Pelan
Privacy Policy
Last updated 18 October 2026 · Bahasa Malaysia
Pelan is a trip planner you use by chatting with your group. This policy says plainly what it stores, who else sees it, how long it is kept, and how to make it go away. It covers the Pelan app and pelan.app.
Who we are. Pelan is run by Tze Wei Wee, an individual based in Malaysia ("we", "us"). For anything in this policy, write to support@pelan.app.
What we collect
| Your account | Name, email address and profile photo, taken from the Google or Apple account you sign in with. You can change the name and photo in the app. We also record when you accepted these terms and whether you agreed to Pelan's use of AI. |
|---|---|
| What you put in a trip | Trip names, destinations, dates, the organiser's notes and the group's preferences, itinerary items (with notes, prices and booking references), expenses and settlements, and the images you attach — booking screenshots and receipts. |
| Chat | Every message in a trip chat, including the assistant's replies, and a short AI-written summary of older messages that Pelan keeps with the trip. A trip chat is shared: everyone on the trip can read it, including people who join later with the trip's code or link — they also see recent messages from before they joined. Share a trip code only with people you would add to the group chat. |
| People you invite | If you invite someone by email, we store that address and who sent the invitation. While it is pending, everyone on the trip can see the address. Invite codes record who used which code, because Pelan is invite-only and this is how that is enforced. People you brought to Pelan, or who brought you, are shown to each other as buddies (name and photo only). |
| Passport | The places Pelan works out you stayed in from your trips' itineraries, the stamps you claim, and your ticket balance. A trip's stamp artwork is shared with the people on that trip. |
| Your device and settings | A push notification token and the platform (iOS or Android), so we can tell you when something happens, and a copy of the notifications sent to you for the last 30 days, so you can look back at them. Your home currency, units, which notifications you want and your itinerary layout. Nothing else — no advertising ID, no precise location, no contacts. |
| Safety | Reports you make — the reason, your note, and a copy of the message or photo you reported — and the people you have blocked. Messages taken down for breaking the community rules are hidden from everyone but kept as a record until the trip or the author's account is deleted. Counts of wrong invite or trip codes and how fast an account is sending, used only to stop guessing and spam. |
| Feedback | What you write in Profile → Send feedback, with your name, email, account id, phone platform and app version, so we can reply and reproduce problems. |
Usage and crash data. Unless you turn it off, the app tells us which screens are opened, which features are used (for example "trip created" or "expense added"), and the details of any crash or error, together with your phone model, operating system, app version, your rough location (country and city, worked out from your internet address — never GPS) and your Pelan account id — a random code, not your name or email. It never includes your messages, trip names or amounts. We use it to find bugs and see what is worth building. Turn it off in Profile → Share usage & crash data.
There is no advertising and no tracking across other apps or websites. We do not sell your data or share it for advertising. Loading pelan.app sends nothing to third parties: its fonts and images are served from pelan.app itself.
Why we use it
- To run Pelan for you — your account, trips, chat, expenses, passport and notifications — because you asked us to (our agreement with you, the Terms of Service).
- To send your chat and photos to AI providers — only with your consent, which you can withdraw at any time in Profile → Pelan AI.
- To keep Pelan safe and working — abuse checks, rate limits, reports, and usage and crash data — because we have a legitimate interest in a service that is safe and works. You can turn usage data off in Profile.
Who processes it
These are the companies that handle your data, each only to run Pelan and under data-processing terms that require them to protect it:
| Clerk | Sign-in and account security. Holds your email and profile basics, and records sign-in activity (time, device, internet address) to protect your account. United States. |
|---|---|
| Convex | The database and file storage. Everything above lives here. United States. |
| Anthropic | Runs the assistant and reads photos and receipts. When anyone on a trip asks Pelan something, Anthropic receives the trip's name, destination, dates, organiser notes and group preferences; the itinerary, including notes, prices and booking references; the expenses and who owes whom, by name; the names of the people on the trip; recent chat messages and the summary of older ones; and any photo in the request. For current facts — opening hours, prices, closures — it runs a web search with a query written from what was asked. United States. |
| Alibaba Cloud | Model Studio runs a faster model that summarises older chat messages (it receives them with the senders' names) and, when you claim passport stamps, works out which places you stayed in and what to paint (it receives the trip's name, organiser notes, preferences and itinerary). Singapore. |
| OpenAI | Checks chat messages, photos and profile pictures for content that breaks the community rules, and paints passport stamps. Stamp art receives place names and trip themes only — no names or messages. United States. |
| Google Maps Platform | Finds where the stops on an itinerary and suggested places are, and how long it takes to drive between them. Receives only place search text as written on the itinerary or suggestions, and coordinates — never names, emails, chat messages, notes or times. This use is subject to the Google Maps/Google Earth Additional Terms of Service and the Google Privacy Policy. |
| OpenStreetMap | Finds where the places on an itinerary are, for the passport. Receives place names only. |
| Expo | Delivers push notifications and app updates. For a notification it receives the text (usually a name and the start of a message) and your device's push token, and passes them to Apple Push Notification service or Firebase Cloud Messaging (Google) to reach your phone. For updates it sees your app version and platform. United States. |
| PostHog | Usage and crash data, as described above. Session recording is off. United States. |
| Cloudflare | Serves pelan.app and app.pelan.app, and forwards support email and the feedback you send from the app to our inbox. |
| Google (Gmail) | Hosts our support inbox. Emails you send to support@pelan.app, and feedback from the app with the details listed above, are stored there. Also handles sign-in when you choose "Continue with Google". |
| Apple | Sign-in, when you choose "Continue with Apple". |
AI providers don't train on your data. Anthropic, OpenAI and Alibaba Cloud don't use what Pelan sends them to train their models, and neither do we. They keep it only to answer the request and to catch abuse, and delete it within about 30 days — unless it is flagged as breaking their usage policies (Anthropic can then keep it for up to two years) or the law requires longer.
Pelan asks before it uses AI on your behalf. The first time you open a trip chat, the app explains what is sent to the AI providers and asks you to agree. If you choose "Not now", or turn Pelan AI off in your profile, your messages and photos are not sent to Anthropic or Alibaba Cloud, Pelan doesn't reply to you, and receipt scanning, "Search more" and stamp painting are off for you. Because a trip is shared, when other members ask Pelan something the trip's itinerary, notes, preferences, expenses and the list of who is on it — including your name — are still included, as is the summary of older chat written before you turned it off. Every message is still checked for abuse.
Where it goes
Pelan is run from Malaysia, but our providers store and process data elsewhere: in the United States (Convex, Clerk, Anthropic, OpenAI, PostHog, Expo, Google), in Singapore (Alibaba Cloud), and on Cloudflare's worldwide network. Each is bound by data-processing terms that require it to protect your data and use it only to run Pelan, including the European Commission's Standard Contractual Clauses for people in the EU and UK.
How long we keep it
Until you delete it. Profile → Danger zone → Delete account removes your account, your messages, the files you uploaded, the expenses you entered, your passport, and every trip you own — immediately, in our database and at our sign-in provider, Clerk (if Clerk is briefly unreachable we retry automatically until it's done). No deactivated state, no grace period, no undo. The full list of what goes and what stays is on the account deletion page.
- Place locations and drive times from Google Maps: at most 30 days, as Google's terms require.
- Notification history: 30 days.
- Usage and crash data at PostHog: kept under your random account id for up to one year, then deleted automatically; ask us and we delete it sooner.
- Server logs: a short rolling log of recent activity for fixing problems — a few days, never more than 30 — with ids and counts, not your messages.
- Backups: we don't take regular backups. A backup made before maintenance is deleted within 7 days.
- Support emails and emailed feedback: kept in our support inbox until they're no longer needed to help you, and deleted when you ask.
A trip is shared. Deleting your account removes what you wrote and deletes the trips you own outright — for everyone on them. Other people's messages in trips you only joined stay with them.
Your rights
- See, correct or export it. Name and photo are editable in the app; for anything else, ask and we send you everything we hold about you.
- Delete it. In the app in two taps, or by email — see deleting your account.
- Withdraw consent, object or restrict. Turn Pelan AI or usage data off in Profile at any time, or ask us to stop or limit a use.
- Notifications. Choose which ones you get in Profile → Notifications, or turn them all off in your phone's settings. Signing out removes this device's push token.
- Block and report. Long-press a message or tap a traveller; your blocked list is in Profile.
Email support@pelan.app from your account's address and we reply within 21 days. In the EU or UK you can also complain to your data protection authority; in Malaysia, to the Personal Data Protection Commissioner.
Age
Pelan is for adults 18 and over. We don't knowingly collect data from anyone younger; if we learn we have, we delete the account.
Security
Traffic is encrypted in transit and data is encrypted at rest by our providers. Sign-in is handled by Clerk, not us. Every read and write of a trip is checked on our server against membership of that trip. Photos are served from long, unguessable links, so anyone you forward a photo's link to can open it.
Changes
If we change this policy in a way that matters, we'll tell you in the app or by email at least 14 days before it takes effect. The date at the top always shows the current version.
Contact
Tze Wei Wee, Malaysia · support@pelan.app — for access, correction, deletion, or any question about this policy.