Privacy Policy

Introduction and Scope

This Privacy Policy describes how helpful bits GmbH ("we," "us," or "our") collects, uses, and discloses personal information when you use PlanToCode Desktop, the PlanToCode mobile apps, the PlanToCode browser extension, the website, and related services. Depending on your residence and whether a particular law applies to us, you may have the rights described below.

Effective Date: September 22, 2025. Last updated: July 29, 2026.

Company Information

The entity responsible for your personal information is:

Privacy Contact: For privacy inquiries and rights requests, contact Email.

Country-Level Availability Controls

PlanToCode availability varies by product surface, deployment, app-store territory, and payment configuration. At service and website edges, we may infer a country code from your network IP address to apply product-availability and security rules. App Store, Google Play, Microsoft Store, and payment providers may apply their own territory settings.

Purpose and limits: Country-level IP geolocation is used to decide whether a configured service or download is available and to protect the Service from abuse. It does not establish your identity, residence, citizenship, or sanctions status, and it is not restricted-party screening.

Access decisions: A configured edge may deny a request when the inferred country is unavailable or unknown. The request still passes through network infrastructure and may appear in ordinary security or access logs. Because IP geolocation can be inaccurate, contact us if you believe an availability decision is wrong.

Retention: Country codes and source IP addresses are retained with the relevant infrastructure or security logs only for as long as those logs are needed for operation, security, dispute handling, or legal obligations. The applicable period depends on the deployed service and is not a fixed universal period.

Notice at Collection

We collect the following categories of personal information from and about you:

Retention: There is no single retention period for every PlanToCode data flow. Current behavior is:

• Desktop workspace data: Stored locally until you delete the related session, project data, local database, or application data. Codex may maintain its own local session files under its configured data directory.
• PlanToCode account data: Kept while the account is active. The account-deletion flow removes the user record and associated PlanToCode database records that are configured to cascade with it.
• Billing records: PlanToCode database billing rows are removed with account deletion, but Stripe, Apple, Google, banks, or tax records may remain under their own retention rules or where accounting, dispute, fraud-prevention, or legal obligations require them.
• Provider content: Retention of prompts, outputs, audio, video, files, and security logs depends on the provider, account type, and configuration used for the requested operation.
• Browser bridge data: Full extracted content and screenshots are not retained in Chrome extension local storage. Results may remain in the related local run or provider context until you delete that data under the applicable product controls.
• Website data: Access and security logs follow the deployed infrastructure policy. Optional analytics or advertising data follows the configured provider and consent settings.
• Aggregate request telemetry: Identifier-free hourly server operation, outcome, and latency counters are kept for up to 25 months. General reporting aggregates them by day and suppresses cells below 25 requests. The threshold is not a distinct-user count or an anonymity guarantee. Deleted live rows may remain in rolling infrastructure backups for up to seven additional days.

Retention criteria: Where a fixed period is not implemented, we consider the purpose of the data, account state, user deletion actions, security needs, legal obligations, disputes, applicable limitation periods, and processor-controlled retention. Contact us for the current period that applies to a particular server-side record.

How We Use Information

We use your personal information for the following purposes:

• Service Provision: Providing desktop coding-agent sessions, mobile companion control, requested browser actions, transcription, review, and related services
• Account Management: Creating and managing your account, authenticating users
• Payment Processing: Processing payments, maintaining billing records, preventing fraud
• Customer Support: Responding to your inquiries and providing technical support
• Security: Protecting against security threats, fraud, and unauthorized access
• Legal Compliance: Complying with applicable laws, regulations, and legal processes
• Website Measurement: Measuring website interactions through configured analytics or attribution providers after cookie acceptance
• Communications: Sending you important account and service-related communications

Promotional communications: We do not use your personal information for promotional purposes without your explicit consent.

Desktop Application

PlanToCode Desktop combines local workspace storage with network services used for sign-in, updates, mobile relay, and user-requested provider operations:

• Local Data Storage: Workspace sessions, command output, local settings, and application diagnostics are stored on your computer
• Requested Runs: Codex and enabled tools may inspect and transmit the prompts, project content, command output, attachments, or browser results needed to complete your request
• Service Metadata: Account, device, app-version, network, relay, update, and security metadata may be sent when the related online feature is used
• Aggregate Request Telemetry:When an allowlisted online operation uses PlanToCode's servers, the server reduces the request to a count by fixed operation, outcome, latency range, binary release, and server region. Authentication, billing, device-management, support, consent, webhook, unknown, and catch-all routes are excluded. The rollups do not contain an account, device, installation, session, IP address, user agent, request path, request content, or free-form property. These are request counts, not counts of people or completed workflows.
• No Client App-Interaction Telemetry: The checked desktop and mobile releases do not send screen taps, local navigation, local diagnostics, crash reports, or onboarding events to a general app-interaction analytics pipeline.

Local Data: Project files remain on your computer unless a run or tool reads them for an action you requested. Session history and settings remain local unless you send or expose them through a requested relay, browser, support, or provider operation.

Data Transmission: Provider content is determined by the requested task, the files and tools used during the run, and the active provider configuration. Review approvals and generated changes before accepting them.

Browser Extension

PlanToCode Browser Bridge connects Chrome to the local PlanToCode desktop app through Chrome native messaging. The extension acts only on commands from the local desktop bridge.

• Browser tasks: When you ask PlanToCode to use Chrome, the extension may open or reuse tabs, open Google Search results, extract page text, inspect page controls, click, type, scroll, select options, set checkbox/radio/switch state, attach user-requested local files to web forms, take visible page screenshots, and close extension-created tabs.
• Browser data: Requested browser tasks may process tab URLs, tab titles, search queries, search result content, visible page text, iframe content, extracted Markdown, screenshots, DOM/accessibility metadata, labels or placeholders for form controls, and local file upload metadata such as file names and counts. Files that you ask PlanToCode to attach to a web form may be sent to that website by Chrome as part of the requested browser task.
• Sensitive content on requested pages: Page content and screenshots can incidentally contain personally identifiable information, health information, financial or payment information, authentication information, personal communications, user-generated content, or location information. The browser bridge processes such content only as part of the browser task you request; it is not used for advertising, credit decisions, or an unrelated purpose.
• Cookies: The extension does not request cookie permissions and does not export cookies. Markdown extraction does not intentionally include current form input values, but screenshots and visible page content may include sensitive data shown on the page.
• Local storage: Chrome local storage holds connection status, metadata-only command, result, and cleanup summaries, and records for extension-created tabs and dedicated windows. Extracted page content, screenshots, and full browser command results are not retained in Chrome local storage.
• Local bridge: The extension communicates with the PlanToCode native messaging host on the same computer. Browser command results are returned to PlanToCode Desktop, may appear in the run timeline, and may be included in agent context sent to your configured AI provider to complete the browser task you requested.
• Limited use: Browser data is used to provide the requested browser bridge feature, support the service, protect security, or comply with legal obligations. We do not sell browser data or use it for personalized advertising. The extension is designed so browser access starts with a command from the local PlanToCode bridge.

Mobile Apps

The PlanToCode Android and iOS apps are companion controls for desktop-owned sessions. They use native screens for project selection, workspace chat, files, diffs, settings, notifications, subscriptions, dictation, and Review Mode.

• Workspace content: Prompts, queued follow-ups, selected files, diffs, attachments, dictated text, and generated AI responses may be sent to PlanToCode services, the selected desktop, and configured AI providers only for the action you request.
• Notifications: iOS uses Apple Push Notification service tokens and Android uses Firebase Cloud Messaging tokens to route enabled notifications to the signed-in device.
• Subscriptions: Apple processes iOS subscription purchases and the iOS app reads StoreKit entitlement state. Google Play processes Android subscriptions and PlanToCode sends purchase tokens to Google Play for entitlement verification.
• Connected-workspace preview: After the first successful desktop RPC, PlanToCode stores non-reversible keyed identity digests with preview start and expiry timestamps in one shared account-control database. The digests are derived separately from the verified provider subject and normalized account email; PlanToCode does not store those raw values or a regional account ID. This minimal eligibility record remains while the preview program operates, including after account deletion, to prevent repeated claims.
• Dictation and Review Mode: Microphone audio is collected only after you start dictation or Review Mode. Screen media is collected only after you start Review Mode or choose media for analysis. The app uses the relevant system permission prompts and sends the recording for the requested transcription or analysis.
• AI-output reports: The mobile apps may let you send the project or session, prompt, generated output, and your explanation to support for review.

Information Sharing and Disclosure

We do not sell personal information. Optional Google Analytics and X advertising scripts may disclose browser and event data to those providers after cookie acceptance. Depending on the applicable law and configuration, advertising attribution can be treated as “sharing” or targeted advertising. We also disclose personal information in the following circumstances:

Service Providers

Third-party services used for particular features include:

• Auth0: Account authentication and identity-provider routing
• Stripe: Website and desktop payment processing and billing management
• Apple: iOS subscription processing and Apple Push Notification service delivery
• Microsoft Store: Windows desktop application distribution and updates
• Google Play: Android subscription processing and purchase-token verification
• Firebase Cloud Messaging: Android push notification delivery
• AI Service Providers: OpenAI, Anthropic, Google AI, xAI, and OpenRouter (depending on the selected feature and provider configuration)
• Website measurement and attribution: Google Analytics and the X pixel when configured and accepted
• Hosting, edge delivery, traffic security, and email: Hetzner, InterServer, Cloudflare, Amazon Web Services, and Mailgun where the related deployment or communication path uses them. Cloudflare currently proxies public website and API traffic and may process IP addresses, request metadata, URLs, country-routing signals, and content in transit.
• Help and feedback: Featurebase when you open the hosted support or feedback portal

Legal Requirements

We may disclose personal information when required by law or to:

• Comply with legal processes, court orders, or government requests
• Protect the rights, property, or safety of our company, users, or others
• Investigate potential violations of our terms of service
• Respond to claims of intellectual property infringement

Business Transfers

In the event of a merger, acquisition, financing, reorganization, or asset sale, personal information may be transferred as part of the transaction. We will provide any notice required by applicable law.

For the public list of supported providers and links to their policies, visit our provider page.

Third-Party AI Providers

When you use AI features in our application, your prompts and associated data may be processed by third-party AI service providers. Important details about AI data processing:

• Provider settings: Data use and retention depend on the provider, feature, account type, and active configuration. Where PlanToCode controls the provider configuration, we use available controls that limit training or secondary use. Settings controlled by your own provider account remain your responsibility.
• Task content: A requested operation may send prompts, files, command output, browser results, audio, video, or other context needed to complete that operation; it is not limited to text manually pasted into a prompt.
• Provider retention: Providers may retain content or security logs under their own terms and configuration. Review the linked policies and the current subprocessor page before sending sensitive material.

AI Provider Privacy Policies

• OpenAI: Privacy Policy
• Anthropic: Privacy Policy
• Google Gemini: Privacy Policy
• OpenRouter: Privacy Policy
• xAI: Privacy Policy

State Privacy Rights

Depending on your state of residence and whether the relevant law applies to PlanToCode, you may have rights to:

• Confirm whether we process your personal information and access that information
• Delete or correct personal information, subject to legal exceptions
• Receive a portable copy of certain information
• Opt out of a sale, sharing, targeted advertising, or qualifying profiling
• Appeal a denied request and exercise rights without unlawful discrimination

Email Email to submit a request. We will respond within the period required by the law that applies to your request.

California Privacy Rights (CCPA/CPRA)

If the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), applies to PlanToCode and your request, California residents have the following rights, subject to statutory exceptions:

Right to Know

• The categories and specific pieces of personal information we collect
• The categories of sources from which we collect personal information
• The business or commercial purpose for collecting personal information
• The categories of third parties with whom we share personal information
• The categories of personal information we disclose for business purposes

Right to Delete

You have the right to request deletion of your personal information, subject to certain exceptions such as:

• Completing transactions or providing requested goods/services
• Detecting security incidents or protecting against fraudulent activity
• Complying with legal obligations
• Enabling solely internal uses reasonably aligned with your expectations

Right to Correct

You have the right to request correction of inaccurate personal information we maintain about you.

Right to Opt-Out of Sale/Share

PlanToCode does not sell personal information. Optional Google Analytics and X advertising scripts may disclose browser or event data to those providers after you accept optional cookies. Depending on the configuration and applicable law, an advertising disclosure may be treated as “sharing” or targeted advertising. You can reject optional cookies or clear the plantocode_cookie_consent cookie to be asked again. You may also email Email with an opt-out request.

Right to Non-Discrimination

We will not discriminate against you for exercising your privacy rights, including by:

• Denying you goods or services
• Charging you different prices or rates
• Providing you a different level or quality of goods or services
• Suggesting that you may receive a different price or rate or level or quality

Sensitive Personal Information

PlanToCode does not ask you to provide a Social Security number, precise GPS location, or payment-card or bank-account number. User-selected prompts, project files, command output, audio, video, and browser pages can nevertheless contain sensitive information. Avoid sending sensitive information unless it is needed for the requested operation, and review the selected provider and its settings first.

Nevada Privacy Rights

Nevada residents have the right to opt-out of the sale of covered information under Nevada Senate Bill 220. We do not sell covered information as defined by Nevada law. However, if our practices change, Nevada residents may opt-out by emailing us at Email.

Children's Privacy (COPPA)

The Service is not intended for anyone under 18 years of age, and we do not knowingly offer accounts to children.

If you believe a child provided personal information through PlanToCode, contact Email. We will investigate and delete or otherwise handle the information as required by applicable law.

Security Measures

The checked PlanToCode implementation uses the following technical controls:

• Transport: Production web and relay endpoints are configured for HTTPS or WSS using TLS 1.2 or TLS 1.3
• Authentication: Auth0-backed access tokens protect account and authenticated service routes; individual identity providers may offer additional authentication factors
• Local storage: Workspace state and diagnostics are stored on the user's device; selected local secrets use operating-system credential storage or application encryption where implemented
• Service boundaries: Server routes validate authenticated user or device context before returning account, billing, or relay data
• Data minimization: PlanToCode does not request precise GPS location, contacts, advertising identifiers, or payment-card numbers

No electronic transmission or storage method is completely secure. Security controls differ across PlanToCode, your local environment, and third-party services.

Data Breach Notification

If a breach triggers a notice obligation, we will notify affected individuals and regulators in the form and within the time required by applicable state or federal law.

International Data Transfers

Personal information may be processed in Germany, where helpful bits GmbH is based, and in countries where the provider selected for an account or feature operates. The current provider list identifies the relevant services. Any transfer safeguards depend on the applicable law and the agreement and configuration in effect with that provider.

How to Exercise Your Rights

To exercise your privacy rights, you may contact us using the following methods:

Verification Process

To protect your privacy, we will verify your identity before processing rights requests. We may ask you to:

• Provide information that matches what we have on file
• Confirm your email address associated with your account
• Provide additional documentation if necessary for sensitive requests

Authorized Agents

You may designate an authorized agent to make privacy rights requests on your behalf. Authorized agents must provide:

• Written permission signed by you
• Proof of their own identity
• We may still require you to verify your identity directly

Do Not Sell or Share Personal Information

PlanToCode does not sell personal information.

Optional Google Analytics and X advertising scripts may disclose browser or event data to those providers after cookie acceptance. Depending on the configuration and applicable law, an advertising disclosure may be treated as “sharing” or targeted advertising.

Current Opt-Out Methods

Reject optional cookies when the consent banner appears. To change a stored choice, clear the plantocode_cookie_consent cookie and reload the site. You may also send an opt-out request to Email.

California "Shine the Light" Law

California residents may email Email to ask about disclosures covered by California Civil Code Section 1798.83, where that law applies.

Cookies and Tracking Technologies

The website stores a plantocode_cookie_consent cookie for up to 365 days after you accept or reject optional cookies. That cookie records the consent choice used by the site.

• Local event acknowledgement: Site interaction events may be sent to PlanToCode's /api/analytics/track endpoint. The checked endpoint validates and acknowledges the event; it does not persist or forward it.
• Google Analytics: Loaded only after acceptance when a Google measurement identifier is configured
• X pixel: Loaded only after acceptance when an X pixel identifier is configured
• Payment and account pages: Stripe, Auth0, Apple, or Google may use their own storage or tracking under their policies when you use those services

To withdraw or change your website choice, clear the plantocode_cookie_consent cookie and reload the site.

Changes to This Privacy Policy

We may update this privacy policy to reflect changes in our practices, technology, or legal requirements. We will post the updated version with a revised effective date and provide any additional notice required by applicable law.

We encourage you to review this privacy policy periodically to stay informed about our privacy practices.

Contact Us

If you have questions, concerns, or complaints about this privacy policy or our privacy practices, please contact us:

Response Times

We respond to privacy requests within the period required by the law applicable to the request. Verification, an authorized-agent request, or a permitted extension may affect timing.

Regulatory Complaints

If you believe we have not addressed your privacy concerns adequately, you have the right to file a complaint with relevant regulatory authorities:

• California: California Privacy Protection Agency (CPPA)
• Other States: Your state's Attorney General office
• Federal: Federal Trade Commission (FTC)