// legal

Privacy Policy

Last updated: 2 June 2026 · Version 0.1 (draft)

⚠ DRAFT — pending legal review. This template describes how OmniPlanner is built and operated, but it is not yet legal advice. Items in [BRACKETS] must be completed and the whole document reviewed by a qualified professional for your jurisdiction before publication.

On this page

Who we are
What we collect
How we use it
Legal basis
Sharing
Retention
Your rights
Security
Contact

1. Who we are

OmniPlanner ("we", "us") is a self-hosted work suite operated by [LEGAL ENTITY NAME], [REGISTERED ADDRESS] (the "data controller"). For privacy questions, contact [email protected].

2. What we collect

We aim to collect the minimum needed to run the service:

Account data — name, username and email address you provide at sign-up, and the apps you use (Plane, solidtime, Leantime).
Content you create — projects, issues, time entries, goals and related work data you enter into the apps.
Technical data — IP address, browser type and timestamps in server logs, kept for security and abuse prevention.
Contact submissions — the name, email and message you send via the contact form.

We use only essential cookies required to sign you in and secure the gate. Optional analytics/marketing cookies are set only with your consent — see the Cookie Policy.

3. How we use it

To authenticate you across the suite via single sign-on and provision your accounts.
To operate, secure and maintain the service (including rate limiting and abuse prevention).
To respond to your contact-form enquiries.
To send essential service emails (account verification, password resets, admin notices).

4. Legal basis

Where applicable law requires a legal basis (e.g. GDPR), we rely on: performance of a contract (providing the service), our legitimate interests (security, operation), your consent (optional cookies, marketing), and compliance with legal obligations. [Confirm the framework(s) applicable in [JURISDICTION] — e.g. KSA PDPL, GDPR.]

OmniPlanner is self-hosted: your content stays on infrastructure we operate in [REGION — e.g. KSA]. We do not sell your data. We share data only with the limited service providers needed to run it:

Provider	Purpose	Data
[Hosting provider]	Server hosting (in-region)	All service data at rest
Namecheap Private Email	Outbound email delivery	Email address, message content
[Add any others]	—	—

6. Retention

We keep account and content data for as long as your account is active and as needed to provide the service, then delete or anonymise it within [retention period]. Server logs are retained for [log retention period]. Contact-form messages are kept for [period].

7. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction or portability of your data, and may object to certain processing or withdraw consent. To exercise these rights, contact [email protected]. You may also have the right to complain to a supervisory authority [name the authority for [JURISDICTION]].

8. Security

We protect data in transit with TLS 1.3 and HSTS, gate all apps behind a single sign-on, apply per-IP rate limiting, and restrict network exposure to the public web ports only. No method is perfectly secure, but we work to protect your data and review our controls regularly.

9. Changes & contact

We may update this policy; material changes will be posted here with a new "last updated" date. Questions: [email protected].