Privacy Policy

This policy explains what data PilatesPlug ("we", "us") collects, why we collect it, and the choices you have. We aim to collect as little as possible while still running a reliable service.

1. Information we collect

Account data. Email address (for sign-in via magic link or OAuth) and an account ID.

Profile content. Anything you publish on your page: display name, bio, services, rates, links, social handles, profile photo, optional background image, theme choices, and custom domain.

Billing data. If you subscribe to Premium, Stripe handles payment processing. We store a Stripe customer ID and the subscription status, never card numbers.

Analytics. When a visitor opens your public page we record a timestamped, anonymized view (approximate country derived from the request, referring site, and the link that was clicked). We do not set tracking cookies for analytics and we do not build cross-site profiles of visitors.

Operational logs. Cloudflare and Supabase generate request logs (IP address, user agent, error traces) used for abuse prevention and debugging. Logs are retained for a short window and then discarded.

2. How we use your data

• To render your public page and operate the dashboard.
• To authenticate sign-in attempts.
• To process Premium subscription payments (via Stripe).
• To provide you with aggregated analytics about your own page's traffic.
• To send essential transactional emails (sign-in links, billing notices).
• To prevent abuse and enforce our Terms.

We do not sell your personal data. We do not run third-party advertising on the Service.

3. Subprocessors

We rely on a small number of vendors to run the Service:

• Cloudflare — hosting, CDN, custom-domain SSL.
• Supabase — database, authentication, and file storage.
• Stripe — payment processing for Premium subscriptions.

Each subprocessor handles data only as needed to perform its function.

4. Cookies

We set only essential first-party cookies needed for authentication. We do not use third-party tracking cookies.

5. Public profile content

Anything you publish on your profile page is intentionally public — that is the point of the Service. Search engines and link previewers may index your page. Do not publish information you are not comfortable being public.

6. Data retention

We retain account data for as long as your account is active. Raw analytics rows are retained for up to 14 days and then aggregated into daily rollups. Aggregated analytics are retained for the lifetime of the account. Operational logs are retained for a short window (typically less than 30 days). When you delete your account, your profile, services, links, uploads, and analytics are removed within 30 days.

7. Your rights

Subject to applicable law (including the GDPR and CCPA where relevant), you have the right to access, correct, export, or delete your personal data. Most of these are available directly from the dashboard. For anything you cannot do yourself, email support@pilatesplug.app.

8. Children

The Service is not directed at children under 16 and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.

9. International transfers

Our subprocessors operate globally. By using the Service you understand your data may be processed in countries other than your own.

10. Changes to this policy

We will post material changes here and update the "Last updated" date above. For significant changes we will also send an email to active accounts.

11. Contact

Questions or requests about your data? Reach us at support@pilatesplug.app.