Privacy Policy
Last updated: October 26, 2026
The short version
- What you log about your child (the plan, wins, accidents, notes) is stored on your own phone. If you share the plan with your partner, it travels between your phones end-to-end encrypted: we can't read it.
- We only handle the data we need to let you sign in, keep shared phones in sync, send reminders you turn on, and read feedback you send us.
- No ads, no tracking cookies, no analytics. We never sell your data.
1. Who is responsible
Twan Eikelboom, Zuider Parallelweg 26, 6882 AE Velp, the Netherlands, runs Potty Plan and is the controller of the personal data described in this policy. Questions or requests: support@pottyplan.com.
2. Data that stays on your device
Everything you enter in the app is saved in your browser's storage on your phone or computer. That includes your quiz answers, your child's name and age, the plan, the log, notes, stickers, your family's words for pee and poop, and your settings. We have no copy of it.
You control this data. You can delete it with "Start over" in the app's Settings, or by clearing your browser data. Printables and PDFs are also made on your device.
If you share the plan with your partner
With "Share with your partner" you can use the same plan on more phones, for example your partner's, a grandparent's or a nanny's. Your phone then encrypts the shared data (your child's details, the plan and the log) before it leaves the phone, with a key that only exists in your pairing code (the QR code or link). We keep one encrypted copy to pass changes between your phones. We don't have the key, so we can't read it. Settings such as sounds and theme stay on each phone and are never shared.
3. Data we process
| What | Why | How long |
|---|---|---|
| Your Whop account: user ID, name, email address and membership status | To sign you in and check that you have access. Legal basis: performance of our contract with you. | Stored only in a sign-in cookie on your device, not in a database. It lasts until your access ends (plus a short margin) or until you sign out. |
| Reminders (only if you turn them on): your device's push address, the time of the next reminder, and its text, which includes your child's first name | To send the potty-sit reminders you asked for, even when the app is closed. Legal basis: performance of our contract, at your request. | The reminder text is deleted as soon as it is sent. The push address is deleted when you turn reminders off or remove the app. |
| Shared plan (only if you turn on sharing): an end-to-end encrypted copy of your child's details, the plan and the log; a fingerprint (hash) of your pairing code; and the buyer's access (Whop user ID, email address and end date), so a partner's phone can open the app | To keep the phones you chose in sync and give them access. Legal basis: performance of our contract, at your request. | Until sharing is stopped in the app. The encrypted copy is then deleted right away. |
| Feedback (only if you send it): your message, the contact details you give or your email address, your Whop user ID, and the plan day, screen, app version and device type | To read and answer your message and fix problems. Legal basis: our legitimate interest in supporting you and improving the app. | Up to 2 years, or sooner if you ask us to delete it. |
| Purchase and support: purchase details from Whop and emails you send us, including refund requests | To deliver your purchase, handle refunds and keep our accounts. Legal basis: our contract and legal obligations (tax and bookkeeping). | As long as needed for support. Bookkeeping records for 7 years, as Dutch law requires. |
| Technical logs: IP address, browser type and requested page | To keep the app secure and working. Legal basis: our legitimate interest. | Kept by our hosting provider for a short period, normally a few days. |
We don't use your data for advertising or profiling, and we don't make automated decisions about you.
4. About your child
Potty Plan is for parents and caregivers, not for children. We don't collect data from children. The details you enter about your child stay on your device. The exceptions are your child's first name inside a reminder text, if you turn reminders on, and the encrypted shared plan, if you share it with your partner. We can't read the shared plan, as described above.
5. Who we share data with
We only share data with the services we need to run Potty Plan:
- Whop (Whop, Inc., USA): checkout, payments, your account and sign-in. Whop processes payment data as its own controller under its own privacy policy.
- Cloudflare (Cloudflare, Inc.): hosts the app and stores reminder data and the encrypted shared plan.
- Your phone's push service (Apple, Google or Mozilla, depending on your device): delivers reminders. The reminder text is encrypted on its way to your device.
- Our team chat or email tool: where we receive feedback messages.
Some of these providers are based in the United States. Where data leaves the European Economic Area, it is protected by the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses. We never sell your data.
6. Cookies
We use only two strictly necessary cookies: one that keeps you signed in and one that secures the sign-in step itself (deleted after a few minutes). We don't use tracking, advertising or analytics cookies, so we don't need to ask for your consent.
7. Your rights
Under the GDPR you have the right to access, correct or delete your personal data, to object to or restrict its use, and to receive it in a portable format. Email us at support@pottyplan.com and we'll respond within one month. Your app data is already in your hands on your device, and you can delete it there at any time.
You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.
8. Security
The app only runs over a secure (HTTPS) connection. Sign-in cookies are signed so they can't be changed, and they can't be read by scripts. A shared plan is encrypted on your phone (AES-256) with a key that only exists in your pairing code. Anyone with that code can join your plan, so only share it with people you trust; you can stop sharing at any time. We keep the data we process to a minimum, so there is very little that could ever leak.
9. Changes
We'll update this policy when the app or the law changes. The date at the top shows the latest version. If a change matters for how we use your data, we'll tell you in the app.