Privacy Policy
Last updated: May 2026
1. Data Controller
The controller of your personal data is the operator of PlaneCatalog, reachable at contact@planecatalog.com. For all data protection related requests, use this email address.
2. What Data We Collect and Why
Account registration and authentication
We collect your email address and authentication tokens to create and secure your account. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Email confirmation is required before you can submit photos.
Photo submissions
When you submit a photo we process: your account email, optional display name, optional submission notes, file metadata (name, size, type), moderation status, and upload timestamps. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Display name (profile)
If you choose to set a display name, it is shown publicly next to your approved photos. This is optional. Legal basis: consent (Art. 6(1)(a) GDPR).
Push notifications
If you subscribe to push notifications via ntfy.sh, your subscription endpoint is stored to deliver notifications. Legal basis: consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time.
Technical and security data
We use rate limiting, session cookies, and authentication tokens to secure the service and prevent abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
3. Data Processors and Third-Party Services
We use the following third-party services which may process your data on our behalf. Some of these are based in the United States — data transfers are covered by Standard Contractual Clauses (SCCs) or equivalent safeguards.
Supabase (USA)
Database, authentication, and file storage. Processes account data, submission metadata, and uploaded photos. Privacy Policy
Vercel (USA)
Hosting and deployment. May process request logs including IP addresses. Privacy Policy
Resend (USA)
Transactional email delivery (moderation notifications). Processes your email address. Privacy Policy
ntfy.sh (Germany)
Push notification delivery. Processes your push subscription endpoint if you opt in. Privacy Policy
4. Data Retention
Account data: retained while your account is active. Deleted upon account deletion request.
Approved photos: retained in the public archive until removed by moderation or upon request.
Rejected/removed submissions: metadata anonymized within 90 days of rejection or removal.
Push subscriptions: retained until you unsubscribe or the subscription becomes invalid.
Server logs: retained by Vercel per their data retention policy (typically 30 days).
5. Your Rights (GDPR)
Under the General Data Protection Regulation you have the following rights:
Right of access (Art. 15): You can request a copy of personal data we hold about you.
Right to rectification (Art. 16): You can correct inaccurate data, e.g. your display name, directly in your account settings.
Right to erasure (Art. 17): You can delete your account at any time from the account settings page. This removes your login and anonymizes linked personal data.
Right to data portability (Art. 20): You can request an export of your data by contacting us.
Right to restriction (Art. 18): You can request restriction of processing in certain circumstances.
Right to object (Art. 21): You can object to processing based on legitimate interest.
Right to withdraw consent: Where processing is based on consent (e.g. push notifications, display name), you can withdraw consent at any time without affecting prior processing.
To exercise any of these rights, contact us at contact@planecatalog.com. We will respond within 30 days.
6. Right to Lodge a Complaint
If you believe we are processing your data unlawfully, you have the right to lodge a complaint with a supervisory authority. In Poland, the relevant authority is:
You may also contact the supervisory authority in your country of residence within the EU/EEA.
7. Cookies and Session Data
We use strictly necessary cookies and session tokens to maintain authentication. These are essential for sign-in and account functions and do not require consent under GDPR. We do not use tracking, advertising, or analytics cookies.
8. Minors
PlaneCatalog is not directed at children under the age of 16. If you are under 16, you must obtain parental or guardian consent before creating an account. If we become aware that a user is under 16 without appropriate consent, we will delete the account.
9. Marketing and Data Sales
We do not use your personal data for marketing purposes. We do not sell, rent, or share your personal data with third parties for their own commercial purposes.
10. Changes to This Policy
We may update this privacy policy from time to time. The date at the top of this page indicates when it was last revised. Continued use of PlaneCatalog after changes constitutes acceptance of the updated policy.
Contact
For any privacy, data protection, or submission-related questions:
contact@planecatalog.com