PRIVACY
Privacy Policy
So you can write things down without second-guessing it. What gets stored, when anything is shared, and what you can do about it.
Last updated: September 9, 2026
The short version
- Your records are stored on your device. iCloud sync only runs if you turn it on yourself.
- Speech is turned into text on the device. The current app sends nothing to any external AI service.
- The Apple Health mood connection is optional, and off to begin with.
- The app carries no advertising or tracking SDKs. Website analytics are described below.
About this policy
上野太郎 (“we”) sets out below how information is handled in the OK Planner app and on this website.
We separate what the app keeps on your device or in iCloud from what actually reaches us, such as an email you send. Where you choose to involve Apple or another service, that service’s own privacy policy applies as well.
OK Planner is operated from Japan and the app stores your records on your own device and, if you enable it, in your own iCloud. If you use it from outside Japan, note that any correspondence you send us is handled in Japan.
Records, voice and photos
Tasks, plans and diary entries
Tasks, dates and times, notes, diary entries, the feeling tags you pick, completion history, routines, focus-timer records and your app settings are stored on your device so they can be shown, edited, searched and looked back on. Using the app needs no account of ours. What iCloud sync covers, if you switch it on, is described under “iCloud sync, reports and sharing”.
Voice input
With microphone permission, Apple’s on-device speech recognition turns speech into text. There is no feature that saves the original audio as a file in your diary or sends it to any server of ours. The resulting text is handled on the device, as a draft or a saved entry.
A supported device, language and recognition model are required, and preparing the model for the first time may involve a connection to Apple. Where on-device recognition is unavailable, you can type instead.
Photos
Photos you choose in the picker are brought into the app on your device so they can be attached and displayed. With iCloud sync on, attached photos sync too. The app never sweeps up your whole photo library. Imported images are re-encoded so metadata such as location is not carried over. Anything visible in the picture itself — text, faces, places — naturally remains in the image.
On AI and advertising
The current app does not send diary entries, photos or audio to any external AI service. There is no advertising, no cross-app or cross-site behavioural tracking, and no SDK for either.
Mood and Apple Health
The mood you choose yourself
The feeling you pick for the moment or for the day, its intensity, the words describing it, any associated items, and the date and time are saved on your device alongside the diary entry. A mood inferred from your writing or your voice is never recorded to Health as though you had entered it.
Connecting to Health
The Health connection is optional and off to begin with. When you choose to connect, permission to read and write “State of Mind” in Apple Health is requested.
While it is connected, moods you save are also written to Health: the date and time, the kind and intensity, the descriptive words and any associated items. Diary text and photos are not sent. Connecting does not upload your past moods in bulk.
Reading from Health
Health is read only when you open “Choose from Health”, and only for the day you selected. Nothing appears in your diary until you pick an entry and save it. The app cannot tell the difference between read permission being withheld and there being no entry for that day.
Where it is kept, and what it is used for
Mood records and the identifiers of anything imported from Health are managed on your device. They are not part of this app’s iCloud sync. What Health itself stores or syncs follows Apple’s settings and handling. Health information is never used for advertising, behavioural tracking, sending to an external AI, or deciding your purchase or subscription state.
Deleting records, and disconnecting
Removing a mood from an entry, or deleting the entry, removes the link inside this app. It does not delete anything already written to Health. Turning the connection off likewise leaves existing Health records in place.
Deleting records held in Health, and changing this app’s access to them, is done in Apple’s Health app. Revoking permission does not automatically delete a mood already saved on your device alongside a diary entry.
Calendars and Apple Watch
Calendar sync (Pro)
If you grant calendar access and choose which calendars to connect, the app reads event names, dates and times from those calendars to show them alongside your own plans. Exporting to an external calendar happens only when you confirm the content and the destination.
Google Calendar is reached through the calendar account added on your device. This app never receives your Google password. Exported events may sync onward to Apple, Google or another provider according to where you saved them.
Apple Watch sharing (Pro)
With Watch sharing on, the names, times and completion states of today’s tasks, pinned items and Later are shared with your paired Apple Watch. Information also travels back so that completing something on the Watch reaches your iPhone. It is not a feature for sending diary text or photo libraries to the Watch.
You can stop the connection in the app’s settings. Bear in mind what is visible on the paired device.
Purchase information
Payment and subscription management for Pro are handled by Apple. The app uses verified purchase information — product, transaction, expiry, revocation — to decide whether Pro is active, to restore purchases and to show your subscription state.
This app never receives your card number or other payment details. For how Apple handles purchase and payment information, see Apple’s Privacy Policy.
Notifications and widgets
If you allow notifications, the names and times of the tasks you set are used in local notifications on your device. Widgets and similar surfaces receive the task and timer state they need to display.
Content may be visible on a lock screen or a shared device. Notification previews and widget display can be changed in your device settings and from the Home Screen.
Contacting us, and this website
When you write to us
If you email us, we receive your address, any name you choose to give, the message, any attachments and the reply history. We use them to answer, to investigate a problem, to confirm identity where needed and to respond to lawful requests. We do not use them for advertising or to train an external AI.
You never need to send full diary entries, private photos, passwords or card numbers. If an investigation needs more, we will ask for the specific detail.
Website analytics
This site is served by Vercel and uses Vercel Web Analytics. The purpose is to see which pages are read and on what kind of device, so the wording and the site itself can be improved.
The URL viewed (which may include some query information), the referrer, the time, an approximate region, the device type and OS and browser details are sent to Vercel and used to produce aggregate counts. We read those aggregates to understand traffic patterns, not to identify anyone.
Vercel states that this analytics does not use third-party cookies and does not collect information that identifies a visitor across other companies’ apps or sites. The identifier used to count a visit is discarded after 24 hours. See how Vercel Web Analytics handles data.
Information involved in serving the site
To serve pages, respond to faults and prevent abuse, the hosting platform may process IP addresses, browser details and access times. Nothing from inside the app — diary entries, photos, tasks — is sent by browsing this site or by its analytics.
Keeping, deleting and permissions
- Records in the app
- You can edit and delete them inside the app. When a Pro period ends, tasks, diary entries and completion records are not deleted. In case of loss, damage or deleting the app, check your sync state and your device backup settings.
- What sync does with deletions
- Edits and deletions travel to iCloud and to your other devices. Sync is not a backup that lets you roll back to an earlier state. Turning sync off does not erase anything on the device or in iCloud, and changes made while it was off are applied when you turn it back on. A transfer already under way may finish.
- What remains in iCloud
- To stop deleted records reappearing, a marker recording the deletion is kept. Photo files detached from a record are not currently removed from iCloud automatically, so deleting a photo in the app may not immediately reduce your iCloud storage use.
- Device backups and external calendars
- Deleting records in the app does not sweep away exported files, device backups or events saved to an external calendar. Those are managed and deleted where they live.
- Permissions
- Microphone, calendar and notification permissions are changed in your device Settings. Health access is managed in Apple’s Health app. Calendar sync, Watch sharing and the Health connection can each be stopped in the app. Revoking a permission disables the features that depend on it.
- What you send us
- Kept only as long as needed to answer, investigate or resolve a dispute, then deleted without undue delay. Where law requires retention, it is kept for that statutory period.
Security and third parties
For personal information that reaches us, access is limited to the people who need it for the stated purpose, and devices and accounts are managed appropriately to guard against loss, leakage and unauthorised access.
We do not pass personal information we hold to third parties, except with your consent or where the law requires it. Where we use outside service providers — for email or for serving this site — they handle it only as far as the work requires, under appropriate management.
iCloud, calendars, device backups and destinations you share to are governed by the terms of those services. Please check them.
Your rights, and how to reach us
If you want to know the purpose of use, or to request access, correction, restriction or deletion of personal information we hold, get in touch. We will carry out identity checks to the extent needed and respond in line with applicable law, including where you are covered by the GDPR, the UK GDPR or a comparable regime.
Diary entries that exist only on your device cannot be viewed, restored or remotely deleted by us. You manage those through editing and deletion in the app. How deletion behaves while iCloud sync is on is covered under “Keeping, deleting and permissions” above.
Operated by: 上野太郎
Contact: info@lumo.tokyo
See Contact for how to reach us. OK Planner is operated from Japan; the statutory seller disclosure required there is published in Japanese at 特定商取引法に基づく表記.
Changes to this policy
When features or handling change, this page and its date are updated. Changes that materially affect your decisions are announced clearly in the app or on this site, and where the law requires consent, we obtain it beforehand.