Privacy

What a plan stores

To make the shared calendar work, a plan holds only what people type into it:

• The names people enter for themselves.
• The days each person taps as free or preferred.
• The plan text (time, place, who's bringing what) and any comments.
• Which date, if any, was chosen as final.

A participant name is whatever a person chooses to type — it can be a nickname. Optional email sign-in stores an email address separately from plan contents, as described below.

Invitation links and organizer access

Every plan gets its own address made from a long, randomly generated code — it can't be guessed or discovered by browsing, and plans are not listed anywhere. In practice, only people you send the link to can find the plan.

Anyone with the invitation link can view and participate. On newly created plans, a private organizer key or a signed-in account with previously verified organizer access is required to change the title, group size, plan details, or final date. Adding an invitation link to an account does not grant organizer access. New responses added through the join screen have separate private editing access for their name, days, completion status, and comments. Older responses keep shared editing, with their original links and contents.

How long we keep it

For new plans, an essential cookie remembers organizer access in the browser for up to one year. It is restricted to that plan’s API, uses HTTPS on the live site, and is not accessible to page scripts. The database stores a one-way hash of the organizer key separately from plan contents. Organizer keys are not included in invitation links or analytics. The organizer can reveal a private recovery link to use another browser; anyone holding that link can control the plan. If both the cookie and the recovery link are lost, the invitation link alone cannot restore organizer access.

A plan becomes eligible for daily cleanup only after 90 days since its last saved edit and, if a final date was set, 30 days after that date. Plans with no final date use the 90-day rule. This protects future final dates for existing and new plans without changing their links, data, or organizer access. Viewing a plan, saving it to My Plans, or signing in does not extend the time. Cleanup runs daily, so deletion may not happen at the exact eligibility time. Plans with invalid historical date records are held rather than deleted. Expired plans are removed from account lists.

Optional email sign-in and My Plans

If you choose email sign-in, we store your email and the plans associated with your account, including verified organizer access where applicable. We send a single-use sign-in link through Resend when email delivery is enabled. Resend receives your address and the sign-in email to deliver it. No plan titles or participant details are included in that message.

Sign-in links expire after 15 minutes. An essential, script-inaccessible cookie keeps you signed in for up to 30 days. The database stores only hashes of sign-in and session tokens. Expired records are cleaned up daily. Hashed email addresses and send times are retained for up to 33 days to limit abuse and email volume. Account addresses and saved-plan associations remain until removal is requested; contact hello@pickourday.com to request account deletion.

If you choose “Save with email” on a plan, that sign-in link also remembers which plan to save. We temporarily store its ID and hashes proving any response or organizer access already held by your browser. After you verify your email, we save the plan and any still-valid access to that account, even if you open the email on another device. We do not claim responses by name or move a response already linked to another account. These temporary proofs are removed when used, when email delivery fails, or during cleanup after the sign-in expires. Saving by email does not mark your response as finished or subscribe you to reminder emails.

Opening a plan while signed in associates it with your account. Older anonymous plans cannot be found from an email address alone; add their links once. Importing this browser’s plans is optional and should only be done on your own device. Removing a card from My Plans hides the association without deleting the event or revoking organizer access. Signing out ends the account session; standalone browser organizer keys and private recovery links remain valid.

If you sign in with a verified email and turn on an email reply reminder, we store that preference for your response and send one reminder per reply date if you have not finished. Finishing your response, choosing a final event date, or turning the reminder off stops a pending reminder. Messages use our existing email provider and contain the plan name, reply date, and ordinary plan link. Private organizer and response keys are not included. Delivery attempts and message copies are kept for up to 32 days for reliable delivery; a preference is removed when its plan is removed.

Attendance confirmations are visible to people with the plan link. They are separate from availability and become outdated when the invitation changes. To recover an interrupted plan creation without duplicating it, your browser temporarily stores a private retry code and the submitted details. The server stores a hash of the code, a request fingerprint, and the created plan ID for up to 180 days. Do not share that private code.

Emailing yourself a plan link opens your own email app. Calendar reminders are files you choose to add to your calendar; delivery and alerts depend on those services and your settings. They do not stop automatically when you respond.

Optional testing invitations

If you explicitly volunteer to test new group-planning features at the testing-interest page, we record that permission, its wording and version, and when you gave it. You may optionally tell us your group type, approximate size and how often you organize. These answers are stored separately from plans and linked to your verified account. The site administrator can view the account email and those answers to invite volunteers. Signing in or saving a plan never joins this list, and this choice does not subscribe you to general marketing.

You can change your answers or withdraw on that page at any time. Withdrawal immediately removes the optional answers and active contact permission; a minimal record of the withdrawal date and permission version remains with the account. Deleting your account removes its testing-interest record. Aggregate statistics do not expose volunteer emails or account identifiers. No testing invitation is sent automatically by joining.

Co-organizer invitations

An owner can invite a co-organizer by email. We store the invited email, plan, inviter account, invitation status, expiry time, and a hash of the invitation code. The email includes the plan title and a link to accept. Invitations expire after 7 days and their records are removed after expiry during daily cleanup. To accept, the recipient must sign in with the invited email address. Owners can see organizer and pending-invitation email addresses; participants and co-organizers cannot view that list.

Co-organizers can edit plan details and choose the final date. Only owners can invite or remove organizers. Removing an invited co-organizer ends those organizer permissions immediately, but does not delete the plan or their responses. Anyone who already has a private organizer link keeps that separate access. Older plans with shared editing keep their existing controls.

Analytics

An organizer can optionally choose a broad event type, such as a game night or meal. It is stored separately from calendar answers and is used to understand which kinds of plans people use. We do not guess it from your plan name. You can change it or choose “Prefer not to say.” A keyed category record remains while its plan or detailed measurement remains; it is removed after both expire.

We preserve monthly aggregate totals of visits, plan creation, broad event types, response milestones and request outcomes after detailed records expire. These summaries contain no names, email addresses, selected dates, private links, or plan/browser identifiers. They are kept for long-term product trends and cannot restore a deleted plan. Before detailed data expires, summaries can reflect corrections; afterward the preserved totals no longer identify individual records. We label incomplete and unavailable historical periods.

To understand whether plans get responses and organizers return, we keep keyed, non-public plan and browser identifiers, response milestone times, and daily request outcomes for up to 365 days. These records do not include email addresses, names, comments, selected dates, or private links. A browser-tab visit lasts up to 30 minutes. On public pages we classify discovery into a fixed category, such as Google, a tagged email, or direct/unknown; we do not store referring URLs or arbitrary campaign text. For our three introductory posts, we also record one fixed topic label—game night, family dinner, or weekend trip—to measure whether those visits create a plan. These labels contain no personal information. We also record fixed feature labels for repeat plans, offered date choices, reply deadlines, and time/location settings, and compare their completion rates. Analytics do not store the contents of these settings. We also record a fixed label when a new plan starts from the invitation shown after a finished response, to measure whether that new plan receives responses. This does not link it to the original plan or respondent. These measurements are separate from your saved plans and account.

We count actions such as opening a page or sharing a plan. New activity records exclude names, plan titles, selected dates, comments, private plan links, referrers and raw browser details. A random browser identifier helps estimate repeat visits; it identifies a browser, not a person. Activity records are retained for up to 365 days. Older records may contain additional details collected before this change.

Our public pages include Cloudflare Web Analytics for traffic measurement; our private plan pages do not include its tracking script. Cloudflare processes traffic data on our behalf; you can read how in Cloudflare's privacy policy. We do not use advertising trackers and we do not sell data to anyone.

Feedback

If you tap the thumbs-up/down feedback prompt, we store your rating and any optional note so we can make the app better. It's stored without anything that identifies you.

What's stored in your browser

The app saves preferences in your browser’s local storage, including your language, the name slot you selected, and up to 100 recently opened plan links with their titles and chosen dates. My Plans uses this list without requiring an account. Anyone using the same browser may see it. You can clear the list in My Plans, and signing out clears it. This does not delete events or account associations. Clear this site’s browser data to remove standalone organizer cookies as well.

Children

Pick Our Day is a general-audience scheduling tool and isn't directed at children under 13.

Deleting a plan sooner

Plans become eligible for daily cleanup after 90 days without a saved edit and, if finalized, at least 30 days after the final date. Older plans retain their existing shared-editing controls. On new plans, changes to plan details require organizer access, and new responses have private editing access. Older responses retain shared editing. If you want a plan deleted entirely right away, email hello@pickourday.com and include the plan link.

Questions

Have a privacy question, a data request, or want a plan removed sooner? Email hello@pickourday.com and we'll help. You can also use the Send feedback link inside any plan.

Private response access

When you add a new response, this browser saves a private response key in local storage. Our database keeps only a hash of that key, separately from the shared plan. Your key lets you edit your name, days, completion status, and comments. A private response link can restore access on another device; anyone with it can edit your response, so keep it to yourself. Ordinary group links never include it.

If you sign in and save or reopen a plan in the browser where you responded, we can connect your response to that account. An email address, organizer role, or matching name alone does not claim someone else’s response. Older responses keep their shared editing behavior. Response access records are removed when their plan expires. Your finished or no-dates status is visible to people with the plan link; aggregate completion actions contain no names, dates, private keys, or response text.