Help & Documentation

All data starts on your device. Nothing is transmitted unless you opt into cloud sync or use a feature that requires it (payments, route planning).

• IndexedDB — primary store for projects, devices, contacts, gear, settings.
• OPFS (Origin Private File System) — secondary backup tier; auto-backups land here.
• LocalStorage — obfuscated preferences (theme, language, UI state).
• No account is required to use the app.
• The app works fully offline.

Cloud sync is opt-in and disabled by default. Since v0.223, an explicit Cloud Sync consent decision is recorded before any project data is uploaded — see 'Cloud Sync consent' in the Cloud Sync help article for the full grant/withdraw flow.

• Self-hosted Supabase instance on Hetzner Cloud, Nuremberg, Germany.
• Data encrypted in transit via TLS.
• Sensitive entities encrypted at rest (see the Data Encryption section).
• Explicit consent gate (v0.223 / UL-11): the upload-to-cloud step only runs after you've granted Cloud Sync consent. Until you do, sync stays paused even though you're signed in.
• Sync runs in the background while online; the app stays fully usable offline.
• Anonymous tool-usage counts: with Cloud Sync consent, opening a PDF tool or a calculator adds one to a daily counter for that tool (at most once per tool, account and day). Only the tool and the date are stored in the counter — not your account, device or IP address. To avoid counting a tool twice on one day, the server keeps a one-way hash of account ID, tool and date and deletes it the next day; nothing is saved on your device for this. To leave your account out of tool counting and of the aggregate usage statistics, turn on “Leave my account out of usage statistics” in Settings → Security & Privacy → Privacy & Legal. Admins use the totals to decide which tools to improve.
• Help-search terms: only if you turn on Help search analytics under Settings → Security & Privacy → Privacy & Legal (off by default, and you also need Cloud Sync consent), a search in the Help panel sends the search term (lowercased, at most 200 characters) and whether it found anything to a counter for that term. The term is stored without your account or IP address, so avoid typing personal details. Admins use the totals to find missing help articles. Switched off, help searches stay on your device.

1. Settings → Account.
2. Click 'Create Account' or 'Sign In'.
3. If a Cloudflare bot-check (Turnstile) appears, complete it.
4. Verify your email address and sign in.
5. In the one-time Cloud Sync consent dialog, choose 'Consent and continue' to sync, or 'Sign out instead' to upload nothing.
6. Sync becomes active; existing local data uploads in the background.

You own your data. The app neither claims rights nor sells information.

• Projects, gear, contacts, templates — all yours.
• No data mining; no advertising profile.
• Export anytime via Settings → Backup & Data.
• Account deletion removes cloud-stored data permanently and then clears the local data on the device you delete from.

A short list of services involved, exactly what they process, and what they don't.

Supabase (self-hosted, Germany)

— Authentication and cloud sync. Runs on your Hetzner instance — Supabase Inc. has no access to the data.

Stripe (Stripe Payments Europe, Ireland)

— Stripe Checkout for upgrades and Stripe Customer Portal for managing subscriptions. Processes email, card details, and IP. Sends transactional billing emails. Privacy: stripe.com/privacy.

Transactional email (self-hosted mail server)

— Account confirmations, password resets, subscription notifications, and other transactional emails are sent from the app's own self-hosted mail server over SMTP — not via a third-party email provider. Only your email address and the message content are processed, and they stay on the self-hosted infrastructure.

Marketing email (opt-in only)

— Occasional emails about the app and its plans are sent only if you tick “Marketing & product emails” at sign-up or later in Settings → General → Email Notifications. They go through the same self-hosted mail server, every one carries an unsubscribe link, and switching the setting off withdraws your consent. Legal basis: your consent (Art. 6(1)(a) GDPR).

Cloudflare Turnstile

— Bot protection on sign-in / sign-up. May process IP and browser metadata. No cookies are set. Privacy: cloudflare.com/privacypolicy.

OpenRouteService (HeiGIT, Germany)

— Optional route planning and travel-time estimates. Coordinates and IP are transmitted only when this feature is actively used. Privacy: openrouteservice.org/privacy-policy.

Open-Meteo (run on our own server)

— Weather forecasts for shoot locations are calculated on our own server, with the open-source Open-Meteo software and Open-Meteo's open weather data (CC BY 4.0). The GPS coordinates and your IP address stay on our server; nothing is sent to Open-Meteo or another weather service.

Support auto-reply (self-hosted)

— Emails to support@cine-power-planner.com get an automated acknowledgment. Rate-limited. Processes sender email and subject only; no data shared with third parties.

• No tracking pixels, no Google Analytics, no Facebook Pixel.
• No advertising cookies.

Sensitive records (contacts, your profile, invoices, expenses, billing details and more) are encrypted on your device before they are written to storage or synced.

• Cipher: AES-256-GCM.
• Key derivation: PBKDF2-SHA256 with 600,000 iterations (OWASP 2023 guidance). The key is derived from your user ID plus a server-issued seed, mixed with a per-device salt. (Older data uses a legacy 100,000-iteration path and stays readable for backward compatibility.)
• A per-device salt is stored redundantly in both localStorage and IndexedDB.
• Cloud sync transmits already-encrypted payloads over TLS — TLS is the second layer, not the only one.
• Non-sensitive preferences use XOR obfuscation only — enough to prevent casual DevTools inspection, not a security boundary.

Six rights, each mapped to an action in the app.

Access

— Settings → Security & Privacy → Privacy & Legal → 'Download my personal data' gives you everything the server holds about your account, as one file. 'Download full backup' under Settings → Backup & Data exports what is on this device.

Rectification

— Edit any record directly inside the app.

Erasure

— Delete the account from Settings → Security & Privacy → Danger Zone → Delete Account.

Portability

— JSON backup is portable and human-readable when decompressed.

Restriction

— Sign out or disable cloud sync to stop server-side processing.

Objection

— To object to usage statistics alone, turn on 'Leave my account out of usage statistics' under Settings → Security & Privacy → Privacy & Legal. Delete the account to opt out of all processing.

Account deletion removes cloud data permanently, then clears the local data on the device you delete from and reloads the app.

• Settings → Security & Privacy → Danger Zone → Delete Account.
• All cloud-stored projects, devices, contacts, and account metadata are permanently removed.
• An active subscription bought on the website is cancelled automatically via Stripe. An App Store subscription is not — cancel it in your Apple Account subscription settings first.
• Local data on the device you delete from is cleared too (a factory reset of this app's storage), and the app reloads — download what you want to keep first.

1. Settings → Security & Privacy → Danger Zone, then click 'Delete Account' to open the confirmation gate.
2. Download your tax records (GoBD) AND a full backup using the two download buttons — deletion is irreversible and erases the cloud copy of these records. The tax records are built on this device from your synced invoices; if some have not reached this device yet, the download stops and says how many are missing.
3. Type DELETE in the confirmation field.
4. Tick the acknowledgment checkbox that your data will be permanently deleted.
5. Enter your current password. The confirm button stays disabled until all of the above are satisfied.
6. Confirm. Server-side erasure of your cloud copy follows; the cloud data and account record are removed.

On first use (or after clearing site data) a banner asks for consent to the privacy policy.

• Accepting unlocks full functionality.
• Declining restricts project creation and Power Calculator use; a notice explains exactly which features are blocked.
• Cloud sync and subscription features remain usable even if you decline.
• The consent decision is stored locally; clearing site data resets it.
• Local data is never deleted just because consent was declined.

The eye icon in the sidebar footer, next to Privacy and Terms, hides every amount on screen, the way banking apps do. Use it on set, in a shared office or while sharing your screen.

• Click the eye to hide amounts. Every price, total, balance and budget then shows ••••, including dashboards, charts, invoice and quote lists, banking and project budgets.
• Bank account numbers (IBANs) in read-only views keep only their last four characters (•••• 1234).
• Click the crossed-out eye to show the amounts again. The change applies instantly, without a reload, and open forms keep their edits.
• Input fields always show their real value, so you can still edit an amount while amounts are hidden.
• PDFs, e-invoices, exports, emails and share links always contain the real amounts. Privacy mode changes only what the screen shows. The public page where a customer accepts a quote always shows the amounts too.
• The setting belongs to this device and browser. It survives a reload and is not synced to your other devices.