Privacy notice
Last updated 27 October 2026
PyroPlanner is a tool for planning fireworks shows. This notice says what personal data it keeps, why, who else handles it, and what you can do about it.
Short version: we keep your email address and what you create in the app. You can delete your account yourself at any time.
1. What we store
- Your account: your email address, and how you sign in (email links, and passkeys if you add them: the passkey’s public key and a name for the device, never a fingerprint or face). Also your settings: language and whether products you add to a show go on your wishlist.
- What you create: your shows (name, date, place, budget, notes, status, camera settings, and the products in them with their timing and placement), your lists of products you want, have ordered or own (with quantities, price paid, shop and order date), and the products you add to the catalog.
- Sharing: if you turn on sharing for a show, anyone with its link can watch it and copy it. They see the show’s name, products and timeline. They do not see its date, place, budget, notes or status, your lists, or your email address. We count how many times a link was opened and copied, but not by whom.
- Technical data: our servers keep short logs of errors and actions (with internal ids, not your email address). To stop abuse we count requests per account, or per visitor using a one-way scrambled form of the IP address, for a few days at most.
2. Why we use it
To run the service you asked for: signing you in, saving your shows and lists, sharing them when you choose, and showing you the products. To keep it secure and stop abuse, such as automated sign-ups and flooding. We also use your email address to send the sign-in link, and nothing else: no newsletters.
The legal grounds are providing the service you signed up for, and our legitimate interest in keeping it secure.
3. Who else handles your data
We use these providers to run PyroPlanner. They handle data on our behalf:
- Supabase: the database and sign-in. Our project runs in Ireland (EU).
- Vercel: hosting. The application runs in Dublin, Ireland. Vercel also keeps request logs, which can include IP addresses.
- Cloudflare Turnstile: a check on the sign-in page that you are a person. It looks at technical information such as your IP address and browser.
- Our email service: it delivers the sign-in emails, so it sees your email address and the one-time link.
- YouTube (Google): only when you press Play on a show or a product video. Then your browser loads the videos from YouTube’s privacy-enhanced mode (youtube-nocookie.com), and Google receives your IP address and may store information in your browser. Nothing is sent to YouTube before you press Play.
Some of these providers belong to companies outside the EU/EEA, such as in the United States. Such transfers rely on the safeguards the law accepts, for example the EU–US Data Privacy Framework or standard contractual clauses.
5. Products you add to the catalog
A product you add stays private to you until we review it. The person running PyroPlanner can see unverified products and which account made them. If we verify a product, it becomes part of the shared catalog that every user sees. It is then no longer tied to you, and it stays even if you later delete your account.
6. How long we keep it
Your account and what you made stay until you delete your account. You can do that yourself on the Account page. Deleting it immediately removes your sign-in, passkeys, shows, lists and the unverified products you made that nobody else uses, and any share links stop working. Products that other people’s shows or lists still use stay without your name on them, and so do verified products.
Copies may remain for a limited time in the database provider’s encrypted backups until they expire. Logs are kept by us and our host for a short period. The abuse counters are removed after a few days.
7. Your rights
You have the right to:
- see the data we hold about you;
- correct it (most of it you can edit yourself in the app);
- have it deleted (use Delete account on the Account page);
- restrict or object to how we use it.
Contact us to use any of these. You also have the right to complain to the data protection authority.
8. Security
Connections are encrypted. Each person can reach only their own shows and lists, and the server checks this on every request. No system is perfectly secure, and a share link is a secret: anyone who has it can open the show, so share it only with people you trust, and stop sharing when you no longer want it open.
9. Changes
If we change what we store or who handles it, we will update this notice and the date at the top.
10. Who is responsible, and how to reach us
Contact us about anything in this notice: pyroplanner@seilonen.fi.
In Finland the authority is the Data Protection Ombudsman (tietosuojavaltuutettu), tietosuoja.fi.