Your plans are the whole point, so it helps to know exactly where they live and who can reach them. liveplanner stores plans on Cloudflare infrastructure behind an authenticated API, never in a third-party analytics product, and you keep control of them whether you sign in or stay a guest. This page explains how it works; the Privacy Policy, which covers every liveworkspace app, is the formal statement for the hosted service.
Where your plans live
Plans are saved through a single Cloudflare Worker API. The browser never talks to storage directly.
- Durable storage: each plan lives in its own Cloudflare Durable Object, which keeps its tabs, cards, sheets and forms in its own storage. Where a plan is filed, its folders, its share links and its timeline are kept by liveworkspace's index, the service every liveworkspace app files its work in.
- Real-time state (who is in the room, live cursors, in-flight edits) is handled by the same Durable Object, one room per plan. The room also keeps a working record of collaborative input (answers, ideas, ticks, votes and comments) in its own storage, so that saves made at the same moment can be merged.
- A cached picture of each plan, used for its thumbnail, live image and share-link card, is stored in Cloudflare R2 object storage and served back through the same API. liveplanner takes no image uploads.
Or nowhere but your own machine. A plan created in Offline Mode lives only in this browser's IndexedDB. It is never stored by the API, so none of the storage above holds a copy of it, and it stays that way until you choose Sync Plan to move it to the cloud.
liveplanner runs on Cloudflare. Your plan content goes to another company only when you use a feature that needs one:
- Emails about your work go through the email provider. They name the plan, and a mention or an assigned action quotes a little of the comment or action (see Email Notifications).
- AI tools you connect yourself, through MCP or the CLI, read the plans you let them reach, under their own terms.
What is stored, and who can read it
A plan is owned by an identity. That identity is either a signed-in account or, for guests, a guest identity that liveworkspace gives your browser, which is the same in every liveworkspace app. Only the owner, people holding a valid share link, and the members of the team whose library the plan is in can read a plan. Opening a plan you cannot access returns a plain "not found", so its contents and name are never revealed.
Staying in control
- Guest by default. You can build and share plans without ever creating an account. See working as a guest.
- Keep it in the browser. Offline Mode keeps a plan off the server entirely.
- Share on your terms. Add a share password to a plan or an expiry to a share link, and revoke links at any time.
- Delete what you own. Deleting a plan moves it to the Trash for 30 days, then removes it with its tabs, comments and share links; you can delete it permanently from the Trash sooner. Signed-in users can delete their whole account, which removes their personal plans, folders, tokens and preferences straight away.
- Opt out of analytics. The anonymous usage events have a switch in Settings. See What We Collect.
liveplanner does not claim end-to-end encryption. Plan content is protected by authentication and access controls, not by client-side encryption. Found a way around them? Please report it privately.
Was this article helpful?