Privacy Policy

1. Privacy Policy

Planscora ("Planscora", "we", "us") respects your privacy and is committed to being transparent about how your personal data is handled. This Privacy Policy applies to the Planscora web service, including when installed as a Progressive Web App (PWA) on your device.

By accessing or using Planscora, you agree to the processing of your personal data as described in this Privacy Policy. If you do not agree, you should not use the service.

2. Who we are

Planscora is operated by Patrik Rundin as an individual, acting as the data controller responsible for your personal data.

Contact details:
Planscora
Operator and Data Controller: Patrik Rundin
Sweden
Email: planscora@outlook.com

Planscora is not currently operated through a registered company. No company name, organisation number, VAT number or registered office is provided, and none should be inferred. Planscora is currently offered free of charge during its early access period.

3. Scope of this policy

This policy covers the personal data processed when you create an account, sign in, and use the Planscora training, planning, calendar, season-planning and performance features.

It does not cover the practices of third-party services you may use alongside Planscora, such as Google when you choose Google Sign-In. Those services are governed by their own privacy terms, which you should also review.

This policy may be updated over time. The effective date and last updated date shown on this page identify the current version.

4. Personal data we process

Based on the current production implementation, Planscora may process personal data necessary for account creation, authentication and use of the training application. This can include:

• your email address;
• authentication and account identifiers;
• authentication information handled by the authentication provider;
• a display name where you choose to set one;
• training plans, scheduled training and calendar activities;
• completed, in-progress and discarded training sessions and exercise results;
• golf practice results;
• gym and physical training results, including sets, repetitions and weights where you enter them;
• weekly goals and training targets;
• season planning information, such as season plans and season dates, training availability and capacity (including your normal week and any high-availability periods), training priorities, development areas, season phases and focus periods, and the planning inputs and targets derived from them;
• tournament and performance information you record, which may include your own self-assessment ratings and written reflections;
• user-created exercises, sessions and training content;
• notes, to-do items, checklists, reviews, reflections and other free-text information you voluntarily enter into training features;
• coach connection information where you choose to connect with a coach; and
• technical information necessary to operate and secure the service.

The current implementation does not require or store, in Planscora's own application tables: date of birth, postal address, precise GPS location, profile photo, uploaded files, or payment information. Planscora currently has no payment processor because the service is free during early access.

5. Information you provide

You provide personal data when you create an account (such as your email address) and when you enter training content, schedule activities, log sessions, record golf and physical training results, set weekly goals, build a season plan and describe your training availability, record tournaments, create custom exercises and sessions, and add notes, to-do items, checklists, reviews and reflections.

Some of this content is free text that you write yourself, including notes, tournament reflections and season or phase reviews. Please only enter information you are comfortable storing in the service.

You can control much of this information directly in the application, including editing it or deleting it through the account deletion functionality. Providing this information is voluntary, but some of it is necessary to provide the features you request.

6. Authentication and Google Sign-In

Planscora supports account authentication using an email address and password, and also offers Google Sign-In. Authentication is handled by the managed authentication provider infrastructure.

When you use email and password sign-in, your password is handled by the authentication provider; Planscora does not store your password in its own application database.

When you choose Google Sign-In, authentication involves Google and the authentication and infrastructure provider. Google processes information according to its own privacy terms. Planscora does not store your Google password and does not store unnecessary Google profile information in its own application database beyond what is needed to create and maintain your account.

Password reset and email verification messages are handled through the authentication and provider infrastructure. Planscora does not name a specific underlying email delivery provider, as this is not independently verified.

7. Coach connection and sharing

Connecting with a coach is optional. Planscora does not share your training information with another user unless you choose to create a coach connection.

A coach connection only becomes active when it has been accepted. A connection can be started by sharing a single-use invite code or by a request, but the other party must accept it before any information becomes available. Invite codes are stored in a protected form rather than as readable codes.

Coach access is limited to the area you authorize, currently golf and/or physical training. A coach receives only the information Planscora makes available within that authorized scope. Information outside the authorized scope is hidden or shown without details — for example, an activity that is not part of the authorized scope can appear only as a busy time slot without its title.

Within the authorized scope, a coach may see scheduled and completed training, the training information Planscora exposes for coaching (such as exercise names, status, results and, for physical training, logged sets), summarised training volume and season overview information, and your display name. A coach does not receive your email address through the coach views.

Some information is never made available through a coach connection. This includes your personal notes, to-do items and checklists, the notes, location and detailed result data attached to your calendar activities, and your private season and phase reflections and reviews.

Tournament information may be available to a coach within the golf scope. Your own mental and self-assessment ratings, your written tournament reflections, hidden strokes and your tournament notes are not made available to a coach.

A coach may propose training, exercises or sessions to you. A proposal does not become part of your training until you accept it. Nothing a coach sends is written into your own training data without your acceptance.

You can remove coach access at any time. Removing access stops the coach's future access to your information and withdraws that coach's pending proposals. Content you already accepted has become your own content and stays in your account, as described in these terms.

8. How we use personal data

We use your personal data to:

• create and maintain your account and authenticate you;
• provide the planning, training, calendar, season-planning, history and statistics features you request;
• save your training activities, sessions, results, goals, plans, notes, reflections and preferences;
• provide coach connections you choose to create, within the scope you authorize;
• record legal and safety acknowledgements you make;
• maintain the security, reliability and integrity of the service; and
• prevent abuse and diagnose and fix technical problems.

We do not use your training or performance data for advertising.

9. Legal bases for processing

Planscora processes personal data on the following legal bases, depending on the purpose:

• Performance of a contract and taking steps before entering into a contract — to create and maintain your account, provide the training functionality you request, save training activities and results, and provide requested account functionality.

• Legitimate interests — to maintain security, prevent abuse, troubleshoot, and maintain the reliability and integrity of the service.

• Legal obligation — where information must be retained or processed to comply with applicable law.

• Consent — only where consent is actually required and obtained.

Consent is not stated as the legal basis for all processing. Planscora does not add fake consent mechanisms.

10. Hosting, service providers and processors

Planscora is built and hosted using Lovable infrastructure and services and their associated service providers. Lovable acts as an infrastructure and service provider for Planscora and may use subprocessors.

Lovable and its subprocessors may process data on behalf of Planscora for infrastructure, hosting, authentication, security and related technical purposes. Lovable provides its own Privacy Policy (https://lovable.dev/privacy) and Data Processing Agreement (https://lovable.dev/data-processing-agreement).

Planscora remains responsible for explaining how personal data is processed in the Planscora service. The Planscora Privacy Policy is not a substitute for Lovable's privacy documentation, and vice versa.

Where exact subprocessors may change, infrastructure providers may use subprocessors rather than the service presenting an incomplete static list as guaranteed exhaustive. Web fonts are served from Planscora's own domain, so loading a page does not send your IP address or browser information to an external font provider.

11. International data transfers

Planscora's primary database and authentication environment is currently hosted in the EU (Ireland). However, not all Planscora processing occurs exclusively in the EU: some infrastructure, network, security, authentication or service-provider processing may occur in other countries.

International transfers of personal data may therefore occur. Where required under applicable data protection law, such transfers are protected by appropriate safeguards used by the relevant providers, such as adequacy decisions or Standard Contractual Clauses.

Planscora has not independently certified every international transfer mechanism; the relevant providers are responsible for the safeguards applied to transfers they carry out on Planscora's behalf.

12. Technical logs, cookies and local storage

Hosting, infrastructure and security providers may process technical logs necessary to operate and secure the service. These may include IP addresses, browser and device information, request information and timestamps.

Planscora may use browser storage and technically necessary mechanisms for authentication and session handling, application functionality, PWA and service-worker functionality, and remembering necessary application state (such as your selected units and calendar view). These are not advertising cookies.

Planscora does not use advertising cookies or third-party tracking cookies. No cookie banner or consent-management mechanism is used, because there are no non-essential analytics or marketing cookies to consent to.

13. Analytics and advertising

Planscora does not currently use advertising trackers or third-party analytics trackers within the application.

However, infrastructure, hosting and security providers may process technical logs such as IP addresses, browser and device information, request information and timestamps where necessary to operate, secure and maintain the service. This is not product analytics or advertising tracking.

Planscora does not claim that it collects no technical data whatsoever.

14. How long we keep information

Your Planscora account and training data are generally retained while your account remains active, or as long as necessary to provide the service you have requested.

When you delete your Planscora account, your authentication account and associated user data are removed from the live production systems used by Planscora. Residual copies may remain temporarily in provider-controlled backups or technical and security logs for a limited period, including where necessary for security, legal compliance or disaster recovery.

Based on Lovable's currently published privacy information, provider backups and logs may be retained for limited periods, including periods of up to 90 days depending on the type of data and processing purpose. Planscora does not promise that every copy disappears instantly from every infrastructure system.

15. Account deletion

Planscora provides self-service account deletion inside the application. You can delete your account through the account and settings functionality (My Golf → Settings → Account). Deletion is permanent and cannot be undone.

Deleting your account removes your authentication account together with the data linked to it. This includes your profile and display name, training plans and scheduled calendar activities, completed, in-progress and discarded sessions, exercise and golf practice results, tournament records and the reflections stored with them, season plans and the related planning, target and review information, weekly goals, custom exercises and sessions, notes, to-do items and checklists, preferences and settings, coach relationships and proposals, and legal acceptance records.

Training content that a coach proposed or shared and that you accepted became your own content when you accepted it. It is stored in your account and is deleted with your account like the rest of your own content.

Shared exercise library and general reference data are not personal data and remain in the service.

You are not required to email Planscora in order to delete your account, because self-service deletion is available. You may, however, contact planscora@outlook.com for privacy-related questions or requests, including if you cannot access the application.

16. Your data protection rights

Depending on where you live and the circumstances of the processing, you may have the following rights under the GDPR and other applicable data protection laws:

• the right of access to your personal data;
• the right to rectification of inaccurate personal data;
• the right to erasure (also known as the right to be forgotten);
• the right to restriction of processing;
• the right to object to processing;
• the right to data portability;
• the right to withdraw consent where processing is based on consent; and
• the right to lodge a complaint with a supervisory authority.

These rights may depend on the circumstances and the legal basis for the processing. Planscora does not promise that every request will automatically result in deletion where retention is legally required.

Apart from account deletion, Planscora does not currently provide an automated self-service export or download function, so access and portability requests are handled manually. To exercise any of these rights, contact planscora@outlook.com.

17. Children and parental/guardian consent

Planscora is not intended to knowingly collect personal data from children in circumstances where parental or guardian consent is required under applicable law. If you are below the age at which you can independently consent to the processing of your personal data in your country, you should use Planscora only with the consent or authorization of a parent or legal guardian where required.

Because Planscora is operated from Sweden, Swedish rules concerning children's consent to information society services may apply where relevant.

Where a younger user connects with a coach, that connection is created and controlled through the user's own account, and the account holder can remove the coach's access at any time.

Planscora does not currently verify parental consent, and no age-verification functionality is provided. A parent or guardian who believes a child has provided personal data contrary to applicable requirements may contact planscora@outlook.com to request removal.

18. Security

Planscora and its service providers use technical and organisational measures intended to protect your personal data. These include access controls, authentication, database access policies that restrict records to the account that owns them, encrypted connections (HTTPS), provider infrastructure security, and security monitoring and protection where provided by the infrastructure.

Privileged operations run on the server rather than in the browser.

No internet-based service can guarantee absolute security. Planscora does not claim that your data is completely secure, that security is guaranteed, or that data can never be accessed by unauthorised persons.

19. Third-party services

The following categories of third-party services are relevant to Planscora:

• Lovable — hosting and application infrastructure.
• AWS infrastructure — where applicable.
• Authentication infrastructure — managed authentication provider.
• Google — only when you choose Google Sign-In.

Planscora does not include a payment provider, because the service currently has no payment processing. Production error-reporting telemetry is not included as a Planscora service merely because Lovable editor and preview tooling exists.

When you use a third-party sign-in provider such as Google, that provider may process information according to its own privacy terms (https://policies.google.com/privacy). Infrastructure providers may use subprocessors, and the categories above may change over time rather than being a guaranteed exhaustive static list.

20. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the service, legal requirements, or our practices. The effective date and last updated date shown on this page identify the current version.

Where changes are material, we will take reasonable steps to make the updated policy available. Continued use of Planscora after a change takes effect constitutes acceptance of the updated policy where permitted by applicable law.

21. Contact

For privacy questions, requests, or to exercise your data protection rights, contact Planscora at planscora@outlook.com.

Planscora
Operator and Data Controller: Patrik Rundin
Sweden
Email: planscora@outlook.com

22. Supervisory authority

You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement, if you believe that processing of your personal data infringes applicable data protection law.

For users in Sweden, the competent supervisory authority is Integritetsskyddsmyndigheten (IMY). More information is available at https://www.imy.se/.

You are not required to lodge a complaint with a supervisory authority before contacting Planscora, and doing so does not affect your other rights.