A NOTE ON YOUR DATA
Privacy, plainly.
When you join Plan to Source, you trust us with a little information. Here's what the website and private project workspace collect and how that information is used.
What you share
We collect your email address when you subscribe. We also record your consent, subscription status and subscription dates, together with available acquisition context: the source page, referring website, campaign parameters and browser language. We limit the length of these fields.
Why we collect it
We use this information to manage the early-access list, send product and procurement updates, respect unsubscribe requests, and understand which channels bring people to the site.
Where it goes
Cloudflare Workers runs the website and Cloudflare D1 stores the canonical subscription record and event history. Resend handles email delivery and contact synchronization. These providers process data as part of delivering the service.
Website analytics
When enabled, Google Analytics 4 uses the Google tag and may store cookies to measure aggregate page visits and successful subscriptions. We do not send your email, subscriber identifier or unsubscribe link to Google Analytics. Analytics is optional for the operation of the site; blocking it does not stop you subscribing.
Your choices
Every welcome email includes a signed unsubscribe link. You do not need an account. Following that link stops future updates; a minimal subscription and event record is retained to respect your preference. You may subscribe again at any time.
Private project workspace
Verified password sign-in creates your account and private workspace without subscribing you to updates. Google Firebase Authentication processes your email, password and authentication requests, stores password credentials, and delivers verification and reset emails. Cloudflare D1 stores account mappings, encrypted login refresh credentials, access and project records; private Cloudflare R2 storage holds uploaded files. The application does not store password hashes. Resend delivers optional security notifications and newsletter emails. Minimal authentication security events are kept for up to 90 days. Project pages do not load public website analytics or send private project information to Google Analytics.
When you acknowledge the upload policy and start automatic processing, selected document text is sent to Groq in the United States using qwen/qwen3.8-27b under the operator-confirmed zero data retention setting. This setting applies to that inference service, not to Cloudflare storage or Resend email records. Results are automatic references, may contain errors and are not reviewed by platform staff.
Original files and derived project content are retained for 90 days after closure. A project deletion request removes access immediately and triggers live-content cleanup within seven days. Minimal audit identifiers remain for 180 days after deletion. Managed database recovery copies and protected operator backups may contain older data for up to 30 days. Live deletion does not erase these copies immediately; restored databases remain isolated until deletion requests have been reapplied.
Contact and retention
For access, correction or deletion requests, contact hello@plantosource.com.
We keep subscription information while it is needed to manage your subscription and updates. After you unsubscribe, we retain the minimum record needed to respect that choice and handle related requests. Contact us to request access, correction or deletion of your information. Any information that must be retained to meet an applicable obligation is limited to that purpose.