Every Plan CD app ships with the same privacy policy, and it fits in one sentence: the app collects no personal data. No account, no sign-in, no analytics, no crash reporter, no advertising network, nothing sent anywhere. The full policy is four short paragraphs, and the reason it is short is that there is nothing to disclose.

That is unusual enough for a paid utility app that it is worth explaining why, and what we give up to keep it true.

What “no tracking” means in practice

When you open Aerial Aligner on a roof, or Stove Toolkit in a showroom, the app does its work on the phone and stops there. Specifically:

  • No accounts. There is nothing to sign up for, so there is no email address, no password, and no database of users to lose.
  • No analytics or telemetry. We do not know which screens you use, how long you spend, or whether you finished the calculation. There is no third-party SDK in any app; the only code that runs is ours and Apple’s.
  • No advertising. You paid for the app once. Nobody else is paying for your attention inside it.
  • No backend. The calculations, the reference tables and your saved history all live on the device. If Plan CD disappeared tomorrow the apps would keep working exactly as they do today.
  • Permissions are used for the feature, then forgotten. Location is read once to find your transmitter or your latitude; the compass and motion sensors drive the live alignment while you are on that screen. None of it is stored or sent.

The one deliberate exception is the optional postcode lookup in the alignment apps. If you type a postcode rather than using GPS, the app sends that postcode, and nothing else, to a public lookup service to turn it into a grid reference. Those apps say so on their own privacy page, because a policy that claims “nothing leaves the device” has to be literally true.

Why we work this way

The people using these apps are at work. A Gas Safe engineer gas-rating a boiler, a landlord recording water temperatures, a joiner checking a pitch: these are professional tasks in other people’s homes. The results can end up in front of building control, a letting agent or a tenant. That data is not ours to collect, and it is a liability to hold.

Tracking changes what you build. Once an app reports usage, every design conversation drifts towards engagement: prompts, streaks, notifications to bring people back. A calculator should be opened, used and closed. The only metric we care about is whether the number was right, and no analytics dashboard can tell us that. Verification against the source documents can.

Privacy is easier to promise than to keep. A policy that says “we may share data with partners” is a policy you never have to update. Ours says “none”, which means every new feature has to clear that bar before it ships. That constraint has been useful: it is the reason the apps have no cloud sync, no login and no dependency on any service that could be switched off or breached.

App Review and trust. Apple’s privacy labels on our App Store pages read “Data Not Collected”. For a small developer with no marketing budget, that label and a policy anyone can read in thirty seconds are worth more than any feature list.

What it costs us

We should be honest about the trade-offs, because there are some.

  • We cannot see crashes. If an app crashes on your phone, we only find out if you tell us. That is why every app page has a support address, and why we test on real devices before every release rather than relying on crash reports afterwards.
  • We cannot see what is popular. Feature decisions come from support email, App Store reviews and our own use, not from usage graphs. We think that produces better apps, but it is slower.
  • No sync between devices. Your saved calculations are on the phone you made them on. Export exists (PDF, CSV, share sheet) so the data is portable, but there is no account to sync through, by design.
  • No free tier funded by ads. Where an app is free to try, like Legionella Logger, it is funded by a one-time unlock, not by advertising.

How to check for yourself

You do not have to take our word for it. On the App Store page for any Plan CD app, scroll to App Privacy: it should read “Data Not Collected”. On the phone, Settings › Privacy & Security › App Privacy Report lists the network domains each app has contacted; ours should be empty, or for the alignment apps, show only the postcode lookup when you have used it. If you ever see anything else, email privacy@plancd.com and we will treat it as a bug.

The policy, in full

The generic policy for the fully offline apps is at plancd.com/privacy.html. Apps that make any network request at all get their own page saying exactly what is sent and to whom; Solar Aligner’s is at /solar-aligner/privacy.html. If a policy ever changes, the date at the top changes with it. Given that nothing is collected, we do not expect it to.