Privacy Policy

Last updated: 2026-08-05

This Privacy Policy describes how Genogram ("we", "us", "our") collects, uses, and shares information when you use genogram.planchart.ai (the "Service").

We aim to collect the minimum information needed to operate the Service. We do not sell personal data.

Information We Collect

We collect and process the following information:

• Account email. Collected at registration and used to authenticate your account and send transactional email (password reset, subscription receipts). We do not use it for marketing without your consent.
• Device identifier (hashed). A rotating SHA-256 hash of your IP address and browser user-agent, used to prevent abuse of rate limits and as an anonymized session identifier. We do not store raw IP addresses.
• Interaction events. Clicks, page views, feature use — used to understand which features are used. Events are associated with your hashed device identifier, not you personally.
• Automatically collected. Standard web-server logs (timestamp, path, response code, user-agent, referrer).

We do not collect: your name, phone number, physical address, date of birth, or payment card information (payments, if any, are handled by third parties — see below).

How We Use Information

• To authenticate your account and deliver the Service to you.
• To rate-limit and detect abuse.
• To improve the product (aggregate analytics about feature usage).

Encryption

Signed-in accounts store diagram content — people, relationships, notes, titles, and photos — private to your account. By default we can access this content to operate the Service (for example, search and export); this is ordinary private storage, not zero-knowledge.

You can additionally mark a diagram Confidential (a Space is shown as Confidential when every diagram in it is; the Space has no separate setting). Confidential content is encrypted in your browser (AES-256-GCM) with a key derived from your password (Argon2id) before it is sent to us. Your password never leaves your browser; we sign you in with a separate one-way value. We store Confidential content only as ciphertext and cannot read it, and a breach of our stored data would expose it only as ciphertext.

Not covered by any encryption: diagrams created without an account are stored unencrypted. Always visible to us regardless of level: metadata — your email, timestamps, folder and Space names (unless that Space is Confidential), and how many diagrams you have. Because your browser downloads our code to perform Confidential encryption, this protects you against theft of our stored data but is not an absolute guarantee against a compromised server. If you lose both your password and your recovery code for a Confidential item, it cannot be recovered by anyone, including us — there is no backdoor.

Subscription Payments

Paid subscription payments are processed by Lemon Squeezy. We do not see or store your payment card information. Lemon Squeezy's privacy policy applies to payment processing: lemonsqueezy.com/privacy.

Cookies

We use the following categories of cookies and similar storage:

• Functional — session tokens and browser storage to keep you logged in and remember your preferences. You can clear these at any time via your browser.

We honor the Do Not Track (DNT) browser signal — if your browser sends DNT, we do not track interaction events.

Data Sharing

We share data with the following third parties strictly as necessary to operate the Service:

• Fly.io — our hosting provider (privacy policy).
• Lemon Squeezy — payment processing for subscriptions.

We do not sell or rent personal information to any third party.

Data Retention

Account data is retained while your account is active. You may request deletion at any time by contacting us. Interaction events are kept for operational analysis and may be aggregated indefinitely. We do not retain raw IP addresses.

Your Rights

You may request access to or deletion of your account and associated data by contacting us. You may also:

• Clear your browser storage to remove device-side state.
• Use DNT in your browser settings to avoid interaction tracking.
• Contact us at hello@planchart.ai with any requests.

Children

This Service is not directed at children under the age of 13, and we do not knowingly collect personal information from children. If you believe a child has submitted information, please contact us.

Changes to This Policy

We may update this policy. When we do, we'll update the "Last updated" date at the top. Material changes will be noted on the site.

Contact

Questions or requests: hello@planchart.ai