Privacy Policy

Last updated: 2026-09-29. This policy explains what Spooky Planning collects, why, where it is stored, and how to get rid of it. It is part of the Terms of Service and applies to spookyplanning.com.

The short version: you can use every feature without an email address (rooms created as a guest hold up to 10 people), we collect no personal data you did not hand us, we sell nothing, and we run no advertising or profiling.

Who is responsible

Donado Labs operates Spooky Planning and is the data controller. Contact for any privacy matter: contact@donado.co.

What we collect

• Nothing, if you stay a guest. Guest sessions need no email address. A guest session holds a display name you choose and an identifier in a cookie, and it disappears when the session ends.
• Your email address, if you register. It is the only personal detail a registered account requires, and it exists so magic-link sign-in can work and so your rooms and history can be reattached to you on the next visit. There is no password to store.
• The content you create in the product. Room names, round names, voting scales, votes, and the participant list of each room. This is the data the product exists to hold.
• Anonymous usage metrics. Aggregate product analytics that tell us which features are used and where errors happen. These cannot be traced back to an individual, and none of it is shared with advertisers or data brokers.

We do not collect payment details, because nothing is for sale. We do not ask for a name, company, phone number, or address.

Legal basis

For registered accounts, processing your email address is necessary to perform the service you asked for (GDPR Article 6(1)(b)). Session and security cookies are strictly necessary for the service to function. Aggregate, anonymous usage metrics rest on our legitimate interest in keeping the service working and improving it (Article 6(1)(f)), and carry no identifier that would let us single you out.

Cookies

We use three kinds, all strictly necessary and therefore exempt from consent requirements under EU rules:

• Session cookies keep you signed in. The session cookie is host-only, so it is never shared with other subdomains.
• Functional cookies carry one-off notifications, such as the confirmation shown after an action.
• Security cookies support bot protection (Cloudflare Turnstile) on sign-in, so automated abuse cannot flood the service.

There are no tracking, advertising, or profiling cookies, and no third-party ad pixels.

Where your data lives

The application runs on Cloudflare Workers. Stored data lives in Cloudflare D1, and realtime traffic in a room passes through a Cloudflare Durable Object that relays messages without persisting them. Cloudflare acts as a processor on our behalf. Email delivery for magic links is handled by Plunk, which receives only the recipient address and the link. Anonymous product analytics are processed by PostHog.

How long we keep it

• Guest session data is temporary and deleted when the session ends.
• Registered accounts keep their email address, rooms, rounds, and votes until you delete the account.
• Deleting your account removes your personal information from our systems. Aggregated and anonymized metrics that cannot identify you may be retained.

Your rights

Under the GDPR you can request access to your personal data, correction of inaccurate data, erasure, restriction of processing, portability, or object to processing. Registered users can exercise erasure immediately and without asking us: profile settings, then "Delete Account". For anything else, email contact@donado.co from the address on the account. You may also complain to your local data protection authority.

Children

Spooky Planning is a workplace tool and is not directed at children under 16. We do not knowingly collect data from them.

Changes

If this policy changes, the date at the top changes with it and the release is noted in the Changelog.