Privacy Policy

Who is responsible

[Company name] ([Registered address], Portugal) is the controller of your personal data under the EU General Data Protection Regulation (GDPR). For anything about your data, email support@plurary.com.

What we collect

Your account

• Email address and password (stored only as a secure hash by our sign-in provider).
• Optional: display name, profile picture, and two-factor sign-in if you turn it on.
• Your plan (Free or Premium) and, if you pay, your subscription status. Card details are handled by Stripe; we never see or store them.

What you add

• Trackers and entries: titles, covers, ratings, statuses, dates, progress, notes and custom fields (which can include places you pick on a map).
• Photos you upload (Premium) and image links you paste.
• Share links you create, and suggestions visitors send you through them.
• Settings: theme, grid or carousel view, and your where-to-watch country.

When you visit a share link

Visitors don't need an account. If a visitor suggests an entry, we store what they type (title and optional note) for the tracker's owner to review. Their IP address is used briefly, in memory, to stop spam, and isn't saved.

Technical data

Like any website, our servers see your IP address and basic request details (browser, time, page). Our hosting provider keeps these in short-lived logs to run and protect the service. We use them for security and fixing problems, not to profile you.

Why we use it (legal bases)

• To provide Plurary (contract): your account, trackers, share links, Premium and support.
• To keep it safe (legitimate interests): rate limits, preventing abuse, security logs, backups.
• To meet legal duties (legal obligation): invoices and tax records for payments.

We don't sell your data, show ads, or use advertising or analytics trackers. We only email you about your account (for example, sign-up confirmation, password resets, and important changes to these terms or to Premium).

Cookies and storage

We only use what's needed to make Plurary work, so there's no cookie banner:

• Sign-in cookies that keep you logged in.
• A cookie remembering grid or carousel view.
• Your browser's local storage for small preferences, like the last where-to-watch country you picked.

Who helps us run Plurary

These providers process data on our behalf, only for the purpose listed:

• Supabase: database, sign-in and file storage (your account, content and photos).
• Vercel: hosting the website and running its servers.
• Stripe: Premium payments and invoices.
• Cloudflare: encrypted backups of the database.
• An email delivery provider: sign-up and password emails.

Some features look things up with other services. Our servers send them only what's needed, never your email or name:

• What you search for (titles, places) goes to the matching catalogue: TMDB, IGDB, Open Library, Taddy, MangaUpdates, Metron, Geoapify (places), and the Streaming Availability API (where to watch).
• Recipe links you add are fetched by our server to read the recipe's title, picture, time and servings.

Cover images, streaming logos, map tiles (from OpenFreeMap) and image links you paste are fetched by our server and passed on to you, so those services see our server, not your IP address. “Open in Maps” and streaming links take you to those services' own sites.

Some providers may process data outside the European Economic Area. When they do, the transfer is protected by the EU's Standard Contractual Clauses or an adequacy decision.

How long we keep it

• Your account and content: until you delete them or your account.
• When you delete your account, your data and uploaded photos are deleted immediately. Copies in backups are removed within 90 days.
• Payment and invoice records: as long as tax law requires (usually up to 10 years), even after you delete your account.
• Server logs: kept by our hosting provider for a short period, typically a few days.

Your rights

Under the GDPR you can:

• see the personal data we hold about you and get a copy of it;
• correct it (most of it you can edit yourself in the app);
• delete it: in Settings, “Delete account” removes everything;
• get your data in a portable format: in Settings, “Your data” downloads it as JSON or CSV;
• object to or ask us to restrict certain uses.

Email support@plurary.com for any of these. We'll reply within one month. You can also complain to a data protection authority. In Portugal that's the CNPD (cnpd.pt), or you can go to the authority where you live.

Security

Connections are encrypted (HTTPS). Each account can only reach its own data: the database enforces this, not just the app. Passwords are hashed, and you can turn on two-factor sign-in. No system is perfectly secure, so if we ever learn of a breach affecting your data, we'll tell you and the authorities as the law requires.

Children

Plurary is for people aged 16 and over. If you believe a younger child has created an account, email support@plurary.com and we'll delete it.

Changes

If we change this policy in a way that matters, we'll tell you by email or in the app before it takes effect. See also our Terms of Service.