Privacy Policy

Scope of this policy

This policy applies to the OpenPlanr website at openplanr.dev, the hosted company application at app.openplanr.dev, and the related hosted services that support it (together, the "Hosted Services"). It also explains where the open-source tools fit.

Local and open-source use. The OpenPlanr CLI and local planning tools are MIT-licensed software that generally operate in your own environment. The plans, specifications, and code they work with stay where you run them unless you use a feature that sends them elsewhere. The CLI contacts the network only for features you invoke: Linear sync (linear.app), artifact sharing (share.openplanr.dev), and company sign-in (api.openplanr.dev).

Credentials used by the CLI. OpenPlanr bundles no connectors; they and their credentials live in your host. Two optional features need a token: Linear sync (openplanr linear) and company sign-in (openplanr company login). Only when you use them does OpenPlanr store a token, in your OS keychain, or in an encrypted file at ~/.planr/credentials.enc if you set PLANR_CREDENTIAL_FILE_PASSPHRASE. For Linear you can instead set PLANR_LINEAR_TOKEN and nothing is stored. Tokens are sent only to Linear or to the company server you sign in to. openplanr company logout removes company tokens.

Third-party AI and runtime services. The local tools can be configured to call AI models, coding agents, package registries, and other services that you select. Those providers process whatever you send them under their own terms and privacy practices, which we do not control. Review their policies before connecting them.

Information you provide

When you use the Hosted Services, you may provide:

• Account and profile information such as your name, email address, and profile image, including details passed to us by the sign-in provider you choose (for example, Google or Microsoft), and information about verified addresses, connected sign-in methods, sessions, multi-factor authentication, and account recovery.
• Organization and workspace information such as organization names, workspace names, member lists, roles, and invitations. For invitations, this can include the recipient email address, intended role, expiration, delivery status, and whether the invitation was accepted or revoked.
• Content you create or upload such as plans, specifications, artifacts, design bundles, review threads, comments, and anything you attach to them.
• Support requests including the messages and any files you send to us when you ask for help or report a problem.

Information collected automatically

When you visit the website or use the Hosted Services, we and our service providers may collect:

• Device and browser information such as browser type, operating system, screen size, and language settings.
• Logs and security events such as IP address, request timestamps and paths, sign-in attempts, access to shared artifacts, and errors, which help us keep the service reliable and secure.
• Cookies and session data needed to keep you signed in, remember your organization, and protect against cross-site request forgery. The Hosted Services do not work without these essential cookies.
• Analytics, where enabled, in the form of aggregated page-view, interaction, and performance measurements that help us understand how the website and product are used.

Website analytics

On openplanr.dev, including the documentation, we use Vercel Web Analytics to count page views and a few actions:

• copying an install command, a prompt, or another command;
• using a page's Copy page button or menu;
• opening search or a search result;
• answering the "Was this page helpful?" question; and
• asking the docs assistant a question or rating its answer.

Each action is recorded by name with up to four details from a fixed list: where on the site it happened, the docs section, the coding agent you selected (Claude Code, Codex, or Cursor), the ID of the prompt or command, whether you changed part of a prompt before copying it, whether you copied the terminal command or the prompt for a coding agent, which Copy page option you chose, how you opened search, the type and position of the result you opened, how an assistant question ended (answered, not covered by the docs, refused at a limit, or failed), how many pages an answer cited, which question of the conversation it was, and your helpful or not helpful answer. If you arrived through one of our campaign links, an install command copy also records that link's campaign tag.

These details never include personal data, the text you copy, or anything you type, such as search terms, prompt edits, or questions for the docs assistant.

To turn analytics off in your browser, open any page on the site with ?va-disable=1 at the end of the address, for example https://openplanr.dev/?va-disable=1. The site saves this choice in your browser's local storage, so it does not work if your browser blocks site storage, and it ends if you clear this site's data. To turn analytics back on, open a page with ?va-disable=0.

Docs assistant

If you ask the docs assistant a question, we send Anthropic your question, the earlier questions and answers in the same conversation, and the documentation passages that best match it, and Anthropic's Claude model writes the answer. Anthropic processes this under our commercial agreement for its API: it does not use the data to train its models without our permission, and it deletes API inputs and outputs within 30 days, subject to agreed retention arrangements, usage policy enforcement, and legal requirements. Zero data retention requires a separate agreement with Anthropic; we do not promise it for this assistant. Inputs and outputs that its safety systems flag for a usage policy violation can be kept for up to 2 years.

Before a question is sent, Vercel checks that it comes from a browser rather than an automated client, using signals from your browser, and counts questions by IP address to enforce a rate limit. Questions that fail either check are not sent to Anthropic.

We do not store your questions or the assistant's answers, and they are never part of our logs or analytics. Please do not include personal or confidential information in a question.

Identity, invitations, and product email

Authentication. OpenPlanr uses Clerk to support email verification codes, Google and Microsoft sign-in, sessions, multi-factor authentication, account recovery, and organization membership. Clerk processes the identity and security information needed to provide those functions. Your chosen Google or Microsoft account provider also processes the sign-in request under its own terms and privacy policy.

Organization invitations. Organization administrators can invite a person to become a member. Clerk delivers and manages those organization invitations as part of the identity service.

Scoped guest invitations. Project maintainers can invite a person to a specific artifact without making that person an organization member. OpenPlanr uses Resend to deliver these invitations and account-deletion notices. A guest invitation can be claimed only by a signed-in account with the matching verified email address.

How we use information

We use the information described above to:

• authenticate you and maintain your account and sessions;
• deliver collaboration features, including organizations, workspaces, artifact sharing, review, and comments;
• detect, prevent, and respond to abuse, fraud, security incidents, and violations of our terms;
• respond to support requests and communicate about the service;
• monitor and improve reliability, performance, and availability;
• understand how the product is used so we can improve it and plan new features; and
• comply with legal obligations.

How we share information

We share your information only in the following ways:

• With people you collaborate with. Members of your organization and people you share artifacts with can see the content you share, along with your name and profile details attached to it.
• With service providers. This includes Clerk for authentication and identity functions, Resend for product-generated email, Vercel for web application delivery, Cloudflare for edge, application, and storage services, and Anthropic for answering questions asked through the docs assistant. They process information as needed to provide their services to us. Our current service-provider list and the data involved are described on the Subprocessors page.
• For legal and safety reasons, where we believe in good faith that disclosure is required by law, legal process, or a government request, or is reasonably necessary to protect the rights, property, or safety of OpenPlanr, our users, or others.
• In a business transfer. If OpenPlanr is involved in a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction subject to this policy.

Retention and deletion

We keep information for as long as your account or organization is active and as needed to provide the Hosted Services. How long specific data is kept depends on what it is used for: for example, shared artifacts remain available while the share is active, and logs are kept for as long as they are needed for security and troubleshooting.

We may retain some information after account deletion where we need it to comply with legal obligations, resolve disputes, enforce our agreements, or maintain security, and in backups until those are rotated.

You can submit or cancel an account-deletion request through account settings, or contact support@openplanr.dev. Deletion is reviewed before processing because an account may be the last administrator of an organization, the last maintainer of shared content, or associated with records that must be retained for security, audit, dispute, or legal purposes. We will identify a blocker rather than silently deleting or transferring controlled content.

International processing

The Hosted Services are operated with infrastructure and service providers that may be located in countries other than the one you live in. By using the Hosted Services, you understand that your information may be transferred to, stored, and processed in those locations. Where the law requires safeguards for such transfers, we rely on the mechanisms available under applicable law.

Security

We use reasonable technical and organizational measures designed to protect information from unauthorized access, loss, or misuse. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe you have found a vulnerability or a security incident, please report it to security@openplanr.dev.

Your choices and rights

• Account information and security. You can review and update supported profile details, verified addresses, connected sign-in methods, multi-factor authentication, and sessions through account settings and your chosen sign-in provider.
• Sharing. You control which organizations you belong to and which artifacts you share, and you can revoke shares you created.
• Cookies. You can control cookies through your browser settings, but the Hosted Services will not function without essential session cookies.
• Access, correction, export, and deletion. You can ask us to access, correct, export, or delete your personal information by emailing support@openplanr.dev. Depending on where you live, you may have additional rights under applicable law; we will respond to requests as that law requires.

Children

The Hosted Services are not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has provided us with personal information, contact support@openplanr.dev and we will take appropriate steps to remove it.

Changes to this policy

We may update this policy from time to time. When we do, we will change the date at the top of this page and, for material changes, provide additional notice such as an email or an in-product message. Continuing to use the Hosted Services after a change takes effect means you accept the updated policy.

Contact

Questions about this policy or your information: support@openplanr.dev. Security reports: security@openplanr.dev.