Privacy policy
Last updated: 16 October 2026
We collect only what we need to run your planner, take payments and support you, and your planner content is encrypted in your browser before it reaches us. This policy is from Yohan Jerome Prakash, trading as Slate & Serif (ABN 44 977 969 075). We handle personal information in line with the Australian Privacy Principles.
1. What we collect
| Information | Examples | Why |
|---|---|---|
| Account | Email address, sign-in method, account ID, settings | To create your account and let you sign in |
| Purchases | Plan bought, amount, date, Stripe payment and refund references, access dates, Premium credit balance | To give you access, process refunds and keep financial records |
| Encrypted planner content | Your entries, notebooks, images and stickers, stored only in encrypted form, plus technical labels such as versions and timestamps | To save, sync, back up and restore your planner |
| Security | Sign-in and session records, IP address, browser type, bot-check results | To protect accounts and stop fraud and abuse |
| Support | What you write when you email us | To help you |
| Notifications (if you turn them on) | A browser notification token | To send the reminders you ask for |
We never receive your full card number; Stripe handles card details. We do not ask for, and you should never send us, a password, planner PIN, Maximum Privacy passphrase or recovery code.
2. Your encrypted planner
Your planner content is encrypted on your device before it is saved. Our servers, database and backups hold the encrypted version, not readable text.
- With account-only, planner PIN or planner-password protection, we can help you recover access after verifying your identity. These modes are not "zero knowledge".
- With Maximum Privacy, only your passphrase or recovery code can unlock your planner, and we cannot recover it.
We do not read your planner content, sell it, use it for advertising, or use it to train AI models.
3. Who helps us run the service
We share personal information only with providers who help us run Slate & Serif, and only what each needs.
| Provider | What they do for us | Where data may be processed |
|---|---|---|
| Stripe | Payments, refunds and receipts | United States and other countries |
| Supabase | Database and account sign-in. Account emails are sent through Resend, an email delivery service in the United States | United States |
| Vercel | Hosts the planner app | United States and a global network |
| Cloudflare | Encrypted independent backups and bot protection on sign-in pages | Global network |
| Google and Microsoft | Sign-in, only if you choose "Continue with Google" or "Continue with Microsoft" | United States and other countries |
| Shopify | Hosts our marketing website, slateandserif.com. It does not take payments for the planner | Canada, United States and other countries |
| Google (Gmail) | Our support email inbox | United States and other countries |
| Your browser's notification service (for example Apple, Google or Mozilla) | Delivers notifications, only if you turn them on | Varies by browser |
We may also disclose information where the law requires it, to protect people or the service, or as part of selling or restructuring the business. We do not sell personal information.
4. Calendar and task connections
The planner does not currently offer calendar or task connections. Two-way Google and Outlook calendar sync is planned for later. Before we offer them, we will update this policy to explain exactly which fields are shared, with whom and how to disconnect.
5. Our marketing website and cookies
slateandserif.com runs on Shopify, which sets cookies so the site works and to measure visits. Shopify's own privacy policy explains how it uses that information. The planner app itself uses only the storage it needs for sign-in, security and saving your planner. We do not use advertising trackers in the planner.
6. Emails we send
We send account emails (such as confirming your email address), and Stripe sends payment and refund receipts. We send marketing emails only if you subscribe, and every marketing email has an unsubscribe link.
7. How long we keep information
- Your planner stays in your account while the account exists, including the read-only period after your access ends.
- A planner document you delete can be recovered for up to 365 days, then it expires.
- Purchase and refund records are kept as long as tax and financial law requires.
- When you ask us to delete your account, we delete your account and planner data from our live systems. Encrypted backups are locked against changes for a set time, so encrypted copies may remain until that lock period ends, and then they expire.
8. Your choices and rights
You can ask to access, correct, export or delete your personal information. Email us from your account address, and we may need to verify your identity. You can export your planner from inside the app. Some records, such as purchase and fraud-prevention records, may be kept where the law requires or allows it, and we will tell you if that applies. If you live in the European Union or United Kingdom, you also have the rights your local law gives you, including to object to or restrict some uses.
9. Security
We use browser encryption, encrypted connections, restricted access to our systems and independent encrypted backups. No system is perfectly secure, so please use a strong, unique password and keep your recovery code somewhere safe.
10. Age
The planner is for people aged 18 or older. We do not knowingly collect information from anyone younger. If you think a child has given us information, email us and we will deal with it.
11. Overseas processing
Our providers process information outside Australia, mainly in the United States. We choose established providers and take reasonable steps to make sure they protect it.
12. Changes and complaints
We will post any changes here with a new date and tell you about important ones. If you have a privacy question or complaint, email slateandserif@gmail.com and we will reply within two business days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).