Privacy Policy

Account information. Your email address and password (stored hashed by our authentication provider), a display name if you give one, and the timestamps recording when you accepted these documents.

Plan content. Everything you build with the app: the occasion, dates and times, cities, venues and addresses, budgets and cost estimates, vendor notes and call scripts, reminders, letters and notes you assemble in the artifacts workshop, and your saved options.

Voice audio, in transit only. When you are in a voice session, your microphone audio is captured and streamed live to Google's Gemini Live API so the concierge can understand and answer you in real time. We do not write raw audio to our database, we do not keep recordings, and there is no download of your voice anywhere in this product.

Transcripts. The text produced from that conversation — what you said and what the concierge said — is saved with your plan so the concierge remembers prior decisions when you come back. Typed conversations are saved the same way.

Basic technical logs. Ordinary server logs and error reports needed to keep the service running and secure.

We do not create a voiceprint. We do not analyse the characteristics of your voice to identify you, authenticate you, verify who you are, estimate anything about you, or match you against any other recording. Your voice is used for one purpose only: turning what you said into words the concierge can respond to in that moment.

Audio is processed by Google as our subprocessor for the Gemini Live API. Their handling of that data is governed by Google's Privacy Policy and the Gemini API Additional Terms of Service. Text conversations use a separate model gateway and do not send audio at all.

Before your first voice session we show a consent screen describing this, and we record the moment you accepted it. We never request microphone permission before you have seen and accepted that screen, and you can always plan entirely by text instead.

This is the part that deserves your attention. To plan something good, you will tell us things about another person — her name or a pet name, what she loves, an inside joke, a shared memory, where she works, and where she will physically be at a specific time on a specific date. That person has not agreed to any of this, and in most cases will never see it.

You are responsible for what you enter about someone else. Only enter details you have a legitimate reason to hold as part of your relationship with that person, and only as much as the plan actually needs.

We recommend you do not enter sensitive categories of information about anyone — including health or medical details, immigration or citizenship status, sexual orientation, religious or political beliefs, precise ongoing location tracking, or financial account, card or government identification numbers. The concierge will never ask you for these, and the plan does not need them.

Saved people profiles. You can also save standing profiles of the people you plan for — name, relationship, birthday and recurring occasions, free-form notes on what they love and hate, dietary or accessibility needs, favourite cuisines, places you have already taken them, and gifts you have already given. These profiles exist so the concierge stops asking you the same questions on every visit. They are stored under your account, readable only by you, and deleted when you delete the profile or your account. During a conversation the concierge may offer to save a new detail it heard; nothing is added to a profile unless you tap to accept it.

Adults only. People profiles are for adults. Do not create a profile for a child, and do not enter a birthdate that would make the person under 18 — the system rejects it. You can absolutely plan something that includes your kids; just keep their personal details out of the saved profiles and mention them in the plan itself only as much as it needs.

If someone contacts us and identifies themselves as a person described in a plan or profile, we will handle the request under applicable law, which may include telling them what we hold or deleting it.

To run the product: conduct the intake interview, draft your run of show, generate vendor call scripts, assemble your artifacts from your own words, calculate budget totals, and keep your reminders. To keep the service secure and working. To respond to you when you contact us.

We do not sell your data. We do not use your plan content or transcripts to advertise to you. We do not disclose the identity of the person your surprise is for to anyone.

Google — real-time speech understanding and the language models behind the concierge. Supabase — the database and authentication that store your account and plans. Our hosting provider — serves the app. We may also disclose information if legally required, or to protect someone's safety.

Plans are kept until you delete them. Because there are no audio recordings, there is nothing to expire on the audio side — only text ever lands in the database.

Delete a plan. Open the plan and use Delete plan. That removes the plan and everything attached to it: legs, vendor scripts, reminders, artifacts and its transcripts.

Delete transcripts on their own. You can clear a conversation without losing the plan — the run of show, budget and scripts stay, and the concierge simply starts the next conversation without that history.

Delete your account. Settings → Legal → “Delete my account and all data”. After a confirmation step this deletes your plans, transcripts, artifacts and profile, then the account itself. It is immediate and cannot be undone. Backups and logs age out on their ordinary cycle.

He Planned is for adults. You must be 18 or older to use it. We do not knowingly collect information from anyone under 18, and if we learn that we have, we will delete it. Planning a child's birthday is a perfectly normal use of the app — the adult doing the planning is the user, and we ask you to keep what you enter about a child to what the event actually requires.

Data is encrypted in transit. Your rows are protected by database-level access rules so that only your signed-in account can read or write them. API keys for the voice and language models live on the server and are never sent to your browser; voice sessions use short-lived single-use tokens.

Depending on where you live, you may have the right to access, correct, export or delete your information, or to object to certain processing. You can do most of this yourself in the app. For anything else, email privacy@heplanned.com from the address on your account and we will respond within 30 days.

When this document changes materially we update the version above and ask you to accept the new version the next time you sign in. Your acceptance date and version are always visible in Settings → Legal.