Privacy

Last updated 25 August 2026. Written to be read, not to be survived.

ontoplano holds a diary. That is the whole reason this page is specific rather than a template: the thing you are storing here is the sort of thing you would not want read.

What is stored

• Your email address and name, because an account needs a way to be signed in to.
• A hash of your password. Not the password.
• Everything you write: blocks, tasks, goals, diary entries, notebooks, people, habits, ideas, shopping, quotes, and the numbers any plugin you connect pushes in.
• A short history of what happened to your account — signing in, changing a password, exporting, a plan change. You can see the same list an administrator can.
• The address you connected from, alongside those events, for as long as they are kept.

Where it is stored

In one SQLite database on the machine you installed it on. Backups are whatever you configured; nobody else has a copy.

Who can see it

Whoever administers the machine, which is you.

There is no analytics, no advertising, no third-party script, and nothing is sold to anyone.

Who else is involved

• Mail. Confirmation and password-reset messages go out through an SMTP server this instance is configured with. It sees your address and the text of those messages.
• Payment. If you subscribe, Lemon Squeezy handles the transaction as merchant of record. They see your billing details; this instance never does, and stores only the identifiers it needs to know your subscription is alive.
• Plugins. Anything you connect with an API token sees exactly the scopes you gave that token, and nothing else. You can revoke one at any time from Settings → Integrations.

Taking it with you, and getting rid of it

Settings → Account exports everything as one JSON file, and deletes the account. Deletion is immediate and complete: every row belonging to the account, including its history, in one transaction. There is no thirty-day grace period during which it is still there.

Backups are the exception, and the honest caveat: a snapshot taken before you deleted still contains what you deleted until it rotates out.

Cookies

One, called better-auth.session_token, which is what keeps you signed in. It is not shared, not read by anyone else, and there is nothing to consent to because there is nothing else being done with it. No tracking cookies means no cookie banner.

Asking about any of this

Write to you@example.com. It is read by a person.