds for your identifier, or export a copy of it. Deleting it resets the plan count for the random identifier. The plan count for a purchase is kept, because it is needed to apply the allowance you bought; for a subscription, only the current month's count is kept, until the month ends. Because we cannot identify you any other way, these controls in the App are the way to find your data; you can also email us the Support ID shown in Settings.

Claude integration

You can connect Claude, or another app on your Mac that uses the Model Context Protocol (MCP), to PlanTonic so it can work in your plans. This is off until you turn on Enable local MCP server in the App's Settings, and needs the unlock. You approve each app you connect, each one gets its own key, and you can disconnect it in Settings at any time. The connection stays on your Mac: the App accepts it only from apps on the same Mac.

• What a connected app can read. A connected app can read and change the plan you have open, save it, and export it.
• Where that goes. When you ask a connected app to work on your plan, what it reads goes to the service behind it, such as Anthropic for Claude, and is handled under that service’s terms and privacy policy. We do not receive it.
• What reaches PlanTonic. If you ask a connected app to draft a plan with the Assistant, your description goes to our service and is handled as described under The Assistant above; we also record that the request came through a connected app. If you ask it to file a bug report or a feature request, we receive the report, any email address you give, the PlanTonic and macOS versions, your Mac’s processor type and language, which app sent it, and the names and error messages of the last five requests from connected apps that failed, never what was sent with them. To confirm the report comes from an unlocked copy, the App also sends the signed record of your unlock purchase and its random identifier. We store reports in Linear, as described under The App above.
• Your plan in a report. A report never includes your plan unless you ask for it. If you do, the plan is attached to the report in Linear.

The Website

The Website is a static site and shows no ads. It is served by Cloudflare, which processes technical information such as your IP address and browser type as needed to deliver the site and protect it from abuse, under Cloudflare's privacy policy. We do not use this information to identify you.

Google Analytics, only with your consent. If you accept analytics cookies, the Website uses Google Analytics, a service of Google LLC, to count visits and see which pages are read and how visitors arrive, so we can improve the site. Google Analytics then receives information about your visit, such as the pages you view, the page that linked you to us, your browser and device type, and an approximate location that Google works out from your IP address, and it sets the cookies described under Cookies below. Until you accept, Google Analytics is not loaded and nothing is sent to Google. We look at this information only as totals and do not combine it with anything that identifies you. It is used for advertising only if you also accept advertising cookies, as described under Google Ads below. Google processes it under Google’s privacy policy, and Google Analytics keeps it for no more than 14 months.

Microsoft Clarity, only with your consent. If you accept analytics cookies, the Website also uses Microsoft Clarity, a service of Microsoft Corporation (Microsoft Ireland Operations Limited for visitors in the European Economic Area, the United Kingdom and Switzerland), to show us how visitors use the pages, through session recordings, which replay your clicks, scrolling and mouse movement and the page as it appeared to you, and heatmaps. Clarity links these to a pseudonymous identifier stored in a cookie, so this is personal data. Clarity also receives information such as the pages you view, your browser, operating system and device type, page errors and performance, and your IP address, which Microsoft uses to estimate your approximate location, and it sets the cookies described under Cookies below. Clarity masks text you type into form fields and drop-down selections, and numbers and email addresses shown on the page. Until you accept, Clarity is not loaded and nothing is sent to Microsoft. We use this only to improve the Website, not for advertising, and do not combine it with anything that identifies you. Microsoft receives it as an independent controller, not as our processor, and uses it under the Microsoft Privacy Statement and the Clarity Terms of Use, including for its own purposes such as improving its products and advertising. Session recordings are kept for 30 days. Heatmap and aggregated data are kept for up to nine months. Clarity does not let us delete one visitor’s data individually.

Google Ads, only with your consent. We advertise PlanTonic with Google Ads, a service of Google LLC. If you accept advertising cookies, Google Analytics shares your visit with our Google Ads account, so that Google can tell which of our ads brought you to the Website and whether you went on to the Mac App Store, and so that we can show our ads to people who have visited the Website, on other websites and apps that show Google ads. Google receives the information described under Google Analytics above, together with the identifier of the ad you clicked, if any, and it sets the cookies described under Cookies below. Google may combine this with what it knows about you from your Google account, under Google’s own privacy policy and your Google ad settings, which you can change at adssettings.google.com. Until you accept advertising cookies, nothing about your visit is used for advertising, even if you accept analytics cookies. We do not upload your name, email address or anything else that identifies you to Google, and Apple does not tell us who buys PlanTonic.

Cookies

The Website sets cookies only as described here. On your first visit, a banner asks which ones you allow.

• Your cookie choice. A cookie called cc_cookie remembers what you chose, so the banner does not ask again on every page. It is strictly necessary and lasts six months, after which the Website asks again.
• Protecting the site. Cloudflare, which serves the Website, may use strictly necessary cookies or similar browser storage to protect the site from abuse.
• Analytics, only if you accept. Google Analytics sets _ga, which tells one visitor from another, and _ga_*, which keeps track of the current visit; each lasts two years. It may also set _gid, which lasts 24 hours. These cookies are set on plantonic.app only after you choose Accept all, or turn on analytics cookies in Cookie preferences.
• Session analysis, only if you accept. Microsoft Clarity sets _clck, which holds a random identifier for you on the Website (one year), and _clsk, which joins your page views in one visit into a single recording (one day); both are set on plantonic.app. It also sets cookies on Microsoft’s own domains, clarity.ms and bing.com: CLID, which records when Clarity first saw your browser on any website that uses it (one year); MUID, which identifies your browser across Microsoft sites and which Microsoft uses for analytics and advertising (about 13 months); SRM_B, a similar Microsoft identifier (about 13 months); MR, which controls when MUID is refreshed (seven days); SM, which syncs MUID across Microsoft domains (until you close your browser); and ANONCHK (expires at once). These are set only after you choose Accept all, or turn on analytics cookies in Cookie preferences.
• Advertising, only if you accept. Google Ads sets _gcl_au, which links your visit to the ad that brought you here, and, if you arrived by clicking one of our ads, _gcl_aw or _gcl_gb, which remember that click; each lasts 90 days. They are set on plantonic.app only after you choose Accept all, or turn on advertising cookies in Cookie preferences.

Changing your mind. Choose Cookie preferences at the bottom of any page of the Website to change your choice at any time. Turning analytics off deletes the Google Analytics and Clarity cookies from your browser and reloads the page so that neither is loaded. Turning advertising off deletes the Google Ads cookies and stops your visits from being used for advertising from then on. Data already sent to Google or Clarity is not deleted and expires under the periods above. Rejecting analytics or advertising cookies does not change anything else on the Website. You can also delete cookies in your browser’s settings.

Your privacy choices. Analytics and advertising each run only with your consent, which is the legal basis we rely on, and you can withdraw either at any time as described above. If your browser sends a Global Privacy Control signal, the Website treats it as declining both: it loads neither Google Analytics nor Clarity, and nothing is used for advertising. Google and Microsoft may process this data in the United States, under the EU-U.S. Data Privacy Framework or another lawful transfer mechanism. We do not sell personal information for money. Letting Google Ads use your visit to show you our ads elsewhere is “sharing” for cross-context behavioral advertising under California law, and sharing visit data with Google or Microsoft for analytics may count as a “sale” or “sharing” too. Either happens only after you accept the matching cookies, and you can opt out at any time with Cookie preferences or Global Privacy Control.

Contacting us

If you email support@plantonic.app or otherwise contact us, we receive your email address and whatever you include in your message. We use it only to respond to you and to improve the App. We keep support correspondence for up to 24 months after your last contact, and we delete it sooner on request.

How we share information

We do not sell personal information and do not share it with third parties for their own marketing. The service providers named in this policy process information on our behalf only to provide their services to us. We may disclose information we hold if required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets, in which case this policy continues to apply to it.

Your rights

Depending on where you live, you may have rights to access, correct, delete, export, or restrict the use of personal information we hold about you, and to lodge a complaint with a supervisory authority. For the Assistant, use the controls in the App's Settings described above. For anything else, email support@plantonic.app. We respond within one month. We will not ask you for identity documents; they would not help us find records that are not linked to your identity. Some information may be kept where the law allows it, for example while a request is being investigated for abuse. Information that lives only on your Mac is under your control, not ours.

International users

The Company is located in the United States, and the Assistant is available only in the United States. If you contact us from outside the United States, your message is processed and stored in the United States.

Children

The App and Website are not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has sent us personal information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. We will post the revised policy at https://plantonic.app/privacy with a new version number and effective date, and tell you in the App before a change affects how the Assistant handles your information. This policy is versioned together with our End User License Agreement.

Contact us

Tumalo Creek Holdings, Inc.
401 Ryland Street, Suite 200-A, Reno, NV 89502, United States
support@plantonic.app