Privacy

Guests need no account: they give a name and their answers, nothing else. A plan lives on our server and everyone with its link can see it. It is deleted 60 days after the date it was locked in for, or 60 days after it was made if never locked in. Organisers sign in so they can find their plans again. We count page views and errors, never names, notes, titles or links. Whip sends no email or texts.

Whip helps a group pick a time. An organiser, signed in through Lotl Auth (which we operate), makes a plan and sends its link. A plan is kept on our server so everyone in the group can use it from their own device: its title, kind, area note, decide-by date and time zone; the names people give; the times proposed, each with an optional place, format and link; each person's answers; whether they said they are out; their one-line note; and which time was locked in. Everyone with the plan's link sees all of it. When someone pastes a link to a session page, our server fetches that page once to read its title; it sends nothing about you. No IP address, email or phone number is stored with a plan, and request logs do not carry names. A plan, with everything on it, is deleted 60 days after the date it was locked in for, or 60 days after it was made if it was never locked in. Page views (as a route pattern, never a plan's link) and errors go to Lotl Observe, which we operate.

What we collect

Here is everything that leaves your browser, and what stays in it:

Plans, kept on our server: Everything a plan needs so a group can pick a time: its title, kind, optional area or venue note, optional decide-by date and time zone; the names people give (a name only, nothing else is asked); each time proposed (date, start time, and optionally a place, a format, a short note and a link with the linked page's title, which our server fetches once from that site when the link is pasted, sending no data about you); places people suggest (a name, and optionally an area, a link and a note) and each person's answer on a place; times pasted in are read on your device and only the rows you add are sent; each person's answer on each time (yes, if need be or no), whether they said they are out, and their one-line note; which time was locked in. Everyone with the plan's link can see all of it. No IP address, email or phone number is stored with a plan, and Whip sends no email or texts. Request logs do not carry names: plan events are logged by kind and plan id only.Stored on our server. Deleted on a schedule, 60 days after the date it was locked in for, or 60 days after it was made if it was never locked in. Legal basis: legitimate interests. Plans delete themselves on schedule; to have one deleted sooner, email hello@lotlsoft.com with its link. Shared with: Lotlsoft's own servers.
Your place on a plan, kept in this browser: Per plan, in localStorage (keys starting whip:<plan>:): which person you are on it, and the organiser's key if this is the organiser's link. The name you last gave (whip.name), so the next plan fills it in, your theme choice (whip.theme), whether this browser has seen or put away the end-of-plan card and on which plan (whip.cta.end, whip.cta.end.done), people on a plan you said are someone else (whip:<plan>:notme) and a tab-only reload flag (whip.reloaded, sessionStorage). None of it is sent anywhere except the organiser's key, which goes to our server with each change so it knows the organiser is asking, and your person id, which says who is voting.Stored in your browser (localStorage). Kept until you delete it. Legal basis: legitimate interests. Removable when you delete your account.
Usage telemetry: Page views, reported as the route pattern (/ or /p/:id, never the plan's id), errors the app throws, and counts of what happened (a plan made, a time added, a vote cast, with its answer). Sent to Lotl Observe. Never a name, a note, a title, a link or a plan's id.Stored on our server. Kept permanently, as daily counts; the raw events are deleted after 90 days. Legal basis: legitimate interests. Not linked to you, so there is nothing of yours in it to delete. Shared with: Lotl Observe.
Accounts: Only for people who sign in (organisers must; guests never need to): your Lotl Auth account id on the plans you made (plans.organiser_user_id) and on your person on plans you joined (people.user_id), so /account can list them, give you your organiser link on another device, and protect your name: only you can be you on a plan or change your answers. Signing in also links the plans this browser joined as a guest (their person ids, held in this browser, are sent once). Lotl Auth, our own sign-in service, holds the account itself: the email address and a password hash, and sends the confirm and reset emails. Download your plans gives you every plan you made or joined as a file. Deleting your account unlinks you from every plan; your name and answers stay on those plans for the group until each plan is deleted on schedule. Organisers can also choose to delete the plans they made, for everyone.Stored on our server. Kept until you delete it. Legal basis: contract (needed to run the service). Removable when you delete your account. Shared with: Lotl Auth, Lotlsoft's own servers.
Staying signed in, kept in this browser: Only if you sign in: the Lotl Auth SDK keeps your access and refresh tokens, when the access token expires, and your account details (lotl_access_token, lotl_refresh_token, lotl_token_expires, lotl_user) in localStorage, so you stay signed in. Signing out removes them.Stored in your browser (localStorage). Kept until you delete it. Legal basis: contract (needed to run the service). Removable when you delete your account.

Where your data is stored

Plans and telemetry are stored on Lotlsoft's own servers.

Your rights

Guests have no account to tie a plan to them; plans delete themselves on schedule. An organiser who signed in can delete their account from Your plans, which unlinks them from every plan. To have a plan deleted sooner, email hello@lotlsoft.com with its link. What this browser remembers is deleted when you clear this site's data. Telemetry counts are not linked to you.

Last updated: 2026-11-10.