PRIVACY

Privacy Policy

This policy explains which information PlanXtur uses when you visit the website or use the web app and Android app.

Last updated: 7 October 2026

1. Who is responsible?

PlanXtur is the name of the service. The legal name and postal address of the data controller are still missing and are clearly marked on the contact page. Questions about personal data can be sent to kontakt@planxtur.dk.

2. Which information do we process?

• Account: your name, email address, a hashed password, your email reminder preference and your chosen language (da/en), if saved on your account.
• Groups: group name, description, membership, role and the settings chosen by administrators.
• Trips and events: title, description, time, location, any price information, image or image URL, external links and information about the organizer.
• Responses and invitations: Yes/No/Maybe responses, invited email addresses, invitation status and links. Reminders and their delivery status are also stored.
• Login and security: a web session cookie or a token in the Android app’s secure storage. The server stores a hash of the session token together with its creation and expiry times. Password resets use a time-limited link; only the token’s hash is stored on the server.
• Push: if you allow push on Android, a device ID and push token are stored and linked to your account. A reminder may contain the event title and ID.
• Payment: the group’s plan, Stripe customer, subscription and price IDs, billing interval, subscription status and the end of the billing period. We do not store full card details in PlanXtur’s database.
• Technical operations: errors and security information may be included in server logs. When unexpected errors occur, the application logs the method and path without the request contents; retention and any additional logging by the hosting and proxy provider must be checked.

The web app can save your language choice locally in the browser under planxtur-language to remember your chosen language. A local marker under planxtur-onboarding-skipped-<user-id> remembers that you have hidden the onboarding guide. The code does not define an expiry time for these local preferences. You can remove them through your browser’s local storage settings.

Information about other people may also come from a group administrator when they create an invitation or event.

3. Why do we process this information?

We use this information to create accounts, provide access to groups, display and manage trips and responses, send invitations and selected reminders, manage subscriptions and protect the service against errors and misuse.

In general, processing takes place to provide the agreed service, meet any statutory requirements and pursue our legitimate interest in secure and stable operations. The precise legal basis for processing information about invited people and optional push must be confirmed through a legal review. Your phone’s push permission is a technical permission and does not in itself constitute general acceptance of this policy.

4. Who receives information?

• Other group members: information about the group, events and responses is shown to members according to their role and access rights.
• Stripe: used for Checkout, subscriptions and Customer Portal. Payment cards and payment flows are handled by Stripe; PlanXtur receives subscription status and Stripe IDs.
• Firebase Cloud Messaging / Google: used for Android push when you have granted permission on your device and the feature is configured. The push token and notification content are sent to the service for delivery.
• SMTP provider: if email delivery is configured, invitation, reminder and password reset emails are sent through the SMTP service selected by the operator. The provider’s name is not specified in the code.
• Hosting, backup and contact email: the server, database, backups and contact emails are handled by providers that cannot be reliably identified from the project. They must be disclosed and assessed before publication.

Providers’ roles, agreements and any transfers outside the EU/EEA must be checked individually. We do not state a geographical location that is not documented by the project.

5. How long is information stored?

Account and group content are stored while they are used to provide the service. Invitations and password reset links expire, but expiry does not necessarily mean that their database records are immediately deleted. A web session can be valid for no more than 30 days; expired sessions are removed when used again. A web app session can also be ended by logging out.

You can request deletion and use “Delete my account” in the app. Deletion may require a group to have another administrator first. Events taken over by another administrator and the group’s other content may remain visible to the group. Copies in backups, operational logs and payment information that must be kept by law may be retained for longer. Specific deletion periods for these categories have not yet been established and must be documented.

6. Your rights

Under the applicable rules, you may request access, rectification, erasure, restriction and, where relevant, data portability, or object to processing. Your rights depend on the particular processing and may be limited by other lawful considerations. Email kontakt@planxtur.dk to exercise your rights. You can also complain to Datatilsynet.

Read about technical storage on the Data Processing and Cookies page.