Privacy

Only what a den puts in itself. Nothing is gathered in the background.

• The email address of each den keeper, used to send sign-in links and nothing else.
• For each member of the pack: the name the family typed, the animal they picked, and, if they set one, a family secret (a picture code or a PIN) which is stored scrambled, never as itself.
• What the den plans: items, notes, jobs and their ticks, requests, the shop and what was bought, trails and their steps.
• If a keeper sets a home town for the weather: the town name and a rounded position, about a kilometre wide. Never a precise or live location, and never from the device.
• For each trusted device: a name, when it was enrolled, when it was last seen, and a scrambled version of its token.

Some things are absent by design.

• No passwords. Keepers sign in with a one-time link by email, and the family secret is a doorbell between siblings, not a password.
• No analytics, no advertising, no tracking pixels and no third-party embeds. Pages load only from this app's own server.
• Nothing is sold, shared or used to build a profile, and none of it trains anything.

Four small cookies, all functional, none for tracking: one that marks this device as trusted by the den, one saying which member is active on it, one that carries a brand-new keeper from their sign-in link to the setup screens, and one remembering the chosen language. No cookie banner, because there is nothing here to consent to beyond making the app work.

Three, each doing one thing.

• Resend delivers sign-in emails, so it handles a keeper's email address and the link inside the message.
• Open-Meteo answers the forecast. The app asks from its own server with a rounded position, so no device and no name ever reaches them.
• The hosting provider runs the app and its database, and so holds everything above in the ordinary way a host does.

Not all of it stays in Europe. Resend keeps its own record of every message it delivered, the address it went to and when, on servers in the United States, even when the mail itself is routed through Ireland. The weather service is asked without any personal data at all, so there is nothing of yours for it to keep. The den itself, everything in the first list above, does stay in the European Union: it lives in a database in Amsterdam.

The den is set up and run by a grown-up keeper, and everything about a child in it was typed by that keeper. A first name or a nickname is enough, and there is no reason to give more. Children never receive email from the app and cannot be reached through it: a den is a closed room, reachable only from a device a keeper has trusted.

A den's own things stay until the den changes or deletes them. Sign-in links expire within minutes and are single use. A revoked device keeps only its record of having been revoked.

A keeper can delete the entire den in Settings, under the den's name. That erases the members, the plans, the jobs and their history, the shop, the trails and every device in one go, immediately and for good, with nothing kept behind.

Everything a den holds is visible in the app to the family that owns it, a keeper can change any of it, and deleting the den is a full erasure done by the family themselves rather than requested from anyone. Beyond that, you can ask what is held about you, or ask for a copy.

Questions, or a request: hello@planimals.nl