Privacy Policy
Last updated: August 30, 2026
At Václav Mikeska ("we," "our," or "us"), we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Plaineo mobile application and related web services (collectively the "Service").
Please review this Policy before using the Service. This Policy is a notice about our data practices, not a substitute for consent. Where consent is legally required, Plaineo asks for it separately at the relevant feature or permission prompt.
1. Who We Are
Václav Mikeska Vídeňská 39, Brno, Czech Republic Company ID: 75755122 | VAT: CZ8307034549 Email: mikeska@gmail.com Website: plaineo.com
For all privacy-related enquiries, data access requests, or deletion requests, please use the email address above.
2. Data We Collect
2.1 Data You Provide Directly
| Data type | Purpose |
|---|---|
| Email address | Account creation, authentication, communications |
| Display name / username | User profile shown to collaborators |
| Calendar and task content | Core functionality — your tasks, events, reminders, notes, and subtasks |
| Attached files and images | Stored as task attachments |
| Voice audio and transcripts | Used for classic transcription or live AI voice conversations; handling and retention differ by provider and voice mode as described below |
| Photos, images, and documents from camera, gallery, files, or the share sheet | Attached when you choose, and/or processed by AI to create or enrich tasks |
| Location (optional) | Used for place-based tasks and suggestions; only collected with your explicit permission |
| Shared content | Tasks and files you share with other Plaineo users |
| Chat, search, and link input | Used for application chat, task search, web research, document chat, and creating tasks from submitted URLs |
| Integration commands | Voice commands and task data submitted through connected Alexa, Home Assistant, widgets, or the public API |
| Purchase and subscription information | Processing purchases, verifying paid access, applying plan limits, managing renewals/cancellations/refunds, and providing billing support |
Prominent disclosure (app store policy requirement): Plaineo uses third-party AI and search services for voice conversations and transcription, application chat, task and document search, and analysis of text, images, documents, and links. Depending on the feature and current service configuration, the data sent may include microphone audio and transcripts, generated spoken-response text, camera or gallery images and uploaded documents, task names, notes, category definitions, chat messages, and search queries, and location supplied for place-related processing. Providers may include ElevenLabs, Alibaba Cloud Model Studio (Qwen, through an EU-deployed workspace in Frankfurt), OpenAI, and Perplexity. The iOS app presents a provider-specific disclosure and requires affirmative permission before first sharing personal data with these AI providers, and again when the disclosure version materially changes. AI providers may temporarily retain request or response data under their service terms for security, abuse prevention, provider billing, or service operation. ElevenLabs may use submitted data to improve its models unless Plaineo's provider-side data-use setting is disabled; the provider-specific conditions are explained in Section 5. Camera and microphone access is user-initiated and is not started in the background.
2.2 Data Collected Automatically
- Device information: device type, operating system version, unique device identifiers (managed by Firebase)
- Operational usage data: sync revisions, quota and token usage, integration status, feature-specific processing state, and news read state
- Log and error data: IP address and request metadata available to hosting infrastructure, access timestamps, app version, platform, route, error message, and technical stack trace where an application error occurs
- Push notification tokens: Firebase Cloud Messaging (FCM) token for delivering push notifications
- Notification payload: Push notifications may contain task names, reminder text, and sharing-related messages (e.g. "User X shared a task with you"). This content is transmitted through Google's FCM infrastructure.
2.3 Data from Third-Party Sign-In
Google Sign-In: When you sign in with Google, we receive your email address, display name, and profile photo from Google. We do not receive or store your Google password. Authentication state is managed entirely by Firebase Authentication (see Section 3).
Sign in with Apple: When you sign in with Apple, we receive a unique Apple user identifier and, where you choose to share it, your email address (Apple may provide a private relay email address instead of your real address). We do not receive your Apple ID password. If you use Apple's "Hide My Email" feature, we store only the private relay address Apple provides, and all communications are routed through Apple's relay service. Authentication state is managed entirely by Firebase Authentication (see Section 3).
2.4 User-to-User Sharing
When you share a task, calendar item, or file with another Plaineo user, we store the recipient's user identifier (UID) and email address in association with the shared item in order to enforce access control. The recipient will be able to see the content you explicitly shared with them. You are responsible for only sharing content with users you intend to share with. You may revoke sharing at any time, after which the recipient will no longer have access to the shared content.
If you create a public task link, anyone who has the link may view the fields exposed by that link until you revoke it. If you create a public API key or connect Alexa or Home Assistant, requests made with that credential can access or change the data permitted by the integration. Plaineo stores only a cryptographic hash of public API keys; you are responsible for protecting the plaintext key and revoking it if it is disclosed.
3. Authentication and Credentials
We do not store your account password. Primary account authentication — including email/password login, Google Sign-In, Sign in with Apple, and Firebase session tokens — is managed by Firebase Authentication (operated by Google LLC). Your sign-in credentials are transmitted to the respective authentication service (Google or Apple) using HTTPS/TLS and are subject to their respective privacy policies (Google's Privacy Policy, Apple's Privacy Policy).
We only receive a secure user identifier (UID) from Firebase after a successful login, which we use to associate your data with your account.
Optional integrations use separate credentials. Google Calendar requires an OAuth refresh token, which Plaineo stores encrypted on the backend until you disconnect the integration. Public API, Alexa, Home Assistant, and native widget access use revocable integration credentials; stored API keys are hashed where supported and native widget tokens are stored in app-private device storage.
4. Local Data Caching and Offline Storage
To provide offline functionality, Plaineo stores a local copy of your data on your device:
- Android and iOS apps (Capacitor / WebView): Your tasks, calendar data, settings, and
selected attachments may be cached
in an IndexedDB database stored inside the app's private WebView storage, scoped to your
user account (database name:
smart-calendar-<userID>). This data is accessible only by the Plaineo app and is not accessible to other apps or websites. - Web browser: When using Plaineo in a browser, data is similarly cached in the browser's
IndexedDB storage, scoped to the domain
plaineo.com. This local cache persists until you explicitly sign out, at which point it is cleared automatically. You can also clear it manually by clearing your browser's site data for plaineo.com. - The local cache includes tasks, calendar events, shared items, and related synchronisation metadata — enough to operate the app without a network connection.
- The local cache never contains your authentication credentials or raw passwords.
- Data is synchronised with our cloud backend (Firebase Firestore) whenever a network connection is available.
4.2 Cookies and Session Storage
The Plaineo web application uses the following browser storage technologies:
| Technology | Purpose | Persistence |
|---|---|---|
| Cookies (set by Firebase Authentication) | Maintain your login session across page reloads | Session / until sign-out |
| localStorage | Store user preferences and app settings | Until cleared manually or on sign-out |
| IndexedDB | Offline data cache (see Section 4.1 above) | Until sign-out or manual clear |
These are strictly necessary for the Service to function. We do not use advertising cookies, tracking pixels, or any third-party analytics cookies. Firebase Authentication may set its own cookies; see Google's Privacy Policy for details.
You may disable cookies in your browser settings, but this will prevent you from signing in to the web version of the Service.
5. Third-Party Services and SDKs
We use the following third-party services. Each processes your data under its own privacy policy. We share only the minimum data necessary for each service to function.
| Service | Purpose | Data shared | Privacy Policy |
|---|---|---|---|
| Firebase Authentication (Google LLC) | User login and session management | Email, display name, UID | firebase.google.com/support/privacy |
| Sign in with Apple (Apple Inc.) | Apple ID-based authentication; "Hide My Email" relay address where selected by user | Apple user identifier, optional email or Apple private relay email | apple.com/legal/privacy |
| Firebase Firestore (Google LLC) | Cloud database for all tasks and calendar data | All user-created content | firebase.google.com/support/privacy |
| Firebase Storage (Google LLC) | Stores file and image attachments | Uploaded files | firebase.google.com/support/privacy |
| Firebase Cloud Messaging (FCM) (Google LLC) | Push notifications | Device FCM token, notification payload | firebase.google.com/support/privacy |
| Firebase Hosting (Google LLC) | Serves the web application | Request IP, browser info | firebase.google.com/support/privacy |
| Google Calendar API | User-selected one-way or two-way calendar synchronisation, calendar discovery, change watches, and conflict-safe mapping | Calendar-list metadata; event titles, descriptions, locations, dates/times, recurrence, status, reminders, attendees, conference/attachment metadata, and sync identifiers; encrypted OAuth refresh token | policies.google.com/privacy |
| Google Maps Platform / Places API | Location search and place autocomplete | Search queries, coordinates or location bias when the feature is used | policies.google.com/privacy |
| ipapi.co | Optional city-level IP geolocation fallback after location permission has been granted and device location fails | Device IP address | ipapi.co/privacy |
| Alibaba Cloud Model Studio / DashScope (Qwen), Germany (Frankfurt) region | Current default model routing for AI text, chat, search ranking, structured extraction, and image/document analysis through a workspace-specific EU endpoint and EU deployment scope | Prompts, relevant task/category/chat content, images/documents, and optional location context | alibabacloud.com/help/en/privacy-policy |
| OpenAI API | Selectable AI text generation and image/document analysis; legacy transcription where configured | Prompts, relevant task/category/chat content, images/documents, audio where configured, and optional location context | openai.com/policies/privacy-policy |
| ElevenLabs API | Speech-to-text, live AI voice conversations, and spoken response generation | Microphone audio, transcripts, generated response text, language/timezone context, relevant category definitions, and voice preferences | elevenlabs.io/privacy |
| Perplexity API | Live public-web search used when application chat needs current internet information | Search queries, relevant conversation context, date/location filters where supplied | perplexity.ai/privacy |
| Firecrawl | Extracts readable content from a URL that you submit for link-to-task processing | Submitted URL and fetch configuration | firecrawl.dev/privacy |
| RevenueCat | Cross-platform checkout, subscription management, and entitlement verification | Firebase UID; product, offering, transaction, receipt/purchase-token, subscription, entitlement, renewal, cancellation, refund, and billing-status information; on web, email address, locale, and limited checkout metadata. Plaineo does not send task/calendar content to RevenueCat | revenuecat.com/privacy |
| Stripe | Payment gateway used by RevenueCat Billing for web subscriptions | Contact and billing details, payment-method information, transaction amount/currency/status, subscription status, and fraud-prevention/device data entered or generated during web checkout. Plaineo does not receive or store full card details | stripe.com/privacy |
| Amazon Alexa | Optional account-linked voice task integration | Voice intent text/slots, task commands, Plaineo responses, and integration credential | amazon.com/privacy |
| Nabu Casa / Home Assistant | Optional Home Assistant voice and household task integration | Voice command text or audio-derived transcript, language/member context, task commands, and Plaineo responses | nabucasa.com/privacy |
| Google Play Store (Google LLC) | Android app distribution and in-app purchase processing | App install/update metadata and purchase/subscription data | policies.google.com/privacy |
| Apple App Store (Apple Inc.) | iOS app distribution and in-app purchase processing | App install/update metadata and purchase/subscription data | apple.com/legal/privacy |
| Capacitor (Ionic / Appflow) | Android/iOS WebView runtime — no telemetry sent to Ionic | None | ionicframework.com/privacy |
Google API Services User Data Policy: Our use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. We use Google Calendar data solely to provide the calendar sync feature and for no other purpose.
Google Calendar: Plaineo requests only Calendar scopes for the mode you choose. The
app-created mode can manage calendars and events created by Plaineo and read calendar-list
metadata. Full sync can read and write events in calendars you select and read calendar-list
metadata. Plaineo stores the encrypted refresh token, selected-calendar metadata, event mappings,
sync cursors, job/error state, and webhook channel state needed to maintain sync. We do not use
Google Calendar data for advertising, credit decisions, or general AI-model training, and we do
not access Google Contacts, Drive, Gmail, or Google Tasks through this integration. Disconnecting
revokes Google access, removes the stored token and sync state, and removes imported Plaineo
copies as described in the unlink confirmation; it does not delete the user's original Google
events unless an explicit sync action already changed them.
AI service providers: AI features are user-initiated. On iOS, a prominent in-app disclosure identifies the data categories and providers and requires affirmative permission before personal data is first shared with third-party AI. The disclosure is shown again after a material provider or data-use change. Other platforms provide this Policy and contextual feature/permission notices. You can stop future AI sharing by not using AI features, revoking camera/microphone/location permissions where relevant, or, on iOS, choosing Withdraw AI data-sharing consent in AI & Voice settings. You may also contact us for assistance.
Provider retention is not uniformly zero. Plaineo configures ElevenLabs live voice conversations with audio saving disabled and a one-day transcript/PII deletion safety window, and normally asks ElevenLabs to delete each finalized conversation after provider usage-cost reconciliation. Zero-retention mode is not enabled because final usage-cost reconciliation currently requires the completed conversation. Other provider requests may be retained temporarily for abuse monitoring, security, provider billing, or service operation under the provider's API terms.
Plaineo accepts Alibaba Cloud Model Studio requests only through a workspace-specific HTTPS endpoint in the Germany (Frankfurt) region using the EU deployment scope. Alibaba states that, for this configuration, request data stored by Model Studio remains in Frankfurt and model inference is restricted to the European Union. A missing or non-Frankfurt endpoint disables the direct DashScope integration instead of falling back to an international endpoint.
Retention and model training are separate issues. Plaineo does not train its own general-purpose AI model on your content and does not instruct providers to train on it. Under the providers' published terms applicable to Plaineo's current API use:
- ElevenLabs may use submitted data to improve its models unless the provider-side Improve the models for everyone setting is disabled; Enterprise accounts are excluded by default. This setting is maintained in Plaineo's ElevenLabs workspace, not in the app.
- Perplexity API states that it does not retain API query data and does not train on API data. This differs from Perplexity's consumer Free/Pro/Max service, which has separate training controls.
- OpenAI API states that API data is not used for model training by default. Plaineo also sends
store: falseso responses do not create provider-side application state; separate temporary abuse-monitoring retention may still apply under OpenAI's API terms. - Alibaba Cloud Model Studio states that customer content is not used for model training without explicit consent. Plaineo does not provide such consent.
No sale of data: We do not sell your personal information to any third party, ever.
Google Play Data Safety: In addition to this Privacy Policy, a summary of our data collection and sharing practices is published in the Data Safety section of Plaineo's Google Play Store listing. The Data Safety section and this Privacy Policy are intended to be consistent; if there is any conflict, this Privacy Policy governs.
Apple App Store Privacy Nutrition Labels: A summary of our data collection practices is also published in the App Privacy section of Plaineo's Apple App Store listing, in the form of Apple's Privacy Nutrition Labels. Those labels and this Privacy Policy are intended to be consistent; if there is any conflict, this Privacy Policy governs. Because paid subscriptions are active, the listing should disclose Purchases and the account User ID as linked to the user, and should also account for contact information used for web checkout where applicable.
6. How We Use Your Data
We use your data exclusively for the following purposes:
- Providing, operating, and improving the Service
- Authenticating your identity and managing your account
- Processing purchases, verifying subscription entitlements, applying plan allowances, and handling billing lifecycle events and support
- Syncing your data across your devices
- Delivering push notifications and reminders
- Enabling AI-powered features (voice, application chat, search, text, image, document, and link analysis), with explicit third-party AI permission on iOS
- Enabling Google Calendar synchronisation
- Enabling task and calendar sharing with users you explicitly choose to share with
- Providing public links, the public API, widgets, Alexa, and Home Assistant integrations when you enable them
- Responding to your support requests
- Detecting and preventing fraud, abuse, and technical issues
- Operating quotas, processing jobs, error reporting, abuse prevention, and service reliability
- Complying with applicable laws and legal obligations
Plaineo does not currently include an advertising SDK or Firebase Analytics in the app. Technical errors may be sent to Plaineo's backend with app version, platform, route, error message, and stack trace so that failures can be diagnosed.
AI-Generated Content
AI-powered features (voice transcription, task extraction from images, text-based AI suggestions) produce output that may contain errors, omissions, or inaccuracies. AI output is provided as a convenience and you are solely responsible for reviewing and verifying any AI-generated content before relying on it. We are not liable for decisions made based on AI-generated output.
7. Data Storage and Security
- Cloud storage: All cloud data is stored in Firebase Firestore and Firebase Storage, operated by Google LLC on Google Cloud Platform. Google applies industry-standard security including encryption at rest and in transit.
- In transit: All communications between your device and our servers use HTTPS/TLS.
- Access control: Firebase Security Rules ensure each user can only access their own data or data explicitly shared with them. Our backend (Firebase Functions) accesses data only to service authenticated, authorised requests.
- We cannot guarantee absolute security. No method of Internet transmission or electronic storage is 100% secure. In the event of a data breach that affects your rights and freedoms, we will notify the relevant authorities and affected users as required by applicable law (e.g. GDPR Article 33/34).
8. Data Retention and Account Deletion
Core account content is retained while your account is active or as needed to provide the Service.
Soft-deleted items are retained briefly to support sync and conflict resolution, then permanently purged.
Application-chat sessions expire after approximately 24 hours of inactivity. AI-flow run records and associated processing artifacts are normally deleted 30 days after completion.
ElevenLabs live-conversation data is normally deleted after cost reconciliation, with a configured one-day deletion safety window if immediate cleanup is interrupted. Other providers apply their own API retention periods.
Google Calendar connection and sync metadata is retained until you disconnect the integration, delete your account, or it is no longer required for recovery/security.
Plaineo stores a limited payment ledger containing provider/transaction identifiers, plan and entitlement status, billing-period dates, price/currency/amount where supplied, and lifecycle events such as purchase, renewal, cancellation, expiration, billing issue, or refund. We do not store full payment-card details. Billing, tax, fraud-prevention, dispute, and accounting records may be kept for the period required by applicable law or reasonably needed to establish or defend legal claims. Apple, Google, RevenueCat, and Stripe apply their own retention rules.
Account deletion: You can request full account and data deletion at any time by:
- Using the in-app account deletion option in the app settings, or
- Visiting plaineo.com/delete-account and following the instructions, or
- Sending a deletion request to mikeska@gmail.com from your registered email address.
Account deletion removes the Firebase Authentication account, primary Plaineo content, the RevenueCat customer record, and Plaineo's active payment ledger, except records that must be preserved for legal, tax, accounting, fraud-prevention, or dispute purposes. Deleting your Plaineo account does not itself cancel a recurring Apple App Store or Google Play subscription. Cancel it through Manage subscription before deleting the account. Web subscriptions should be cancelled through the RevenueCat customer portal. Processing records that are already subject to short automatic retention, provider-side copies, security logs, and backups may remain until their applicable deletion period expires. Completion across active systems may take up to 30 days. Local app or browser caches are cleared on sign-out, account deletion, uninstall, or manual site-data removal, depending on the platform.
9. Your Rights
You have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you
- Correction: Request correction of inaccurate or incomplete data
- Deletion: Request deletion of your personal data (see Section 8)
- Data portability: Request your data in a portable, machine-readable format
- Restriction: Request that we restrict processing of your data
- Objection: Object to certain types of processing based on legitimate interests
- Withdrawal of consent: Where processing is based on consent (e.g. Google Calendar sync, iOS third-party AI sharing, or location access), you may withdraw it at any time without affecting prior processing
To exercise any of these rights, contact us at mikeska@gmail.com. We will respond within 30 days (or within any shorter period required by applicable law).
10. App Permissions
10.1 Android App Permissions
The Plaineo Android app may request the following device permissions:
| Permission | Purpose |
|---|---|
| Internet | Required for all network operations |
RECORD_AUDIO / Microphone |
Classic voice recording or live AI voice conversation; audio is sent to ElevenLabs under the retention described above |
READ_MEDIA_IMAGES / Storage |
Selecting images to attach to tasks |
CAMERA |
Capturing photos to attach to tasks or for AI image analysis |
POST_NOTIFICATIONS |
Displaying task reminders and push notifications |
RECEIVE_BOOT_COMPLETED |
Re-scheduling local reminders after device restart |
All permissions that require user consent are requested at runtime with a clear explanation of their purpose before first use. You may revoke any permission at any time in your device settings; revoking a permission will disable the feature that depends on it.
10.2 iOS App Permissions
The Plaineo iOS app may request the following device permissions:
| Permission (Usage Description Key) | Purpose |
|---|---|
Microphone (NSMicrophoneUsageDescription) |
Classic voice recording or live AI voice conversation; after AI consent, audio is sent to ElevenLabs under the retention described above |
Camera (NSCameraUsageDescription) |
Capturing a photo for AI task extraction and, when you choose, keeping it as a task attachment |
Photo Library (NSPhotoLibraryUsageDescription) |
Selecting images for AI task extraction or task attachments |
Location (NSLocationWhenInUseUsageDescription) |
Optional place context for tasks, image extraction, and place suggestions |
| Notifications | Task reminders and sharing alerts |
All permissions are requested at runtime with a system-provided prompt that shows the purpose string. You may revoke any permission at any time in Settings → Privacy & Security on your device; revoking a permission will disable the feature that depends on it.
11. Children's Privacy
The Service is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe your child has provided us with personal information, please contact us immediately at mikeska@gmail.com and we will delete it.
12. International Data Transfers
Your data is stored and processed on Google Cloud Platform and the third-party services listed above. Direct Alibaba Cloud Model Studio requests are restricted to the Germany (Frankfurt) region and EU deployment scope as described in Section 5. Other processing may occur in the EEA, United States, Singapore, or other countries used by the selected provider or routed model provider. When data is transferred from the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on:
- Google's Standard Contractual Clauses and Data Processing Agreements for Firebase services
- applicable adequacy decisions, Standard Contractual Clauses, and provider data-processing terms
13. GDPR Rights (EEA and UK Users)
If you are in the EEA or UK, you have rights under the GDPR / UK GDPR and may lodge a complaint with your local supervisory authority. Our legal bases for processing are:
- Contract performance – processing necessary to deliver the Service you registered or paid for, including purchase verification and subscription entitlements
- Legitimate interests – security, fraud prevention, service improvement
- Consent – for optional features such as iOS third-party AI sharing, Google Calendar sync, and location access
14. California Privacy Rights (CCPA)
If you are a California resident, you have the right to know what personal information we collect and how it is used, request deletion, and opt out of sale (we do not sell personal information). You will not be discriminated against for exercising these rights.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date and provide notice through the app, website, or email as appropriate. If a change adds a new kind of Google user-data use or materially changes iOS third-party AI sharing, Plaineo will request renewed consent before beginning that new use.
16. Contact Us
For privacy questions, data requests, or concerns:
Václav Mikeska Vídeňská 39, Brno, Czech Republic Email: mikeska@gmail.com Website: plaineo.com