ActionPlan Privacy Policy

ActionPlan (“we”, “us”) makes a tool that turns dense documents (leases, scholarship letters, financial forms, healthcare and insurance notices, and similar) into a clearer summary, deadlines, and a draft response. This Privacy Policy explains what data we collect when you use the service at the URL where this policy is published (the “Service”), what we do with it, and what choices you have.

The Service is in early access. Some features described in this policy may change as we add or remove functionality. If we make a material change, we’ll update the effective date above.

What we collect

When you create access at /early-access, you’ll submit either:

• Your email address, or
• An access code we gave to you or your organization.

If you submit an email, we store it (lowercased) so we can recognize you on later visits and so the same account picks up where you left off. If you submit only an access code, we don’t store an email. We identify your session entirely through a cookie.

When you submit a document for analysis, we collect:

• The text of your document. If you paste text, we store what you pasted. If you upload a file (PDF or .txt only), we extract the text from the file and store that. We do not keep a copy of the uploaded file itself, only the extracted text.
• The analysis result. The summary, action items, deadlines, risks, and questions our model produces from your document. These are stored alongside the source text so you can come back to them.
• Anything you add inside the workspace. This includes task plans you generate and email/letter/note drafts you create from a task. These are stored until you delete the document they’re attached to, or until you replace or discard them individually inside the workspace.

We also generate and store:

• An internal account ID (a random UUID) to identify your account on our servers.
• Usage counts for your account: how many documents you’ve analyzed, your allowed document quota, the time your account was created, and the last time it was active.
• Which access code you used, if any.

We do not read or store IP addresses, user-agent strings, device fingerprints, or geolocation at the application layer. Our hosting provider may retain its own infrastructure logs at the platform level; those are outside our application.

We do not run any third-party analytics, behavior-tracking, advertising, or session-replay tools.

How we use what we collect

We use the information you submit only to operate the Service:

• To run the analysis you asked for and return the result to you.
• To keep you signed in across visits.
• To enforce your trial quota.
• To recognize a returning email so you don’t start from scratch.
• To diagnose problems in our system when something goes wrong (see Server logs below).
• To respond to you if you contact us.

We do not use your submitted content for advertising. We do not sell it.

Cookies and sessions

We use a first-party cookie to keep you signed in. The cookie is HttpOnly, SameSite=Lax, and Secure in production. It contains your internal account ID and an issued-at timestamp, signed with a server secret. Lifetime: up to 30 days.

We do not set any third-party cookies. We do not use cookies for advertising, cross-site tracking, or analytics.

On one page in the signed-in app, we temporarily store your current analysis in your browser’s sessionStorage so the workspace can render after navigation. This data lives in your own browser, is cleared when you reset the workspace or leave the page, and is not transmitted anywhere beyond what’s already in our database.

Third parties we use

To provide the Service, your data passes through the following providers:

• An AI service provider. We use a third-party AI service to process prompts, uploaded or pasted document text, and related content in order to generate the analyses, task plans, and drafts the Service produces. The provider’s handling of submitted content is governed by their own terms. We do not control the provider’s data handling beyond what they publish.
• A hosting and database provider. Your account information, document text, analysis results, task plans, and drafts are stored in a third-party-hosted database we use. Our application is run on a third-party hosting provider. Both are accessed over authenticated connections.

Those are the third-party services that touch your account data through the application. We don’t share your data with anyone else.

Storage, retention, and deletion

We currently retain the data you submit for as long as your account exists. We do not automatically expire or delete documents, analyses, or accounts on a schedule.

You can delete an individual document at any time from inside the Service. When you do, we delete the document, your task-completion history for it, the task plans you created for any of its tasks, and any drafts (emails, letters, or notes) you generated from any of its tasks. This runs as a single atomic operation: either all of it is removed, or none of it is.

We do not currently provide a self-service way to delete your account, your email, or your entire history in one action. If you’d like us to delete your account and the data tied to it, email us at the address below and we will handle the request manually.

We do not apply application-layer encryption to stored documents or analyses; protection at rest depends on the hosting and database providers. Connections between your browser, our servers, and our third-party processors are over HTTPS.

Server logs

When something fails on our side, we write log entries to our server’s standard error. Logs may include internal identifiers, error messages, and short excerpts of system or model output in rare error paths. Logs do not normally contain your full source text, your email, or your session token. Our hosting platform may retain logs we emit; those logs follow the platform’s own retention.

Your choices

You can:

• Stop using the Service at any time.
• Delete individual documents from inside the product (cascade described above).
• Email us to request that we delete the rest of your data.
• Clear our cookies in your browser; doing so will sign you out.

We will respond to requests in a reasonable time. We may need to confirm the request comes from you before acting on it.

Children

The Service is not intended for children under 13, and we don’t knowingly collect information from anyone under 13. If you believe a child has submitted information through the Service, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy as the Service changes. When we do, we’ll update the effective date at the top. For material changes, we’ll do something more visible than just updating the date.

Contact

Email us at actionplan.support@gmail.com.