The short version

Otter is run by one person, for a small audience of people I’ve invited. Below is the formal privacy policy with all the details of how your data is handled and what rights you have to it, but I also wanted to summarize it in very plain terms. Where the two differ, the formal policy is the one that binds me.

• You own your data. You can export it to take it with you, or delete it all at any time.
• Otter protects your data via encryption and backups. The backups also mean that full deletion can take up to ninety days to propagate.
• Otter does not record anything about you that is not required for running the service. There is no tracking, no telemetry, no analytics, no advertising.
• Otter never sends anything to another service, outside of its own operational requirements (server and database hosted on Fly.io, offsite encrypted backup hosted on Tigris, Google for sign-in).
• Otter, the service, never contacts you: no email, no notifications, no upsells. The only emails you’ll get from me are if I reply to an email you send to support@otterplanner.app, or if I need to inform you of a data exposure.
• No other user will ever have access to your data. The one thing of yours I see on purpose is the feedback you send me, which shows me your name and email address next to it.
• If you lose your Google account, you lose access to the planner: it is your identity for this app.
• For transparency, since I operate the site, I do technically have access to your data. But I have created automatic tooling and scripts for deployments, backups, restores, etc. If there is ever a bug so bad that I can’t fix it without looking into the database, my operational runbook’s rule is that I will make a log of everything I accessed, and inform you if I saw anything that is yours. But no one else, no employees, vendors, or other services (outside of my hosting providers) ever have access to your data.

If you have any questions, you can use the Feedback tab in the app or email me at support@otterplanner.app.

Privacy policy

Effective

September 30, 2026

Last policy change

September 30, 2026

Last minor revision

October 14, 2026

1. Who this policy is about, and who is responsible

Otter (“Otter”, “the Service”) is a day planner at https://otterplanner.app. It is run by one person, its owner (“I”, “me”), and not by a company. I am responsible for the personal data described here, and I can be reached at support@otterplanner.app.

This policy applies to everyone who uses the Service. Use is by invitation only: an account can be created only by a Google account whose address I have listed in advance, and I invite people in the United States only. By using the Service you accept this policy. If you do not, please do not use the Service; you may delete anything already held at any time (§ 8).

2. Definitions

• Personal data — information relating to an identified or identifiable person.
• Content — what you write in the Service: tasks, appointments, lists, notes, the names of your contexts, and feedback you send.
• Account data — the data the Service holds about your account itself (§ 3.1).
• Safety copies — the backups described in § 6.

3. What is collected

The Service collects only what is listed here. Nothing is inferred, purchased or combined from elsewhere.

3.1 Account data

Google also tells the Service whether it has verified your address; that fact is checked and not stored. Google’s profile picture is discarded and never stored.

3.2 Content

Everything you write, with the fields each thing carries: a task’s title, type, date, time, deadline mark, repeat rule, steps and their ticks, written-on note, context and pin; an appointment’s place, length and rhythm; a list’s lines; a note’s title and body; when something was done, deleted or pinned. Feedback you send: its text, the thread of replies, the version of the app it came from, and the kind of browser and device it came from (for example Safari · iPhone) — never the full browser identification string.

3.3 On your device

Cookies and per-tab storage, listed in § 10. Nothing else.

3.4 Mail you send me

If you email support@otterplanner.app: your address, the name your mail program sends with it, what you wrote and anything attached, and my replies. This is not part of the Service and is not in your export; it lives in a Microsoft 365 mailbox (§ 9) and is kept as § 6 says.

3.5 Read and not kept

Your IP address is read on sign-in requests to limit how many one address may make in a minute. It is held in the server’s memory only, is never written to disk or to a log, and is forgotten when the server restarts.

3.6 What is not collected

No analytics or usage measurement of any kind. No advertising identifiers. No device identifiers. No location, contacts, camera or microphone. No password, phone number, date of birth or security question. No profile picture. No request log: the server writes no line per request.

4. How personal data is used

Personal data is used for one purpose: to provide the Service to you — to sign you in, keep what you write, show it back to you, and let you take it away or delete it. The allow list and the sign-in rate limit (§ 3.5) exist to keep the Service secure and available for the people it is for, and use the least data that can do that.

Personal data is not used for marketing, for advertising, for profiling, for automated decision-making, for research, for training any machine-learning or language model, or for any purpose other than the one above. No content is sent to any AI or language-model service.

5. Who can see personal data

• You, signed in. Nothing of one person’s ever reaches another person through the Service; another person’s thing is indistinguishable from one that does not exist.
• Me, for feedback you send. The feedback inbox shows me your display name and email address beside what you wrote, and nothing else of yours.
• Me, for mail you send me at support@otterplanner.app: the mail and my replies, in the mailbox, and nothing else of yours with them.
• Me, as the operator. I can open the database directly and read anything in it. The rule I follow, written into the Service’s operations runbook: the database is opened by hand only to fix a problem the Service cannot fix itself, never to read a person’s planner or look at a name, every such session is logged the same day with when and why, and if a person’s rows have to be touched, that person is told. No one else opens it: there are no employees or contractors, and the companies in § 9 hold the data under their own terms.
• No one else. Personal data is never sold, rented, shared, or given to a data broker, an advertiser, or a “partner”.
• If the law compels me. If I am legally required to hand over personal data, I will provide only what is demanded, and tell the person concerned unless the law forbids it.

6. Where personal data is stored, and how long

Location. The Service and its database run on Fly.io in San Jose, United States. Data is encrypted in transit (HTTPS only) and encrypted on disk: Fly.io’s managed database service stores it on block-encrypted volumes and encrypts its own backups the same way.

While your account exists everything in § 3.1 and § 3.2 is kept.

Things you delete wait thirty days on Recently deleted, where you can restore them or delete them for good. Past the thirty days they can no longer be restored or exported, and are deleted for good the next time you use the account’s delete, restore or export, or open Recently deleted. Feedback is kept while your account exists and deleted with it.

Safety copies. Fly.io keeps continuous backups of the database for ten days. Each day the Service is used, an encrypted copy is also written to object storage at Tigris, provisioned through the same Fly.io account: daily copies are kept thirty-five days, and a monthly copy ninety days. The copies are encrypted before they leave the server, to a key that is not stored on Fly.io. So something you delete for good is gone from the Service at once and from every safety copy within ninety days. If the Service ever has to be restored from a safety copy, things deleted after that copy was taken would come back; I would tell everyone if that happened, and say which moment the Service was restored to.

Logs. The server writes no request log. Its output — start-up messages, a line when a sign-in is refused (without the address), and error traces — is kept by Fly.io for about a week and is not shipped anywhere else.

Mail you send me (§ 3.4) stays in the mailbox, with my replies, until you ask me to delete it. Then it is deleted for good, and Microsoft can recover a deleted message for up to thirty days after that.

Nothing is kept about an export. The Service records neither that you exported nor what.

7. Your rights, and how to use them

You have these rights over your personal data wherever you live, and each one is something you do yourself, in the Service, at once:

• Access — Export on Settings downloads everything you wrote, with your account’s name, settings and the day it was made, as one file, whenever you like. It leaves out only how you sign in — your address and Google’s identifier (§ 3.1) — and the Service’s own bookkeeping.
• Correction — edit anything.
• Deletion — Recently deleted lets you delete any one thing for good, or everything there; Delete account on Settings deletes your account and everything in it, immediately, with no waiting period and no reason asked.
• Portability — the export file is plain JSON with its format named at the top, so another program can read it.
• Mail you sent me — it is not in the Service, so neither Export nor Delete account reaches it; ask, from the same address, and I will send you a copy or delete it.
• Stopping — the Service does nothing with your data beyond providing itself, so there is nothing to opt out of short of leaving: sign out, and nothing follows you; or delete your account.

If you can no longer sign in — say, the Google account is gone — there is no other way into the account, and no way for me to act on a request about it, by design: the Google account is the only thing that says who you are, and any second way in would be a way in for someone else. The account stays as it is, under § 6, holding nothing that identifies you beyond what Google gave. If you know the Google account is ending — a school or work account, say — export first, and delete the account from Settings if you want it gone.

8. Deleting your account

Delete account on Settings removes your account and everything it holds — account data, content, everything on Recently deleted, and every feedback thread you sent, with my replies — at once and irreversibly. You are signed out on every device. What deletion does not undo: your address stays on the allow list until I remove it, so the same Google account can sign in again and will get a new, empty planner, and my log of changes keeps the days it was added and removed; Google keeps its own record of having signed you in; mail you sent me stays in the mailbox until you ask me to delete it (§ 6); and safety copies hold your data for the windows in § 6.

9. Third parties

The Service uses exactly these, and no others:

• Google — sign-in only. Google tells the Service your account identifier, name, address and whether the address is verified; the Service asks for nothing else. Google learns that you signed in to Otter and when. If you sign in with a Google account administered by a school or an employer, that organisation controls the Google account, not the Service.
• Fly.io — hosting: the server and the database. Fly.io can see the machines and holds the disks, under its terms of service, which let it use what it hosts to provide and improve its platform.
• Tigris, through Fly.io — object storage for the daily safety copies, which are encrypted before they are stored, to a key Tigris does not hold, so it holds nothing it can read.
• Microsoft, through GoDaddy — the support@otterplanner.app mailbox (Microsoft 365). It holds the mail you send me and my replies (§ 3.4). It is not part of the Service, which sends and receives no email.

Each works under its own terms and privacy policy, and each is given only what its part needs. The Service itself uses no analytics vendor, no error-reporting service, no email service, no content delivery network, no font host and no payment processor. The Service loads nothing from any other origin and makes no outbound call of its own; this is enforced by tests in the code, not by policy alone.

10. Cookies and browser storage

Every cookie the Service sets is needed for it to work. None tracks you, none is shared, and there are no third-party cookies. A test in the code holds this table to the whole list.

Per-tab storage, cleared when the tab closes, holds a draft you are typing, the keyboard’s state across a tab change, and where a capture landed. A draft holds words you typed; signing out clears it. Nothing is kept in localStorage or IndexedDB.

During sign-in, Google sets cookies on its own domain under its own policy; the Service neither sets nor reads them.

11. Children

The Service is not directed at children and is not advertised to anyone. Every account is by invitation from me, to a person I know, and I do not invite anyone under eighteen without a parent’s agreement. A younger person’s account is theirs alone: it holds exactly what anyone’s does (§ 3), and no one else — no parent, no school — can see into it through the Service.

12. Security

The Service is served only over HTTPS, with strict transport security. There is no password to breach: sign-in is Google’s, and only listed addresses are admitted, with the list failing closed. Every request is checked against your session, and another person’s thing is indistinguishable from one that does not exist. The Service loads no third-party code. Sessions expire after thirty days, and you can end every session at once from Settings. The Service’s dependencies are few and pinned, and a production build is checked to contain no development back door.

No system is perfectly secure. If I learn that someone reached personal data they should not have, I will tell every affected person within seventy-two hours of learning of it, by email at the address on the account, saying what was reached and what I have done.

13. Contact

Questions, requests and complaints about this policy or your data: support@otterplanner.app. Signed in, the Feedback tab reaches me too.

14. Changes to this policy

This policy carries its effective date and lives in the Service’s source code, so every change to it is on record, each with the day it was made. A change to anything § 15 promises is announced: a line on Settings says so until you have opened this page. Any other change — a sentence tidied, a new field named in the inventory because the planner gained one, a list called by a better name — is on record and not announced. A change that would take something new from you — a new kind of data, a new third party — will be asked for at the point of use, never introduced by a policy edit alone.

15. What will never happen

I will never knowingly do any of the following:

• Advertise, sell or share personal data, or give it to a data broker or a “partner”.
• Load any third-party script, pixel, SDK, font or analytics service.
• Track you across sites, fingerprint your device, or store your IP address.
• Send email, push or notifications of any kind, or any marketing — the one exception being a reply to mail you sent me, and the notice in § 12.
• Let an AI or language-model service see anything you wrote, unless you ask for a specific feature, each time — and never to train anything.
• Read your planner; I see only the feedback you send.
• Ask you for a password, or make an account for you.
• Ask for your location, contacts, camera or microphone.
• Stand between you and leaving: no waiting period, no offer to stay, no fee, nothing kept back, and export always works.
• Change anything in this section without an announcement.