Privacy Policy
Last updated: 27 October 2026
We collect only what we need to run your planner, take payments and support you, and your planner content is encrypted in your browser before it reaches us. This policy is from Yohan Jerome Prakash, trading as Slate & Serif (ABN 44 977 969 075). We handle personal information in line with the Australian Privacy Principles.
1. What we collect
| Information | Examples | Why |
|---|---|---|
| Account | Email address, sign-in method, account ID, settings | To create your account and let you sign in |
| Purchases | Plan bought, amount, date, Stripe payment and refund references, access dates, Premium credit balance | To give you access, process refunds and keep financial records |
| Encrypted planner content | Your entries, notebooks, images and stickers, stored only in encrypted form, plus technical labels such as versions and timestamps | To save, sync, back up and restore your planner |
| Security | Sign-in and session records, IP address, browser type, bot-check results | To protect accounts and stop fraud and abuse |
| Planner and sample traffic | Technical request information, such as IP address, browser and device details, requested page, time, response status, approximate location and referring site when available | To deliver the planner and sample, investigate errors and performance, protect the service and understand aggregate use |
| Support | Messages and contact details you send by email or support chat; a signed support identifier; and chat-related technical information such as IP address, browser and device details | To answer your questions, connect the conversation to your account and operate the support service |
| Notifications (if you turn them on) | A browser notification token | To send the reminders you ask for |
We never receive your full card number; Stripe handles card details. We do not ask for, and you should never send us, a password, planner PIN, Maximum Privacy passphrase or recovery code.
2. Your encrypted planner
Your planner content is encrypted on your device before it is saved. Our servers, database and backups hold the encrypted version, not readable text.
- With account-only, planner PIN or planner-password protection, we can help you recover access after verifying your identity. These modes are not "zero knowledge".
- With Maximum Privacy, only your passphrase or recovery code can unlock your planner, and we cannot recover it.
We do not read your planner content, sell it, use it for advertising, or use it to train AI models.
3. Who helps us run the service
We share personal information only with providers who help us run Slate & Serif, and only what each needs. Optional support chat is provided by tawk.to and loads when you choose to open it. It receives a signed support identifier, your messages and the details you submit, and technical information needed to operate the widget. Support messages are handled by the support provider and are separate from your encrypted planner content. Maximum Privacy protection for planner content does not apply to messages you send in chat.
| Provider | What they do for us | Where data may be processed |
|---|---|---|
| Stripe | Payments, refunds and receipts | United States and other countries |
| Supabase | Database and account sign-in. Account emails are sent through Resend, an email delivery service in the United States | United States |
| Vercel | Hosts the planner app and public sample, and processes technical request information and traffic reports | United States and a global network |
| Cloudflare | Encrypted independent backups and bot protection on sign-in pages | Global network |
| Google and Microsoft | Sign-in, only if you choose "Continue with Google" or "Continue with Microsoft" | United States and other countries |
| Shopify | Hosts our marketing website, slateandserif.com. It does not take payments for the planner | Canada, United States and other countries |
| tawk.to | Optional support chat and conversation storage | United States for Google Cloud storage, with a global delivery network |
| Google (Gmail) | Our support email inbox | United States and other countries |
| Your browser's notification service (for example Apple, Google or Mozilla) | Delivers notifications, only if you turn them on | Varies by browser |
We may also disclose information where the law requires it, to protect people or the service, or as part of selling or restructuring the business. We do not sell personal information.
4. Calendar and task connections
The planner does not currently offer calendar or task connections. Two-way Google and Outlook calendar sync is planned for later. Before we offer them, we will update this policy to explain exactly which fields are shared, with whom and how to disconnect.
5. Our marketing website and cookies
slateandserif.com runs on Shopify, which sets cookies so the site works and to measure visits. Shopify's own privacy policy explains how it uses that information. The planner app uses storage for sign-in, security and saving your planner. If you open optional support chat, its separate frame and the provider also use cookies and browser storage for the chat session and service operation. Our isolated frame keeps an opaque account marker to separate account sessions. Closing chat does not delete the provider's conversation history. We do not use advertising trackers in the planner.
Planner and sample usage information
Vercel receives technical request information when you visit planner.slateandserif.com, including the public sample at /sample and these policy pages. We can review aggregate page loads, errors, bot classifications and counts of different network addresses. These figures do not tell us exactly how many people visited or who is using an open sample. Repeat visits, shared networks, automated traffic and our testing can affect the figures.
These hosting reports do not contain the text you write in the planner. We do not currently use an optional visitor-tracking script or usage-analytics cookies in the planner or sample. We do not use session replay or browser fingerprinting to analyse planner or sample use, and we do not link sample traffic reports to an email mailing list.
Before introducing optional usage analytics, we will explain what it collects, its purpose, the provider, retention and your choices at the point where it is used. We will provide an easy way to turn it off and obtain consent before collection wherever required. A privacy-policy update alone will not be treated as your consent. Necessary service and security logging is separate from optional analytics.
6. Emails we send
We send account emails (such as confirming your email address), and Stripe sends payment and refund receipts. We send marketing emails only if you subscribe, and every marketing email has an unsubscribe link.
7. How long we keep information
- Your planner stays in your account while the account exists, including the read-only period after your access ends.
- A planner document you delete can be recovered for up to 365 days, then it expires.
- Purchase and refund records are kept as long as tax and financial law requires.
- When you ask us to delete your account, we delete your account and planner data from our live systems. Encrypted backups are locked against changes for a set time, so encrypted copies may remain until that lock period ends, and then they expire. Support chat has separate retention: tawk.to states that chats and tickets remain stored until they are deleted, subject to its legal-retention and backup exceptions. You can contact us about deleting support information.
Hosting request records follow Vercel's retention settings for our service. Any identifiable technical records we retain separately are kept only as long as needed for a specific security, troubleshooting or legal purpose. Aggregate reports that no longer identify individuals may be kept to compare service usage over time. We do not keep a permanent individual browsing history for the sample.
8. Your choices and rights
You can ask to access, correct, export or delete your personal information. Email us from your account address, and we may need to verify your identity. You can export your planner from inside the app. Some records, such as purchase and fraud-prevention records, may be kept where the law requires or allows it, and we will tell you if that applies. If you live in the European Union or United Kingdom, you also have the rights your local law gives you, including to object to or restrict some uses.
You do not need a planner account to ask a privacy question about the sample. Contact slateandserif@gmail.com. We will request only the information reasonably needed to handle your request; please do not send planner contents, passwords or recovery information.
Australia
You can request access to, or correction of, the personal information we hold about you. Contact us with your request or privacy complaint and we will explain our response and any applicable exception. If a complaint is not resolved, you can contact the Office of the Australian Information Commissioner at oaic.gov.au. Our provider table explains where overseas processing may occur.
European Economic Area and United Kingdom
Where EU or UK data-protection law applies, Yohan Jerome Prakash, trading as Slate & Serif, is responsible for the processing described in this policy. We use account and purchase information to provide the service you request, financial records to meet legal obligations, and necessary technical information for our legitimate interests in running a secure, reliable service and understanding aggregate use, balanced against your rights. Where optional processing requires consent, we obtain it before that processing starts. Providing account information is necessary to open an account; the public sample does not require one.
Subject to the conditions in the applicable law, you can request access, correction, erasure, restriction or a portable copy of your personal information. You can object to processing based on legitimate interests and withdraw consent for processing based on consent, without affecting the lawfulness of earlier processing. Contact us to exercise these rights. We will respond within the applicable legal timeframe and explain any permitted exception or extension. You can complain to your local data-protection authority, including the UK Information Commissioner's Office at ico.org.uk or the authority in your EEA country.
United States
Depending on your US state and which privacy laws apply, you may have rights to know about, access, correct, delete or obtain a copy of your personal information, and to appeal a refused request. Contact us to exercise applicable rights or appeal our response. We do not sell planner or sample personal information, share it for cross-context behavioural advertising, or use it for targeted advertising. You will not receive a worse planner service for exercising applicable privacy rights.
9. Security
We use browser encryption, encrypted connections, restricted access to our systems and independent encrypted backups. No system is perfectly secure, so please use a strong, unique password and keep your recovery code somewhere safe.
10. Age
The planner is for people aged 18 or older. We do not knowingly collect information from anyone younger. If you think a child has given us information, email us and we will deal with it.
11. Overseas processing
Our providers process information outside Australia, mainly in the United States. We choose established providers and take reasonable steps to make sure they protect it.
Vercel's published data-processing terms include EU Standard Contractual Clauses and a UK international data transfer addendum for transfers to which those safeguards apply. You can contact us for information about the transfer safeguards relevant to your personal information and how to obtain a copy. A privacy-policy update, visiting the sample or using the planner is not treated as your consent to a transfer that requires separate consent.
12. Changes and complaints
We will post any changes here with a new date and tell you about important ones. If you have a privacy question or complaint, email slateandserif@gmail.com and we will reply within two business days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).