1. Controller and contact
The controller is 2moove technologies GmbH, Blasewitzer Str. 41, 01307 Dresden, Germany, represented by managing director Daniel Wolf. For privacy requests and support: support@planmy.day. This notice covers planmy.day, the app at app.planmy.day and associated API and MCP features. It informs you about processing; it does not request blanket consent.
2. Information website
The landing page provides product information. We use no advertising or analytics cookies there and do not create visitor profiles. Delivering web pages technically processes connection data such as IP address, request time and requested resource to serve the page and prevent attacks. The basis is Article 6(1)(f) GDPR; our interest is secure website delivery. Following a link to the app enters a separate service area with accounts and planning data.
3. Account, planning data and purposes
For registration, login and account management we process your email address, user identifier and authentication data needed for your login method. Passwords are stored securely in the identity service and are not disclosed to connected AI assistants. The app processes tasks, groups, day plans, activities, notes, templates, statuses, times and settings you create. The purpose is the storage, display, editing and synchronization of your planning that you request. The basis is Article 6(1)(b) GDPR. We cannot provide an account without the required account data; you choose your planning content and optional connections.
4. Cookies and local preferences
The app uses the authentication cookies PMD_SESSION_ID and PMD_USER_ID to associate requests with your signed-in account. The regular configuration gives them a lifetime of up to 30 days; logout or expiry may end access earlier. The identity service Keycloak also uses login and security cookies. Strictly necessary storage and access do not require consent under section 25(2)(2) TDDDG. Personal session data is processed to provide your account under Article 6(1)(b) GDPR and for security under point (f). Local browser storage also retains your chosen language, region, appearance and planning views until you change them or clear site storage. These support the respective interface functions, not advertising or cross-site tracking. Clearing browser storage removes local preferences and may require another login.
5. Calendars and task services
Connecting an external service processes the calendar, event or task data you authorize and the permissions and tokens needed for access. The purpose is your requested integration under Article 6(1)(b) GDPR. The scope depends on the service and authorization. You can disconnect or revoke access at the external provider. Imported planning data may remain part of your plan until you delete it or request account erasure. This does not automatically delete data at the original provider.
6. Optional API and AI connections
An API or MCP client you authorize can retrieve and modify planning data within its permissions. We send the requested data to the client you choose and, where applicable, its provider. We receive API requests, not automatically your entire chat history. Our execution is based on Article 6(1)(b) GDPR. The provider's further processing is subject to its own responsibility and privacy notice. MCP access tokens last one hour; refresh tokens last 30 days and rotate when used. Personal API tokens have the lifetime chosen at creation and can be revoked in Developer settings. For immediate termination of an MCP authorization, contact support; removing a connector alone does not guarantee immediate server-side revocation. This does not recall data already sent to a provider.
7. Account email and support
We use your email for necessary verification, recovery, security and account messages and to respond to your requests. Depending on the purpose, the basis is Article 6(1)(b) or (f) GDPR; our legitimate interest is secure service support. Registration is not a newsletter subscription. Feature and offer emails are not currently part of this process. Any later marketing consent would be separate, voluntary and withdrawable.
8. Operations and security
For troubleshooting and abuse prevention we process technical logs and, where enabled, error reports: for example time, endpoint, outcome, request identifier, technical browser information and attributable account or connection identifiers. Configured error reporting uses GlitchTip through the Sentry protocol. The frontend removes or filters cookies and sensitive authentication headers before transmission. This diagnosis serves operations, not personalized advertising. The basis is Article 6(1)(f) GDPR; our interests are security and troubleshooting. We do not need private planning content for advertising profiles.
To display the app, the browser currently loads text and icon fonts and a library from Google servers. Google receives technical connection data such as the IP address and browser request information. Our purpose is rendering and technically providing the app, relying on Article 6(1)(f) GDPR. These external resources are not loaded by the static legal pages, whose font is hosted locally.
9. Recipients and international processing
Only authorized people and service providers receive access as needed for operations, hosting, identity management, email delivery, error diagnosis or backups. Processing on our behalf is governed by Article 28 GDPR agreements. Backups are stored, among other places, in Amazon S3. Calendar, task and AI providers you connect receive the data needed for your connection. Authorities or other recipients receive data only with an appropriate legal basis. We do not sell your personal data. Transfers outside the EEA must meet Articles 44 onward GDPR, for example an applicable adequacy decision or appropriate safeguards. Contact us for information about recipients used for your processing and relevant safeguards; the privacy notices of your chosen external providers also apply.
We operate the application ourselves on virtual servers provided by infrastructure provider 1blu. Email is provided by united-domains in Germany.
10. Retention and erasure
We store account and planning data for the duration of use unless you delete content earlier or request erasure. Archived entries remain stored and are not permanently erased. Sessions and tokens have the lifetimes described above; imported data and provider authorizations must be considered separately. Operational logs are retained for a limited period according to their security and diagnosis purpose; specific incidents may require longer case-specific retention. Support correspondence is retained as needed to resolve and document the request. Statutory retention duties and the necessary establishment or defense of legal claims can prevent immediate complete erasure. Such data is restricted to the relevant purpose. Backups are separate from live operations and replaced through the backup cycle; deleting live data does not immediately remove every older backup copy.
For operational diagnosis, the regular retention periods are 14 days for centralized operational logs and 30 days for technical metrics and error reports. For a specific security incident, necessary extracts are retained until the investigation and any necessary legal proceedings are complete; they are then erased unless statutory duties require retention.
11. Your rights and erasure requests
Subject to the GDPR, you can request access, rectification, erasure, restriction and data portability. Where processing relies on legitimate interests, you can object on grounds relating to your particular situation. Any consent can be withdrawn for the future. Write to support@planmy.day, including to request erasure of your whole account and planning data. We verify identity only as necessary and generally handle requests within one month; any legally permitted extension is explained. Logging out, archiving or removing an external connection does not erase your entire account. You may complain to a supervisory authority, particularly where you live, work or believe a breach occurred. The authority for our registered office is the Saxon Data Protection and Transparency Commissioner: datenschutz.sachsen.de.
12. Changes and further information
We update this notice when actual processing changes and communicate material changes appropriately. A new notice does not create consent. The four language editions describe the same processing. For questions about specific data, recipients or retention, contact support@planmy.day.