Privacy Policy

Read how GalleryPlanner handles analytics, payments, support requests, and on-device storage so you understand what stays on your device and what does not.

Last Updated: October 9, 2026

This Privacy Policy explains how GalleryPlanner (“GalleryPlanner”, “we”, “us”, or “our”) handles information when you use our website, our web app, our iPhone app, and related gallery wall planning tools (the “Service”). The Service is operated by Timothy Straub, based in the Commonwealth of Massachusetts, USA, who is the data controller for the personal data described in this Policy and can be contacted at support@gallery-planner.com. By using the Service, you agree to this Policy.

1. Local-first design and your projects

GalleryPlanner is designed with a local-first philosophy. Your gallery wall projects, including measurements, layouts, and any photos you add, are stored on your device (in your browser’s storage on the web, or inside the app on your iPhone) and are never uploaded to GalleryPlanner.

GalleryPlanner also offers optional user accounts via Clerk, used for sign-in and for Pro access on every device where you’re signed in. Your account doesn’t include your projects or photos, and we keep no copies or backups of them. If you clear your browser’s data, delete the iPhone app, or lose your device, your projects are gone unless you exported them.

Device backups. Projects and photos in the iPhone app are not included in iCloud or computer backups of your iPhone, so restoring a backup to a new iPhone does not bring them back. To keep a copy or move a project to another device, use Export Project.

Notifications. If you allow notifications in the iPhone app, reminders (such as a Pro Pass ending soon or an unfinished wall) are scheduled on your iPhone itself. They are never sent through our servers, and we don’t collect a device token. If analytics is on, we record whether you allowed notifications and when you open one, but not what they say.

2. AI features and your photos

GalleryPlanner may offer AI-assisted layout or design features, such as Smart Fill. They run on your device, and your photos and layouts used with these features are not sent to us or to third-party AI providers.

We do not use your photos or layouts to train machine learning models outside of your device. If we ever introduce server-side or third-party AI processing, we will update this Policy and clearly explain what is sent, to whom, and why before you use those features.

3. Analytics and technical data

We use analytics and performance tooling to understand how the Service is used and to improve reliability. These tools collect technical information and product usage events.

We currently use:

PostHog (analytics + session replay): We use PostHog to understand how features are used (for example, “Export PDF” or “Launch App”), including product analytics and session replay for debugging UX issues. We configure PostHog to block your photos from appearing in session replay, block selected text-entry fields, and mask selected on-screen text such as project names, wall names, frame labels, photo filenames, and in-app notification text. We also avoid sending that information in analytics event properties and disable automatic capture of copied text. We also use PostHog to collect page-performance metrics — such as how long content takes to render and how much the layout shifts while loading — so we can find and fix slow or unresponsive interactions; error reports when something breaks (the error message, where in our code it happened, and your device type and app version); and what you search for in Help (our search events keep the first 80 characters; session replay, where it records, may show the full text) so we can improve our help content. PostHog infers your approximate location (country or city) from your IP address.
MailerLite (newsletter forms and update emails): On selected website pages, we use MailerLite signup forms to let you subscribe to updates. We may also use MailerLite to send product updates to customers who purchase Pro. In either case, MailerLite processes the email address and related subscription metadata needed to manage email preferences and deliver emails.

We do not intentionally collect sensitive personal content through analytics. We do not intentionally collect information that directly identifies you (such as your name or email address) through analytics tools, except where you explicitly submit it or provide it in connection with Pro purchases and related email communications. If you choose to submit optional in-app feedback text, that text may be sent to PostHog as feedback telemetry. Our hosting, analytics, and email service providers may process IP addresses and related technical data as part of providing their services. In the European Economic Area and the United Kingdom, we ask for your consent before turning analytics on. Elsewhere, analytics is on by default and you can turn it off.

You can review or change your analytics choice at any time from the Privacy choices link in the website footer or the Privacy choices control in the app menu.

4. Cookies and on-device storage

GalleryPlanner saves your projects and preferences on your device (in your browser’s storage, such as IndexedDB and localStorage, on the web, or in the app’s storage on iPhone) so your work is there when you come back, without an account. This storage is essential for the core functionality of the Service.

If you’ve previously signed into a Pro account, we may also store a Pro sign-in recovery hint on your device, including your email address and account identifier, for up to 45 days so we can offer a prompt to sign back in.

We use limited third-party service storage (for example, analytics identifiers, MailerLite form/session state, referral tracking, and fraud/security controls) to operate Service features. You can clear stored data through your browser settings, which removes your saved projects and preferences and may reset newsletter popup frequency settings. In the iPhone app, Clear all local data in Settings removes your projects and app preferences; deleting the app removes the app’s stored data. Your sign-in and records of App Store purchases are kept separately in the iPhone’s secure storage (see Section 6).

If analytics is on and you arrive through a partner link, or have a referral cookie from an earlier partner visit, Lemon Squeezy’s referral script creates a device fingerprint and sends a visitor identifier derived from it, together with the page URL and referrer, to Lemon Squeezy. It stores an ls_aff_ref referral cookie and adds the referral to Lemon Squeezy checkout links so a later purchase can be credited to the partner. Turning off analytics in Privacy choices deletes that cookie, and checkouts started afterward from the website or web app do not carry the partner reference. A website page where the script was running reloads to clear its tagged checkout links. A Lemon Squeezy checkout already open in another tab before you turn analytics off keeps its partner reference, so a purchase completed there may still be credited to the partner.

We use the following service providers to operate the Service:

Clerk: Sign-in, account management, and the Pro status stored on your account.
Cloudflare: Infrastructure used by PostHog’s managed analytics reverse proxy and related security/CDN services.
Lemon Squeezy: Merchant-of-record payment processing, order records, and affiliate referral tracking.
Apple: Sign in with Apple; payment processing and order records for purchases made in the iPhone app; purchase and refund notifications sent to our backend; and confirming a purchase’s current status when our backend sends Apple its transaction identifier.
Upstash Redis: Entitlement linking and operational state for Pro access and claim/reconciliation workflows.
PostHog: Product analytics and session replay telemetry.
Vercel: Hosting and serverless/API execution.
MailerLite: Newsletter signup, product update emails, and email preference management.
MailerSend: Transactional email, including purchase thank-you emails and issue reports.

Signing in. You can sign in with an email code, or with Apple, Google, or Microsoft (in the iPhone app: email or Apple). When you sign in with a provider, we receive your email address and, if you share it, your name. With Sign in with Apple you can choose Hide My Email, in which case we receive an Apple relay address that forwards to you. We use your first name to personalize purchase emails.

These providers process data to deliver their respective services to us. Some providers may process data under their own terms and privacy policies where they act as independent controllers. Submitting Report an Issue emails your message, the listed device and app information, and any email address you provide to GalleryPlanner support.

6. Payments and Pro Entitlements

On the web, GalleryPlanner uses Lemon Squeezy as our Merchant of Record for processing payments. Purchases in the iPhone app are made through Apple (see “Purchases in the iPhone app” below). When you purchase Pro on the web:

Payment Data: Your payment information is securely processed by Lemon Squeezy and is never stored on our servers.
Account Linking: If you are signed in, checkout includes your Clerk user identifier so your Pro access can be linked immediately.
Buy-first linking: If you buy before signing in, we temporarily store limited entitlement data (such as order identifiers and normalized purchase email) in server-side key-value storage to match the purchase after you sign in with a verified primary email. Pro access is not activated across devices until that sign-in claim is completed.
Webhook Processing: Lemon Squeezy and Clerk send signed webhook events to our backend. We verify signatures before processing and update your Clerk public metadata (for example, Pro status) so Pro works on every device where you’re signed in.
Pass Entitlement Metadata: For Pro Pass products, account metadata may include entitlement timing fields (for example, purchase time, activation time, and expiry time) to enforce pass duration and access state.
Email Updates for Customers: We may use the email address associated with a Pro purchase to send GalleryPlanner product updates through MailerLite. Those emails include unsubscribe controls so you can opt out at any time.

Purchases in the iPhone app. Pro purchases in the iPhone app are made through Apple’s In-App Purchase system:

Payment Data: Apple processes your payment under its own terms and privacy policy. We never receive your payment details or your Apple Account.
On your iPhone: Apple confirms each purchase to the app, which unlocks Pro on that iPhone and keeps a record of the purchase in the iPhone’s secure storage, so you don’t need an account to buy. The record holds Apple’s signed purchase information (product, transaction identifiers, and purchase time), any refund time, for a Pro Pass its start time, and, once it has been sent to our backend, the identifier of the account it was sent for. It stays on the iPhone, can remain there after the app is deleted, and isn’t removed when you delete your account.
When you’re signed in: The app sends Apple’s signed purchase information to our backend, which verifies it with Apple and stores an order record linked to your account (transaction identifiers, product, refund status, your account’s email address and identifier, and for a Pro Pass its purchase, start, and expiry times). This lets Pro work on your other devices, including the web, when you’re signed in. Purchases made while signed out are sent after you sign in.
Refunds: Apple sends signed notifications to our backend when a purchase is refunded or a refund is reversed, and we update your Pro access to match.
Analytics: If analytics is on, the app sends PostHog events about purchase and Restore activity, such as which option you chose, whether a purchase or Restore succeeded, and how many purchases were restored. These events never include payment details or Apple’s signed purchase information.
Emails: When an iPhone app purchase is linked to your account, we may send a purchase thank-you email and product updates to your account’s email address, as described above for web purchases.

7. Account Deletion

When you delete your account, we permanently delete:

Your Clerk account record and associated Pro entitlement data
Your Pro entitlement records in our server-side store (Upstash Redis)
Your MailerLite subscriber record, if applicable
Your PostHog analytics profile; event data purge completes within 30 days

Deleting your account also ends Pro that depends on it: Pro bought on the web, and any Pro Pass saved to your account, including on your iPhone. Lifetime Pro bought in the iPhone app stays available on iPhones using the same Apple Account, through Restore Purchases.

Your projects and photos are stored on your device, not on our servers, and are unaffected by account deletion. They remain until you clear your browser’s storage or delete the app.

Payment and order records held by Lemon Squeezy as Merchant of Record, and by Apple for purchases in the iPhone app, are retained under their own tax and legal obligations and are not deleted as part of account deletion. Records of iPhone app purchases kept on your iPhone (see Section 6) also stay on the iPhone.

We may also retain limited data where necessary to comply with legal obligations, prevent fraud, or resolve disputes.

To delete your account, use the account management controls in the app (your profile icon → Manage account), or contact us at support@gallery-planner.com. If you used Sign in with Apple, you can separately stop using it with GalleryPlanner in your Apple Account settings; this only disconnects Sign in with Apple and doesn’t delete your GalleryPlanner account or its data.

We may receive information that directly identifies you (such as your name or email address) when you subscribe to updates through a newsletter form, purchase Pro, send us an email, or contact us through our social channels. We use this information to manage newsletter and customer update subscriptions, respond to your inquiry, provide support, process Pro-related communications, and maintain our correspondence.

If you contact us and later want your messages deleted, you can request this at any time using the email listed below.

9. Data retention

We keep personal data only as long as needed for the purposes described in this Policy:

Account data (Clerk) and Pro entitlement records (Upstash Redis): retained until you delete your account.
Account deletion record (Upstash Redis): when you delete your account, we keep a minimal record that the deletion happened (your account ID, the date, and which deletion steps completed) for 3 years, as evidence we honored your request. It contains no email address.
Analytics data (PostHog): event data is retained per our analytics configuration; when you delete your account, your analytics profile is deleted and the associated event data purge completes within 30 days.
Newsletter and update email data (MailerLite): retained until you unsubscribe or delete your account.
Purchase thank-you email records (Upstash Redis): retained until you delete your account.
Pro sign-in recovery hint (on your device): up to 45 days.
Payment and order records: held by Lemon Squeezy as Merchant of Record (web purchases) or by Apple (iPhone app purchases), and retained per their tax and legal obligations.
iPhone app purchase records on your iPhone: kept in the iPhone’s secure storage so your Pro access works offline and without an account; they may remain after the app is deleted and are not removed by account deletion.
Projects and photos in the iPhone app: kept only in the app on your iPhone until you delete them or the app. They are not included in iCloud or computer backups, and we have no access to them.
Support correspondence: retained as long as needed to handle your inquiry and maintain our correspondence, unless you request deletion.

10. International users and your privacy rights

The Service is operated from the United States, specifically the Commonwealth of Massachusetts. If you access the Service from outside the United States (including Canada, the European Union, or the United Kingdom), your information may be processed in the United States or other locations where our service providers operate. Where our service providers receive personal data from the EEA, UK, or Switzerland, transfers rely on safeguards such as the EU–U.S. Data Privacy Framework (and its UK and Swiss extensions) and/or Standard Contractual Clauses, as applicable to each provider.

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

Consent — analytics and session replay, newsletter signup, and similar optional features. You can withdraw consent at any time (for analytics, via the Privacy choices link in the website footer or the app menu).
Performance of a contract — account creation, Pro purchases, entitlement syncing, and customer support.
Legitimate interests — service security, fraud prevention, and sending product updates to existing customers about our own similar products (you can opt out at any time via the unsubscribe link in each email).
Legal obligation — record-keeping required by tax and other laws (primarily held by Lemon Squeezy as Merchant of Record).

You also have the following rights over your personal data, subject to conditions under applicable law: access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and the right to withdraw consent at any time (without affecting processing that happened before withdrawal). To exercise any of these rights, contact us at support@gallery-planner.com. You also have the right to lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner’s Office).

If you are in another jurisdiction that grants you specific privacy rights (such as access, correction, or deletion), you may contact us at the same address to exercise those rights where they apply. Note that most of what you create in GalleryPlanner (projects, layouts, photos) never reaches our servers — it stays in your browser or the iPhone app on your device, where you control it directly.

11. Children’s privacy

GalleryPlanner is not directed to children under 13, and we do not knowingly collect personal information from children. If you believe that a child has provided us with personal information, please contact us so we can take appropriate steps.

12. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page and, where appropriate, provide additional notice within the Service. Material changes affecting how we process personal data will include notice by email (if you subscribed) or in-app.

Your continued use of the Service after any changes take effect constitutes your acceptance of the updated Policy.

13. Contact

If you have any questions about this Privacy Policy or how we handle information, you can contact us at:

Email: support@gallery-planner.com