PlayPlanner

1. Who we are

PlayPlanner is a family venue discovery app. The data controller is Liam Evanson trading as PlayPlanner, based in the United Kingdom.

If you have questions about how we handle your data, or wish to exercise your rights, contact us at: privacy@playplanner.app

2. What personal data we collect

We collect only the data we need to provide the service.

Account data

• Email address — required to create and secure your account.
• Password — stored as a secure hash; we never see your plaintext password.
• Display name — visible to other users on reviews you write.
• Username — optional; visible to other users if set.
• Profile photo — optional; visible to other users if set.
• Bio — optional; visible to other users if set.

Family information

• Children's age ranges (e.g. "2–4", "5–7") — optional; stored as broad bands only. Exact dates of birth are never collected.
• Postcode — optional; used only to show venues near your area.

Location data

• Device location — only when you grant permission and only while using the map. We round coordinates to approximately 100 metres before use. We do not store your precise GPS coordinates on our servers.
• We do not track your location in the background. Location is only accessed when the app is open and you are using the map.
• A record that you gave or refused location permission is stored for GDPR accountability. This record contains only a timestamp and consent version — not your coordinates.

Content you create

• Venue reviews — including rating, visit date, and any age ranges you add.
• Venue photos — images you upload. Photos are stripped of EXIF metadata (including GPS tags) before storage.
• Venue submissions — held for moderation before publication.
• Favourites — the list of venues you have saved.

Technical data

• Session tokens — stored securely on your device to keep you logged in.
• GDPR audit log entries — records of consent events (terms accepted, location consent granted) for legal accountability. These contain only a user ID, action type, and timestamp — never your personal content.

3. Why we collect it and our lawful basis

Under UK GDPR, we must have a lawful basis for each processing activity.

• Providing the app and your account — contract (Article 6(1)(b)).
• Location-based venue search — consent (Article 6(1)(a)). You can withdraw at any time in Profile > Privacy Settings.
• Children's age ranges and postcode — consent (Article 6(1)(a)). Optional; delete at any time.
• Marketing emails — consent (Article 6(1)(a) + PECR). Only sent if you explicitly opt in.
• Reviews and photos — contract (Article 6(1)(b)).
• GDPR audit logging — legal obligation (Article 6(1)(c)) and legitimate interests (Article 6(1)(f)).
• Fraud prevention and platform safety — legitimate interests (Article 6(1)(f)).

4. Location data — additional detail

• Location is off by default. We never access it without your explicit permission.
• We ask for location permission only when you open the map screen.
• No background location tracking. We do not request the "always on" location permission. Location is only used while the app is open and you are actively browsing the map.
• Coordinates are rounded to approximately 100 metres (3 decimal places) before any processing. High-precision GPS coordinates are discarded immediately.
• Rounded coordinates are used only to query our venue database and return nearby results. They are not stored on our servers after the query completes.
• You can revoke location permission at any time in Profile > Privacy Settings or your device's system settings.

5. Children's data

PlayPlanner is designed for parents and carers aged 18 and over. We comply with the ICO Age-Appropriate Design Code (Children's Code).

• We do not knowingly collect data from children under 13.
• If you provide children's age ranges, we store them only as broad bands (e.g. "2–4"). We never collect children's names, exact dates of birth, or images of children.
• Children's age data is never shared with third parties or used for advertising.
• You can delete children's age ranges at any time in Profile > Edit Profile.

If you believe a child under 13 has created an account, please contact us at privacy@playplanner.app and we will delete the account promptly.

6. Who we share your data with

We work with the following data processors, each under a data processing agreement:

• Supabase Inc. (USA, with EU Standard Contractual Clauses) — our database and authentication provider. Stores account data, reviews, and photos on our behalf. supabase.com/privacy
• Google LLC — Google Maps SDK is used for the map display. Location queries sent to Google are anonymised (rounded coordinates). policies.google.com/privacy
• Open-Meteo — used to show weather forecasts on venue detail pages. Only a venue's approximate location (rounded coordinates) is sent; no personal data is included. Open-Meteo is a GDPR-compliant, privacy-friendly weather API. open-meteo.com/en/terms
• Stripe Inc. (if you purchase a Premium subscription) — processes payment card data. PlayPlanner never sees or stores your card number. stripe.com/gb/privacy
• Expo / EAS — used to build and deliver the app. No personal data is shared with Expo beyond what is standard for app delivery.

We may share data if required by law, court order, or regulatory authority. We will tell you if this happens unless legally prohibited from doing so.

7. International data transfers

Supabase stores data on servers in the European Union. Where any transfer outside the UK or EEA is required, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses.

8. How long we keep your data

• Account data — kept while your account is active. Deleted within 30 days of account deletion.
• Reviews and photos — kept until you delete them, or your account is deleted.
• Favourites — kept until you remove them or your account is deleted.
• Location consent log entries — kept for 3 years for ICO accountability, then deleted automatically.
• GDPR audit log entries — kept for 3 years then deleted automatically.
• Payment records — Stripe retains transaction records in line with their legal obligations (typically 7 years).

You can download all data we hold about you at any time in Profile > Download my data. You can delete your account and all associated data in Profile > Delete account.

9. Your rights under UK GDPR

To exercise any right, contact privacy@playplanner.app or use the in-app controls in Profile > Privacy Settings.

• Right of access (Article 15) — request a copy of all data we hold. Use "Download my data" in the app for an instant export.
• Right to rectification (Article 16) — correct inaccurate data in Profile > Edit Profile.
• Right to erasure (Article 17) — delete your account and all data in Profile > Delete account. Actioned within 30 days.
• Right to withdraw consent (Article 7(3)) — withdraw location or marketing consent at any time in Profile > Privacy Settings.
• Right to restriction (Article 18) — ask us to pause processing while a dispute is resolved.
• Right to data portability (Article 20) — receive your data in JSON via the "Download my data" feature.
• Right to object (Article 21) — object to processing based on legitimate interests.
• Right to complain to the ICO — ico.org.uk or 0303 123 1113. We would appreciate the chance to address your concerns first.

We will respond to rights requests within 30 days.

10. Cookies and local storage

The PlayPlanner app does not use tracking cookies. We store a session token on your device (using iOS Keychain / Android Keystore via expo-secure-store) solely to keep you logged in. This token contains no personal data and is deleted when you sign out.

11. Security

• Passwords hashed using bcrypt (handled by Supabase Auth).
• Session tokens stored in device secure storage — not browser cookies or AsyncStorage.
• Row-level security on all database tables — users can only access their own data.
• All data transmitted over HTTPS/TLS.
• Photo uploads stripped of EXIF metadata (including GPS tags) before storage.

If you discover a security vulnerability, please contact privacy@playplanner.app responsibly.

12. Changes to this policy

We will notify you of significant changes by in-app notification or email before the changes take effect. Continued use of PlayPlanner after the effective date constitutes acceptance of the updated policy.

13. Contact us

Data controller: Liam Evanson trading as PlayPlanner
Email: privacy@playplanner.app

For data rights requests, email with the subject line "Data Rights Request" and we will respond within 30 days.