Privacy Policy

Throughplan is provided by GRIIND s. r. o., Mierová 1099/66, 064 01 Stará Ľubovňa, Slovakia, company ID 53 821 173, VAT ID SK2121505331, registered in the Commercial Register of the District Court Prešov, section Sro, file no. 42298/P. In this policy, “we” and “us” mean that company.

We are the controller of the personal data described in this policy. We have not appointed a data protection officer; for anything about your data, write to info@throughplan.com.

Throughplan is a tool for planning software projects: it draws wireframes and writes technical specifications. It consists of our website, the web app, the desktop app and the cloud service behind them.

This policy covers the data we handle to run your account and the service. The content an organization stores in its projects (including any personal data in it and the data about the people it invites) is handled on that organization’s behalf. For that content the organization is the controller and we act as its processor under the Data Processing Addendum.

• Access requests. While access is invite-only you can leave your email address to be let in. We use it to confirm the request and to send you a sign-up link when a place opens, and we send ourselves a notice with that address. Basis: steps you asked for before entering into a contract (GDPR Art. 6(1)(b)). A request that does not lead to an account is kept for at most 12 months; once your account is created from it, it is kept until you delete the account; earlier if you ask.
• Your account. Name, email address, whether the address is verified, and your password, stored only as a salted hash. If you sign in with Google, we receive your name, email address and profile picture link, and store the Google account identifier and the tokens Google issues for the sign-in. We use none of them to reach any other Google data. Basis: performing our contract with you (Art. 6(1)(b)). Kept until you delete your account.
• Sign-in sessions. A session token, the IP address and browser (user agent) the session was started from, when it started and expires, and which workspace is active. We use them to keep you signed in, to show you your active sessions and to protect your account. A session stays valid for 7 days and is extended while you use the product. Basis: our contract (Art. 6(1)(b)) and our legitimate interest in security (Art. 6(1)(f)). Kept until you sign out or revoke the session, or until your account is deleted.
• Workspaces and collaboration. Workspace names, members and their roles, invitations (the invited email address and who invited them), client invitations and access grants, share links and who created them, comments (including the name a guest types when commenting through a share link), change requests, decisions, saved versions and project activity. Basis: our contract (Art. 6(1)(b)); for people an organization adds, the organization is the controller. Kept while the workspace exists.
• Project content. Wireframes, specifications, project instructions, your messages to the built-in assistant, images you attach to those messages, and the records of agent runs (their output, token counts and cost). It also includes what a coding agent you connected reports about a code repository when you allowed it to report: which parts of the specification it found there, file paths inside the repository, short notes and its verdicts, the repository’s name, branch and commit, and who ran the check through which connection. No code is stored, and a repository’s address is reduced to its name. Basis: our contract (Art. 6(1)(b)), on the organization’s behalf. Kept while the project and its workspace exist.
• Coding-agent connections. When you connect a coding agent, such as Claude Code or Cursor, to a workspace, we record the connection (you, the workspace, the agent’s name and the address it returns to after sign-in, when you connected it and last used it, and when, by whom and why it was revoked) and, for each request the agent makes, which tool it called, for which project and item, how it ended, how long it took and the IP address it came from, never the content it read. What an agent you allowed to report sends back is project content, described above. We use them to let the agent read and report only what you may, to show you and the workspace which agents are connected, and to protect the service. Basis: our contract (Art. 6(1)(b)) and our legitimate interest in security (Art. 6(1)(f)). A connection is kept, after it is revoked too, until your account or the workspace is deleted; the request records are kept for 180 days, also after your account is deleted, and daily totals per workspace, which name no one, for 400 days.
• Payments and invoices. Paid plans are sold through Link: Sold through Link, LLC, a Stripe company, sells them in its own name on our behalf as the merchant of record. When a workspace buys a plan, Link processes the buyer’s name, email address, billing address, VAT ID if given, and payment details as an independent controller under its own privacy policy (https://link.com/privacy). To open the purchase, we create a customer record in our Stripe account with the workspace’s name and identifier and the buyer’s email address and language. Link then makes each order available to us in that account: the buyer’s name, email and billing address, VAT ID, the type, brand and last four digits of the payment method, and the amounts, VAT, refunds and invoices; Stripe keeps these records on our behalf, as our processor. Into our own database we copy only the customer and subscription identifiers, the billing email, the brand and last four digits of the card, and each invoice’s number, amounts, VAT, billing period and dates. Basis: our contract with you (Art. 6(1)(b)); where the buyer acts for a business, our legitimate interest in performing our contract with that business (Art. 6(1)(f)); for our accounting records, our legal obligation (Art. 6(1)(c)). The identifiers, the billing email and the card details in our database are deleted with the workspace. The customer record in our Stripe account is deleted with the workspace. The orders, invoices and payments in that account, which carry the buyer’s name, email and billing address, cannot be deleted there by us: they stay for as long as Stripe keeps them under its own legal obligations, and after the workspace is deleted they are no longer linked to it in our database. Link issues the invoices and keeps them under its own legal obligations; we keep our record of each invoice for ten years after the end of the year it concerns, as the Slovak Accounting Act requires for accounting records (§ 35 of Act No. 431/2002 Coll.), and after the workspace is deleted that record is no longer linked to it. Link deletes the data of your purchases, including in our Stripe account, when you ask it to.
• Acceptance of the Terms. Which version of the Terms you accepted, when, and whether at sign-up or when buying a plan (with the workspace). We keep it to be able to show what was agreed. Basis: our legitimate interest in proving the contract (Art. 6(1)(f)). Kept until you delete your account.
• Feedback. What you send through “Report a problem”: your message, any screenshots you attach, and the app version, whether you sent it from the web app or the desktop app, and your browser or system details at the time, together with your account and the workspace you sent it from, so we can reply and improve the product. Our reply and the versions that carry the fix are shown back to you in the app. A screenshot you upload but do not send is deleted within two days. Basis: our legitimate interest (Art. 6(1)(f)). Kept until you delete your account or the workspace you sent it from.
• Product usage records. When our servers see something happen in the product: you create an account (and whether with email or with Google), your email address is verified, you sign in, you create a project, you send a message in a project’s chat, an analysis of a project is saved, an agent run on a project finishes (which agent, and whether it succeeded), a client accepts an invitation to a project, a checkout for a paid plan is opened (which plan and billing period), and a share link to a project is opened. Each record holds the time, the account and the workspace it happened in (a share link opened by a guest is linked to the workspace only) and never a project’s name or content, a message, a finding or an email address. And for each day you use the web app or the desktop app, which of the two it was, taken from the request the app makes to load your session. From these records we also keep the date your email address was verified, the dates you first ran an agent and first opened a checkout, and, if you own a workspace, the date its first paid plan started. They show us whether the product is being adopted and where people stop on the way to a paid plan, and they are linked to your account.
• Where a new account came from. When you create an account in the web app, we also record where you arrived from: the name of the website that linked to the page you opened first, the campaign tags in that page’s address (utm_source, utm_medium and utm_campaign, for example “newsletter”) and the route pattern of that page (for example /pricing), never its full address. The web app keeps them only in the open page, stores nothing on your device for this, and sends them once, after you sign up; if you sign up with Google or confirm your email address through the emailed link, they travel in the address you return to, and the app removes them from it as soon as it has read them. We store them only once, only for an account created less than a day earlier, and they are linked to your account.
• Page views. Which screen of the web app or page of our public site was shown: its route pattern (for example /projects/:id), never the full address, the project it points to or anything you typed; whether it started a visit, and, for the first page of a visit, the name of the website that linked to it. A page view is linked to your account and the workspace you were in only when you are signed in and have allowed Analytics in the cookie settings; otherwise it is linked to nothing. We store no IP address or browser details with it. The same rule applies when you download an export of a project, its handoff pack or a client deliverable (we record the file format and which of the three it was) and when you click a call to move to a larger plan (we record where in the product it was).
• Website and app measurement through Google Tag Manager. If you allow Analytics in the cookie settings, your browser loads Google Tag Manager, which loads Google Analytics, the one measurement tag we have configured. From then on, each page you open sends Google Analytics, for our public pages, the page’s address, its title and the page you came from, and for screens inside the product only the shape of the address (for example /projects/:id) and a general title of the screen, never the address itself, its query string or the name of a project or workspace, and never an identifier of your account; it also records scrolling to the end of a page, clicks on links to other sites, file downloads, video plays and searches on our site, and receives the information your browser sends with any request, including your IP address and browser details. Google Analytics sets the cookies “_ga” and “_ga_K834Y3NKQ9” on our site, which expire 13 months after your first visit, keeps the data of individual visits for 14 months and does not link them to Google accounts (Google signals is off). Basis: your consent (Art. 6(1)(a)), which § 109(8) of Slovak Act No. 452/2021 Coll. on Electronic Communications also requires for storing information on your device and reading it from there; you can withdraw it at any time through Cookie settings or in Settings → Legal & privacy, with effect from that moment, and the Google Analytics cookies are then deleted. Nothing of this is loaded before you allow it.
• Chat on our public website. Our public pages show a chat button; nothing is loaded and nothing is sent until you click it. When you click it, your browser loads the chat from Namiru, a service of Crowie s. r. o., our processor. From then on Namiru receives what you write in the chat, any contact details you choose to give there (such as a name, an email address or a phone number) and the information your browser sends with any request, including your IP address and browser details; it uses the IP address for security and to work out your country, and keeps only a keyed hash of it with the conversation. The replies are written by AI: Namiru sends your messages to the AI providers it uses, to write each reply and a short summary of the conversation for us. So that a conversation can continue, the chat stores a random visitor identifier in your browser, for 30 days after your last chat, and a session identifier for the open tab, both only after you open the chat. We read the conversations to answer you and to improve our website and the product. The chat is not shown inside the product, and a conversation is not linked to your account unless you identify yourself in it. Please do not write sensitive information into the chat. Basis: our legitimate interest in answering the questions visitors ask us (Art. 6(1)(f)); the two identifiers need no consent, because they are strictly necessary for a service you asked for by opening the chat. Namiru deletes its chat message logs after 90 days; the conversations themselves stay in our Namiru account until we delete them, which we do on your request.
• Desktop app launches. The app version, operating system and processor type, each time the desktop app starts its window. A launch is linked to nothing, not even when the app is connected to your account.
• Release rehearsals. Before each release we try it out on a separate copy of our database, on the same server, which only our own staff can open. In that copy, names, email addresses, IP addresses, the names and content of workspaces and projects, messages, comments and feedback are replaced with placeholders, sign-in sessions and passwords are removed, and no files are copied; identifiers, dates, plans, invoice amounts, records of accepting the Terms and usage records stay as they are, so we could still tell which of the placeholders is you. Each release replaces the previous copy, so a correction or deletion reaches it at the next release. Basis: our legitimate interest in releasing changes that do not harm the service or your data (Art. 6(1)(f)).
• Security records. An audit log of sensitive actions in a workspace: who did what and when, and for some actions (such as deleting or restoring a project, creating or revoking a share link, inviting a client, approving a specification or changing the plan) the IP address the action came from. Basis: our legitimate interest in security and accountability (Art. 6(1)(f)). Kept for as long as the workspace exists.
• Server logs. For each request: its time, method, route, response status, a request identifier and the IP address it came from. We use them to operate and secure the service; passwords, tokens and similar secrets are removed before anything is written. Basis: our legitimate interest (Art. 6(1)(f)). Kept only on the server, and discarded when the logs rotate or the service is redeployed.
• Error reports. When something breaks, a technical report of the error: what failed and where in the code, the steps that led to it (screens opened, requests made, buttons clicked), the address of the page, the app version, your browser or operating system, and your language and time zone. Reports carry no name or email address, only the identifier of your account and of the workspace you were working in, so that we can find the errors that affected you when you ask us for help; secrets are removed before a report is sent, reporting is set up not to record your IP address, and in the browser it stores nothing on your device. Error reports from our servers, from your browser and from the desktop app are sent on the basis of our legitimate interest in keeping the service working and secure (Art. 6(1)(f)), because without them we cannot find what breaks. Your browser and the desktop app send them by default, whether you are signed in or not; the browser also tells the provider when a session starts, so we can see how often sessions end in an error, and the desktop app tells it when the app starts and whether it closed normally. You can switch reports from your browser off in Cookie settings or in Settings → Legal & privacy, and reports from the desktop app in its Settings → Legal & privacy; switching off stops reporting at once on that device and stays in effect until you switch reports on again. To be able to report a crash, the desktop app keeps details of the running session, and of any crash, in its own folder on your computer; they leave it only as reports while reporting is on. Kept by our error-monitoring provider for at most 90 days.
• Contract withdrawals. The name, the email address and the choice of what you withdraw from (a paid plan, a move up to Team or your account) that you enter in the withdrawal form, and when we received them. We look the address up among accounts and among the billing addresses of paid plans, use it to confirm the withdrawal to that address and keep the confirmation as our record of it. When neither an account nor a paid plan uses the address, we send it nothing but still keep the withdrawal and look for the contract it concerns. Basis: our legal obligation under consumer protection law to confirm and carry out the withdrawal (Art. 6(1)(c)); keeping the record afterwards rests on our legitimate interest in proving it (Art. 6(1)(f)). Kept for 3 years, the general limitation period for claims under the contract.
• Emails. We send account verification, password reset, workspace invitations (to the invited person, naming who invited them and the workspace), client invitations, access-request confirmations and approvals, and notices about a workspace’s plan, such as when it starts or ends and when access is about to be limited or projects locked, the confirmation of your contract when your account is created, a plan is bought or moved up, and the confirmation of a withdrawal, and the emails about deleting an account: the link to confirm a deletion you asked for by email, the notice that it is scheduled, cancelled or done, and the notices to the members of a workspace that is handed over or will be deleted with it. Invoices and receipts come from Link. Basis: our contract (Art. 6(1)(b)); for the contract and withdrawal confirmations, our legal obligation (Art. 6(1)(c)).
• Email delivery log. For each email we send: its kind (for example, a password reset), when we sent it, whether our email provider accepted it and, if not, the error, and the identifier of the account it was for, if there is one, never the address, the subject or the content. We use it to see whether emails reach the people they are for, and to answer when you ask whether we sent you one. Basis: our legitimate interest in keeping the service working and secure (Art. 6(1)(f)). Kept for 90 days; when you delete your account, its entries stay until then but are no longer linked to it.

Product usage records, where a new account came from, desktop app launches, and page views, downloads and upgrade clicks that are linked to nothing rest on our legitimate interest in understanding how the product is used so we can improve it (Art. 6(1)(f)); page views, downloads and upgrade clicks linked to your account rest on your consent (Art. 6(1)(a)). All of them are our own statistics, counted on our own servers, and only they can be linked to your account. A separate count reaches Google Analytics, only for visitors who allow Analytics, and is never linked to an account; the two are described separately above because they are two different things.

We do not sell personal data, we show no advertising inside the product, and we make no decisions about you by automated means that have legal or similarly significant effects.

The engine that turns your descriptions into wireframes and specifications runs inside the Throughplan desktop app on your own computer. It uses the AI tool you have installed and signed in to yourself: Claude Code from Anthropic or Codex from OpenAI.

To do its work, the engine sends that provider a summary of your project, the project’s instructions, what you are editing, your messages and, for Claude, the images you attach. This goes straight from your computer to the provider under your own agreement with them; it never passes through our servers, and we neither receive nor control that processing.

Our cloud service never runs an AI model and never sends your project content to one.

We use these providers to run the service. Each processes personal data only on our instructions and under a data processing agreement:

• Contabo GmbH: Server hosting for the application, its database and file storage. Location: Germany; the server is located in the European Union.
• Mailjet SAS (part of the Sinch group): Sending account, invitation, access and plan emails. Location: France (European Union); email data is hosted in the European Union. Transfer safeguard: for its support providers outside the EU, the European Commission’s Standard Contractual Clauses in its data processing agreement.
• Functional Software, Inc. (Sentry): Error monitoring for our servers and for the web and desktop apps, unless you switch it off. Location: European Union (Germany); operator in the United States. Transfer safeguard: EU–US Data Privacy Framework certification, with the European Commission’s Standard Contractual Clauses as a fallback.
• Stripe Payments Europe, Limited, with Stripe, LLC: Keeping the customer, subscription and invoice records of our Stripe account. Location: Ireland (European Union), with processing by Stripe, LLC in the United States. Transfer safeguard: EU–US Data Privacy Framework certification, with the European Commission’s Standard Contractual Clauses as a fallback.
• Google Ireland Limited (Google Tag Manager, Google Analytics): Measuring how our website and web app are used, through Google Tag Manager and Google Analytics, only for visitors who allow analytics. Location: Ireland (European Union), with possible processing by Google LLC in the United States. Transfer safeguard: EU–US Data Privacy Framework certification, with the European Commission’s Standard Contractual Clauses as a fallback.
• Crowie s. r. o. (Namiru): Running the chat on our public website and writing its replies with AI, only for visitors who open the chat. Location: Slovakia (European Union); conversations are hosted in the European Union (Germany), and replies are written by AI providers in the United States, Singapore and China. Transfer safeguard: for its AI providers outside the EU, the EU–US Data Privacy Framework where a provider in the United States is certified, and otherwise the European Commission’s Standard Contractual Clauses.

If you choose to sign in with Google, Google Ireland Limited handles that sign-in as its own controller under its own privacy policy.

If you allow Analytics, Google Analytics sends the data described above to Google Ireland Limited, which processes it as our processor, only on our instructions and under the Google Ads Data Processing Terms, which are Google’s processor terms for Google Analytics too and which we have accepted; we do not allow Google to use it for its own products and services.

If you open the chat on our public website, what you write there goes to Crowie s. r. o., which runs Namiru and processes it as our processor, only on our instructions and under its Data Processing Agreement, and to the AI providers it engages to write the replies: OpenRouter, Inc. in the United States, which passes each message to the provider of the model, at present Alibaba Cloud in Singapore, with data centres in Singapore and China. Namiru does not use the conversations to train models of its own.

When a workspace buys a paid plan, Link sells it on our behalf and processes the buyer’s payment and billing data as its own controller under its own privacy policy (https://link.com/privacy). Stripe, which provides our Stripe account, keeps the customer and order records in it for us as our processor.

Inside the product, the people you work with see what you share with them: members of your workspace, clients you invite, and anyone holding a share link you created. A coding agent that a member connects to a workspace reads that workspace’s projects on the member’s behalf and, when the member allows it, reports what it found in a code repository; the report is shown to the workspace’s members who can open the project, never to clients. What the agent and its provider do with what they read is governed by the member’s own agreement with that provider. We disclose data to authorities only when the law requires it.

Our database and file storage, the database’s backups and the copy we rehearse releases on all run on a server in the European Union. Error reports are stored by Sentry in its European Union region (Germany); Sentry’s operator, Functional Software, Inc., is based in the United States, so its staff may access them from there, under its certification under the EU–US Data Privacy Framework with the European Commission’s Standard Contractual Clauses as a fallback. Our email provider keeps email data in the European Union; its support providers outside the EU work under the Standard Contractual Clauses. If you allow Analytics, the Google Analytics data described above goes to Google Ireland Limited and may be processed by Google LLC in the United States, which is certified under the EU–US Data Privacy Framework, with the Standard Contractual Clauses as a fallback. Stripe processes the records of our Stripe account in the United States as well; that transfer relies on Stripe, LLC’s certification under the EU–US Data Privacy Framework, with the Standard Contractual Clauses in Stripe’s data processing agreement as a fallback. Link, which receives the buyer’s payment details directly at checkout, transfers them under its own privacy policy. Google as a sign-in provider and the AI provider you use handle any transfer of your data under their own terms. Namiru keeps chat conversations on servers in the European Union (Germany). To write replies, it sends the chat messages to AI providers in the United States, Singapore and China; it relies on the EU–US Data Privacy Framework where a provider in the United States is certified, and otherwise on the European Commission’s Standard Contractual Clauses.

You can delete your account in Settings → Account, or ask us to by email at info@throughplan.com; for a request by email we send your account’s address a link to confirm it, valid for 7 days, and nothing happens unless it is used. Once the deletion is confirmed, your account is disabled at once (you are signed out everywhere, cannot sign in, and the coding agents you connected are disconnected) and it is deleted 14 days later; until then, the link in the email we send you cancels the deletion. Cancelling does not bring back a paid plan that ended with the deletion or a workspace you handed over.

Deleting your account deletes your profile, sign-in methods and sessions, your workspace memberships, your coding-agent connections, your records of accepting the Terms, your feedback with its screenshots and your notifications, and your usage records. Projects you created in a team workspace, or that were handed to you there, stay with the team: they pass to the workspace’s longest-standing owner (or, if there is none, an admin or the longest-standing member). The same happens when you are removed from a team workspace. Workspaces in which you are the only member are deleted with your account, including their projects and files and the feedback and screenshots sent from them. For each workspace you are the only owner of that still has other members, you choose to hand it over to one of them, who becomes its owner at once, or to cancel it: its members are told the date, and it is deleted with your account; a request by email that makes no choice cancels it. The paid plans of the workspaces you are the only owner of end when the deletion is confirmed.

After the deletion we keep a record of it that holds only a one-way hash of your email address, the dates of the request and the deletion, how it was requested and our reference to it, to prove the deletion and to apply it again if we ever restore a backup. Basis: our legal obligation to erase your data and to be able to show that we did (Art. 6(1)(c), with Art. 17 and Art. 5(2)), and our legitimate interest in defending legal claims (Art. 6(1)(f)). Kept for 3 years after the deletion, the general limitation period for claims.

A workspace owner can delete the whole workspace in Settings → Danger zone. This deletes its projects, members, invitations, client access, comments, activity, audit log, the images attached in its builder chats, and the problem reports sent from it with their screenshots. Page views and usage records linked to it lose that link and expire on their normal schedule.

Some records stay after you leave a team workspace or delete your account: that workspace’s audit log and project history keep a reference to your account (and, in the audit log, the IP address of the action) for as long as the workspace exists, the problem reports you sent from a team workspace you left stay there with their screenshots until you delete your account or the workspace is deleted, the records of your coding agents’ requests stay until they expire after 180 days, what a coding agent reported for you about a repository stays with its project, with a reference to your account, for as long as the project exists, and an access request stays for as long as described above. We delete any of these on request.

Deleting a project moves it to the trash, where it stays (and can be restored) until the workspace is deleted.

Our database is backed up every night, and each backup is overwritten within 35 days, so deleted data leaves the backups within 35 days of its deletion. The copy we rehearse releases on is replaced at every release.

Product usage records, page views, downloads, upgrade clicks and desktop app launches are kept for 13 months. The days on which your account was active, and daily totals derived from these records, are kept for 400 days. The dates you were first and last active, last signed in, created your first project, had your email address verified, first ran an agent, first opened a checkout and first paid, and where your account came from, are kept for as long as your account exists. Deleting your account deletes every one of these records that is linked to it; records linked to no account expire on the same schedule, and the daily totals are not linked to any account and remain.

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate data corrected: you can change your name in Settings → Account;
• have your data erased: see “Deleting your data” above;
• restrict how we use your data, while you contest its accuracy or your objection is being considered, where the processing is unlawful but you prefer restriction to erasure, or where we no longer need the data but you need it for a legal claim;
• receive your data in a portable format: Settings → General exports all of a workspace’s projects as JSON with Markdown, and any project can be exported on its own as JSON, Markdown or PDF;
• object to processing based on our legitimate interest: see “Your right to object” below;
• withdraw any consent you gave in the cookie settings at any time, purpose by purpose and as easily as you gave it (through Cookie settings in the footer of our website or the account menu of the app, or in Settings → Legal & privacy), without affecting what was sent before.

Your right to object. Where we rely on our legitimate interest (product usage records, page views linked to nothing, desktop app launches, coding-agent request records, release rehearsals, security records, server logs, the email delivery log, feedback, records of accepting the Terms, a business buyer’s payment records, the record kept after an account is deleted and error reports), you can object at any time, on grounds relating to your particular situation, by writing to info@throughplan.com. We then stop that processing for you unless we have compelling legitimate grounds that override your interests, such as keeping the service and its users secure, or need it for legal claims. To object to error reports from your browser or the desktop app you need not write to us: switching them off in Cookie settings or in Settings → Legal & privacy stops them at once on that device.

For anything the product does not let you do yourself, write to info@throughplan.com. We answer within one month, and we may ask you to confirm the request from the email address of your account.

You can also complain to a data protection authority. Ours is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, Slovakia (https://dataprotection.gov.sk); you may also go to the authority where you live or work.

• All traffic to the service is encrypted in transit (HTTPS).
• Each workspace’s data is isolated in the database with row-level security, and the application connects with a role that cannot bypass it.
• The database is reachable only over a private network, not from the internet.
• The database is backed up every night; the backups are kept on the same server, readable only by its administrators, and overwritten within 35 days.
• Passwords are stored only as salted hashes; you can review and revoke your sessions.
• Requests are rate-limited, sensitive actions are written to an audit log, and secrets are removed from logs and error reports.

An email address and a name are needed to create an account; without them we cannot provide the service. Everything else you add is your choice.

Throughplan is a tool for professional work and is not aimed at children. If someone under 16 uses it, any consent the service asks for, such as in the cookie settings, must be given or approved by their parent or guardian.

When we change this policy we update the date at the top. We announce material changes in the product or by email before they take effect.

Privacy questions and requests: info@throughplan.com, by phone on +421 918 940 280, or by post to GRIIND s. r. o., Mierová 1099/66, 064 01 Stará Ľubovňa, Slovakia.