Cine Power Planner is a local-first app. Your projects, contacts, gear lists, and templates live primarily on your device — the app works fully offline and without an account.

If you create an account and enable cloud sync, copies of your data are synchronised to our self-hosted Supabase server (Hetzner data centre, Germany) so you can:

Access your projects from multiple devices
Collaborate with crew members
Restore from cloud backup if your device is lost or wiped

You can grant or withdraw consent for cloud sync at any time. This page explains what that means.

It covers exactly one thing: whether your project data, contacts, templates, gear lists, activity log, and similar records get synchronised from your device to our Supabase server.

It does not cover:

The Terms of Service / Privacy Policy agreement at signup (that's a separate, mandatory checkbox)
Cookies or first-party storage (handled by the small banner at the bottom of the screen on first visit)
Marketing emails (we don't send any; if we ever start, you'll be asked separately)

When you create an account, the signup form shows two checkboxes:

Terms of Service + Privacy Policy (required to create an account)
Cloud sync consent (required to use cloud features; you can sign up and use the app locally without this — see "Using the app without cloud sync" below)

Both must be checked to enable the "Create account" button.

If you signed up before this feature was introduced, the next time you sign in you'll see a one-time "Action required: Cloud sync consent" dialog. It explains what consent covers and gives two choices:

Consent and continue — records your consent and unlocks cloud sync
Sign out instead — leaves your account untouched; you can sign in later and choose at that time. After sign-out you can keep your local data on this device or clear it — your choice.

The dialog cannot be dismissed with Esc or by clicking outside. We treat the consent record as a hard requirement for any new cloud writes.

For each consent event we store a row in the user_consents table with:

Field	Why we record it
`granted_at`	When you consented
`privacy_policy_version`	Which version of the Privacy Policy was in effect at consent time
`consent_text_hash`	SHA-256 of the exact text you saw (in your locale), so even if we later change the wording we can prove what you agreed to
`consent_locale`	Whether you saw the EN or DE version
`ip_truncated`	The first 24 bits of your IPv4 (or first 64 of IPv6) — enough to verify rough origin, never the full address
`user_agent`	Browser/OS at consent time

This is the audit trail required by GDPR Article 7(1): if a regulator asks us to demonstrate that a user consented, we can show this row.

Go to Settings → Security & Privacy → Privacy & Legal. You'll see a "Cloud Sync" block that shows one of:

Granted on <date>. Policy version: <vN>. — cloud sync is active
Withdrawn on <date>. Your data is now local-only on this device. — cloud sync is off; you can re-grant
Not yet consented. — pending (you'll typically see the migration dialog before reaching this state)

Same place: Settings → Security & Privacy → Privacy & Legal → Withdraw Cloud Sync Consent.

Click the button → a dialog opens explaining what will happen:

This will erase the cloud copies of your projects, contacts, templates, activity log, and other synced data. Your local data on this device is unchanged, and your account stays open. You can re-grant consent later.

To prevent accidental clicks, you have to:

Optionally type a reason (helps us improve the product — but it's not required)
Type the word WITHDRAW in the confirmation field
Click the red "Withdraw and erase cloud data" button

Cancel closes the dialog without doing anything.

What gets erased

When you confirm withdrawal, on our servers we:

Delete all your sync_entities rows (projects, contacts, gear, templates, etc.)
Delete your stored files from gear-pictures and project-documents buckets
Anonymise your chat-message author references and activity-log entries (preserving the audit trail for the remaining project members but removing your identifiable name + free-form details)
Hard-delete invites you sent that haven't been accepted yet

What stays

Your account itself (auth.users row) — you stay signed in
Your local data on this device — every project, contact, template stays in your browser's IndexedDB
Your stripe / billing data (handled by separate flows)
The user_consents row is updated with withdrawn_at + your optional reason — the original consent grant is preserved as audit evidence

After withdrawal you can:

Keep using the app locally on this device indefinitely
Keep working locally. Re-granting is not available in the app yet: the withdrawal is shown under Settings → Security & Privacy → Privacy & Legal, but no grant button is rendered there — re-granting after an explicit withdrawal also needs a sync-engine restart, which is not built. This guide offered a "Grant cloud sync consent" button until 2026-09-08.

Withdrawal vs Account Deletion

These are different actions:

Action	What gets erased	What stays
Withdraw cloud sync consent	Cloud copies of your data	Account, local data on this device
Delete account	Cloud data AND your account; cancels Stripe subscription	Local data on this device (until you also factory-reset)

If you want to leave entirely, use Settings → Security & Privacy → Danger Zone → Delete Account, not withdrawal.

Using the app without cloud sync

You can use Cine Power Planner without creating an account at all. Just don't sign up under Settings → Account. The full app works as a local-first PWA:

Projects, templates, gear, contacts — all stored in your browser's IndexedDB
PDF exports work fully offline
Calendar, lens coverage, frame lines, power calculator — all client-side

Features that require an account (and therefore require cloud sync consent if you have an account):

Cross-device sync
Real-time collaboration with crew
Cloud backup of your work
Contracts tab (e-signature workflow)
Subscription / paywall management

Where the data lives

In transit: TLS to our Supabase server at cine-power-planner.com
At rest on our servers: Hetzner data centre, Falkenstein, Germany (EU)
At rest on your device: IndexedDB, encrypted-at-rest for sensitive entity types (contacts, invoices, expenses, billing) via AES-GCM-256 keyed off a server-side seed (so an attacker needs both your device AND access to our edge function to decrypt)
Backups: Daily encrypted borg backups on the same VPS, GPG-encrypted, retained per the borg retention schedule

Questions or data requests

For data access, correction, or erasure requests (Articles 15, 16, 17, 20 of the GDPR) — including requests about your data held by us as a non-user contact (someone else added you to their project's contact list) — email support@cine-power-planner.com.

The Privacy Policy at /privacy-policy covers our full data-processing terms and identifies the data controller for legal purposes.

Related developer docs

Feature spec: docs/features/cloud-sync-consent/ — full SDD pipeline (requirements / design / tasks / status)
Audit origin: .agent_archive/audit-data-safety-retention-2026-05-21.md finding UL-11
Release notes: CHANGELOG.md v0.223.0 and v0.223.1

Last Updated: 2026-09-08 Version: 0.790.2