Privacy Policy

01Who this covers

Plug is a platform where creators publish a storefront and sell digital products. Three kinds of people appear in this policy: creators, who hold an account and publish a page; customers, who buy or download something from a creator; and visitors, who open a storefront without buying.

Plug and the creator each hold information about a customer, for different reasons. Plug runs the platform. The creator runs their own business. When you buy something, both of them end up with your email address.

02What Plug collects

From a creator, when they sign up and set up a page: email address, a password (stored only as a hash, never in readable form), the handle they choose, and whatever they add to their storefront — display name, bio, profile photo, product titles and descriptions, prices, cover images, and links.

From a creator who signs in with Google: the email address, name and profile picture Google returns. Plug asks Google for nothing else, and cannot see your Google password.

From a customer, at checkout: the email address you enter. That is the whole of it — it is what the product is delivered to and what proves the purchase is yours later.

From files a creator uploads: the file itself, its name and its size. Plug measures the size to apply the storage allowance on the creator's plan.

From visitors: a count of how many times a storefront has been opened. It is a single number per storefront. It is not tied to you, and Plug does not record who opened a page.

03What Plug does not collect

Plug does not process payments yet, and collects no card or bank details from anyone. Priced products cannot currently be bought.

There is no analytics service, no tag manager, no advertising pixel and no third-party script anywhere in Plug. Nobody is tracking you across other websites, because there is nothing in the page that could.

The only cookies are the ones that keep a creator signed in. There is no advertising cookie, so there is no cookie banner — there is nothing to consent to.

Plug does not sell personal information, does not share it for advertising, and does not build profiles or make automated decisions about anyone.

Plug does not read the contents of the files a creator uploads. They are stored and delivered, not inspected.

04What it is used for

• Running your account and your storefront.
• Delivering what a customer bought, and letting them get it again later.
• Sending transactional email — a download link, a link back to a library. Plug does not send marketing email.
• Showing a creator how their own storefront and products are doing.
• Keeping the service working and looking into problems when something breaks.

05What the creator you bought from can see

The creator can see the email address you used at checkout, what you bought, when, and how many times you have downloaded it.

That is how selling works — they are the seller and you are their customer. They can also export that list. What they then do with your address is their responsibility under their own obligations, not Plug's, and Plug does not control it.

Creators cannot see each other's customers, and no creator can see anything about a purchase made from someone else.

06Who else handles it

Plug uses a small number of services to run. Each one only receives what it needs to do its job.

• Supabase — the database, sign-in, and image storage. Holds accounts, storefronts, orders and profile images.
• Cloudflare R2 — storage for the files creators sell. Files are private and are only handed out through a signed link that expires in about a minute.
• Resend — sends transactional email. Receives the recipient address and the message.
• Vercel — hosts and serves the site.
• Google — only if a creator chooses to sign in with Google.

These providers process data outside your country in some cases, including in the United States. Plug does not disclose personal information to anyone else, except where the law requires it.

07How long it is kept, and deleting it

Account and storefront information is kept while the account exists. Purchase records are kept while they are needed to prove an entitlement — that is what lets a customer come back for a file months later.

You can ask for your information to be deleted, or for a copy of it, by writing to support@plugapp.co. Plug will act on it. During the beta this is handled by a person rather than a button in the product, so allow a few days.

One limit worth stating plainly: deleting your Plug account does not reach the copy a creator already exported of their own customer list. For that, ask the creator.

08Security

Passwords are hashed by the authentication provider and are never visible to Plug. Access to every row of data is enforced by the database itself rather than by the app asking nicely, so a creator can only read their own records.

Files for sale are never public. They are held in private storage and released only through a short-lived signed link, issued after the database confirms the purchase.

No system is perfect, and Plug is a new one. If something looks wrong, write to support@plugapp.co.

09Children

Plug is not for children. Accounts are for people aged 18 or over, and Plug does not knowingly collect information from anyone under 13. If you believe a child has given Plug information, write to support@plugapp.co and it will be removed.

10Changes

This policy will change as the product does — payments in particular will add a payment processor and the data that goes with it. When something material changes, the effective date at the top changes and account holders are told. It will not be altered quietly.

11Contact

Write to support@plugapp.co with anything about this policy, about your information, or about a creator's use of your information.

Plug is operated at plugapp.co.