Plumly Privacy Policy

Updated and effective October 10, 2026. This update describes our data practices; it does not replace any consent required before processing.

This update clarifies AI capture processing, public profiles and shared content, RSVP visibility, usage records, commercial links, and retention after deletion.

1. Who we are

Cedarline Technologies LLC, a company registered in Florida, United States, operates Plumly. This policy covers the Plumly app, plumly.app, public profiles and guides, invitations and RSVP features, and support interactions. It applies to account holders, guests, creators, invitation respondents, and website visitors. Cedarline Technologies LLC is responsible for the purposes and means of the processing described here, including as controller where that term applies.

Contact us at [email protected], or write to Cedarline Technologies LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702, United States.

2. Guest use, accounts, and profiles

You can use core local features without an account. Guest use does not mean every feature is offline: importing links, interpreting content, opening shared pages, and other connected features can involve remote processing.

When you sign in with Apple, we process your account identifier, Apple authentication identifiers, session information, and the name and email Apple supplies. Your email may be an Apple private relay address. We do not receive your Apple Account password.

You can provide a display name, photo, unique public handle, biography, and profile location such as a city. These public-profile fields identify you in search, profiles, guide attribution, and social features. A profile photo is uploaded to publicly readable storage; a profile need not have a public guide to be viewable. A private local name and a public profile are not the same thing. Review what you publish and do not include information you intend to keep private.

Plumly stores onboarding choices, device permissions and connection preferences, and a local record of Terms acceptance containing a version and acceptance time. Guest and account libraries are separated on the device. Supported sign-in and recovery flows ask whether to bring eligible guest or recovered local information into the selected account’s local library. That action is separate from a manual cloud backup or guide publication.

3. Information you save and create

Plumly handles the text, images, screenshots, URLs, notes, dates, locations, plans, reminders, and guide contents you supply or import. It also processes extracted or suggested details, such as titles, categories, event times, and venue addresses, and the relationships between saved items.

We use this information to provide the capture, organization, interpretation, planning, and sharing features you request. Information can come from you, permissions you enable, external sources you import, or other people whose content you view or save. Captures can contain personal information about you or others; avoid including unnecessary sensitive information.

Your personal library is stored on your device. Account, publishing, remote interpretation, and backup features can separately process information on our backend. Device storage can also include preferences, profile state, image caches, temporary capture files, and data shared with Plumly's share extension.

Starting an AI-assisted capture stores a draft locally before interpretation. Discarding the review result does not undo a request already sent to a provider, and a discarded draft can remain in local storage. Guide sections, item membership, private notes, public guide notes, source attribution, and pending publication or recovery information can also be stored locally. Only the fields selected for a publication are included in that publication; manual library backup is a separate operation.

4. Automated interpretation

Plumly uses local processing and Anthropic’s Claude API to classify captures and suggest details. The app sends selected screenshot or photo pixels, resized and compressed for processing, and any supplied or extracted text through Supabase to Anthropic. Requests also include a capture timestamp. For links, the app can retrieve the page’s title, description, source URL, and preview image and send that context and image for interpretation. Dictated text can be sent through this flow. Images and text may reveal people, calendar details, locations, or sensitive information even when no separate field identifies them.

Interpretation can begin before you review, save, or discard a result. Guest captures also use remote interpretation. A signed-in request authenticates to Supabase with your account session; the Claude message contains the submitted content and processing instructions, rather than a separate Plumly account identifier. Results may be inaccurate; you can review and edit them. Optional library backup is separate, so not making a backup does not prevent interpretation requests from leaving your device.

Plumly does not use your content to train AI models. Our Terms do not grant permission to use it for model training. Provider processing and retention are governed by the applicable commercial arrangements; this policy does not promise that remote processing has zero retention. Anthropic describes its commercial practices in its Privacy Center.

Do not submit content for remote interpretation if you do not want it processed for that purpose. Contact us about processing choices or deletion of information already submitted. Accepting our Terms does not replace any separate permission required by applicable law.

Our backend records classification usage metadata: the account identifier when signed in, source type, predicted category, confidence, model, and input and output token counts. The classification record does not store the submitted image or full text in that table. Error logs can contain provider errors or unparseable model output, which may contain information from the capture. This is not a promise that submitted content is absent from every operational log or provider system.

The screenshot and text classification payload does not include a separate live GPS-coordinate field. Addresses or coordinates present in your content can still be sent. Connecting the device calendar imports supported fields locally through Apple’s calendar framework; that import path does not itself call Claude. If you separately submit calendar content as an image or text for interpretation, or back up or share an imported item, the corresponding remote processing applies.

5. Library backups

Library backup and restore are manual actions you initiate. Plumly does not automatically synchronize your personal library.

A library backup can include each item's identifier, category, title, subtitle, notes, source link, image URL, and relevant place address, city, coordinates, or event start time. Records are associated with your account and include update information. Supabase provides the backend storage used for these records.

Not making another backup does not delete a backup previously created. Deleting the app is also different from deleting server records. Use account deletion or contact us about removing information held on our backend. Copies stored through your device's own backup services are governed separately by those services.

A later backup updates included records but is not a mirror that automatically removes older cloud records for items you deleted locally. The backup stores item fields and image URLs; it is not a complete backup of every photo file, guide structure, permission, or device setting.

6. Guides, public profiles, and sharing

Saving an item is different from publishing a guide. Guide visibility has these meanings:

Published guides can display the title, sections, item titles and descriptions, source and image URLs, public guide notes, product or route links, disclosure labels and details, and author information. Public profiles can include your display name, photo, handle, biography, city, public guide listings, and public activity counts. Some profile surfaces also list available shared events, places, or plans. Your private item note is distinct from a public guide note. Do not publish another person’s information or private plans without an appropriate basis.

People can save supported guide contents into their own Plumly, copy or screenshot content, and forward accessible links. Editing, unpublishing, or deleting an original does not necessarily remove independent copies. External services may cache or index public material. Contact us about removal if the available controls do not address your request. Copies hosted within Plumly remain subject to applicable privacy obligations.

When you share to Messages, email, a calendar, or another service, the selected information is provided to that destination. That service controls its own delivery and retention. Opening a share sheet does not establish that a message was delivered.

Local edits do not update the published guide until a publication update succeeds. Unpublishing makes the hosted original unavailable to public readers but retains the author’s guide; republishing can reactivate the same link. Deleting the original removes its hosted publication. Previously saved independent copies and their attribution can remain. Removing a guide container or private guide copy does not necessarily remove its separately saved library items.

We store follow relationships, guide-save records, and related activity. A creator can receive activity identifying a person who followed them or saved their guide; follower and save totals may be displayed publicly. The signed-in account’s follower-list feature lists its own followers rather than offering a public list of everyone else’s followers. Public profile information can still appear in search and discovery.

We store blocking relationships to enforce supported signed-in access and discovery restrictions. A block severs follow relationships between the accounts; unblocking does not automatically restore them. Blocks do not hide published content from signed-out web visitors or remove existing copies. Reports contain the reporting and reported account identifiers, reason, optional note, and submission information. Moderation records can also contain review status and resolution information. These are used to investigate and address abuse and legal concerns.

Guide publication and copying can involve operational identifiers, publication revisions, hashes, result records, and source attribution used to prevent duplicate operations and misattribution. Attribution can include the original author’s identifier, handle, display name, guide title, and source link. A source author’s account deletion does not automatically remove attribution stored with another user’s copy.

7. Invitations and RSVPs

Supported invitation features allow responses without signing in. Responses can include a name, response status, guest count, note, invitation identifier, device identifier, and submission time. A response without an account can still contain personal information.

For event invitations, anyone with the link can view the public roster’s respondent names, statuses, and guest counts. The organizer’s authenticated roster also includes notes and submission times. The public roster is separate from that owner-only endpoint; an invitation link is not a private audience restriction. Organizers and other viewers can retain or share information they see. Provide only the information needed for your response.

The RSVP web page stores a generated device identifier and the last name you entered in browser local storage. The identifier helps associate a reply with an earlier unsigned reply from that browser to the same invitation. It is not an advertising identifier. The browser values remain until cleared; clearing them does not delete the server response. A response submitted with a verified account session can be account-linked, but unsigned web responses are not reliably associated with your Plumly account. Deleting your account therefore does not identify every unsigned response you submitted to another person’s invitation.

To request correction or deletion of an unsigned response, email us with the invitation link or identifier and enough context to locate the response. We may need additional verification to avoid changing another person's response. Do not send passwords or unrelated sensitive information. Changing an RSVP status is not necessarily deletion of the response record.

Deleting the invitation owner’s account removes their hosted invitations and associated responses through the account-deletion process. Expiration or revocation can make a shared invitation unavailable without necessarily deleting its database records. An event date passing or changing your response to “Can’t” is not a request to erase the response. Supported RSVP alerts can send the respondent’s name and invitation title through Apple’s push-notification service to the organizer’s device, where notification settings affect display.

8. Permissions and connected features

You control device permissions through iOS settings. Available permissions depend on the feature and app version.

Photos and camera: selecting or capturing images, importing screenshots, and adding profile photos.

Microphone and speech recognition: supported voice capture uses Apple’s speech framework. On-device recognition is requested when supported; otherwise Apple’s speech service may process audio. The resulting dictated text can be sent for interpretation as described in section 4.

Calendars: after you connect the calendar and grant full access, Plumly reads supported upcoming events from the calendars available through Apple’s calendar framework. The import uses event identifiers, titles, start and end times, and locations. It currently looks ahead 180 days and excludes all-day, birthday-calendar, and canceled events. Connected imports can refresh when calendar changes are detected. Supported calendar files are parsed locally for identifiers, titles, times, locations, and source URLs. This import does not itself send the calendar to Claude. Later backup, sharing, or AI capture can transmit selected content. Exported calendar entries remain under the calendar service’s control.

Notifications: local reminders are scheduled on the device. Remote notification features use an Apple push token stored on our backend for supported event and RSVP alerts.

Location: enabled nearby-place and proximity features use the location access you grant, which can include precise or background access. Apple’s maps and geocoding services can receive place queries and location context. Location information can also be present in capture content, saved addresses, profile cities, external map links, event searches, published guide details, and manual backups. We do not treat all location-related information as device-only or anonymous.

Contacts: supported contact-selection features use the access you grant.

Music: supported music features use artist information from Apple Music and Shazam. Recent artist observations from the system music player are stored locally in a list capped at 50 entries and approximately two weeks. Artist names and a city can be sent to Ticketmaster or SeatGeek to look up events. We do not sell this information or share it for advertising.

Withholding permission can limit the corresponding feature. Revoking permission does not itself erase information already saved, transmitted, or exported. Contact us about those records separately.

9. Providers and other disclosures

The services used to provide Plumly include:

External websites receive requests when you import or open their content. What they receive depends on whether the request originates from your device or our servers. Network services process connection information needed to handle requests, and may maintain operational or security records under their applicable practices. This policy does not promise the absence of infrastructure logs.

We also disclose information when you direct us to share it, when legally required, or when legally permitted and reasonably necessary to protect people, investigate abuse, or establish, exercise, or defend legal rights. A lawful business transfer remains subject to applicable law and the privacy commitments made when information was collected.

When a link or preview image is loaded, its destination or image host can receive a network request even if you do not make a purchase. For supported TikTok imports, a metadata request can be made to TikTok. Opening product, route, reservation, or other external links sends you to that provider, whose privacy practices govern its handling of the visit. Commercial referral parameters supplied in a link may be passed to the destination. Plumly’s disclosure label does not strip or disable those parameters.

10. Usage information, advertising, and browser storage

We do not sell or rent personal information or track people across other apps and websites for advertising. Plumly does not include third-party advertising, attribution, or analytics SDKs. We do record some signed-in actions in our Supabase backend, including supported guide saves, publication actions, follows, directions, and reservations. These records contain the account identifier, action name, and action properties such as a guide slug, target account identifier, item count, or destination-app type. We use them to understand feature use and operate the service. They are separate from the classification metadata described in section 4.

Plumly's static website pages do not use advertising or analytics scripts. Hosting and security services can still process requests. Device settings, consent records, and identifiers used to associate an RSVP serve functional purposes; they are not a permission to use information for cross-site advertising.

Plumly does not operate an advertising network in this release. User-authored guides may contain sponsored recommendations or affiliate links; their authors supply the labels and explanations. An external merchant or affiliate service may apply its own tracking when you follow a link. Our statements about Plumly’s tracking do not describe every external website’s practices.

11. Retention and deletion

Different records have different purposes and deletion paths. We keep personal information for the service purpose for which it is handled and any applicable legal obligations. The criteria include whether your account or content remains active, whether the information is needed to provide a requested feature or resolve a request, and whether retention is necessary for a legal obligation or claim.

Account deletion. Use Delete account in the app’s account settings, or contact us if you cannot access the account. The process closes account upload access, removes owned avatar and event-photo objects, and then removes the account and associated active backend records. It clears the departing account’s local library, identity, relevant caches, shared-extension data, and notifications on the device completing cleanup. If deletion or local cleanup cannot be confirmed, the app retains recovery information and offers a retry or recovery flow. It does not report a verified local cleanup merely because a request was sent. Uninstalling the app alone does not request server deletion. Other account, guest, recovery, or offline-device stores are not all erased by one account’s deletion.

Deletion recovery receipts. After a receipt-enabled account deletion, we retain a receipt identifier, the deleted account’s identifier, a one-way hash of a device-generated recovery code, and the completion timestamp. This is account-linkable personal information, not anonymous data. The receipt does not contain your profile or saved content. It is retained indefinitely, with no automatic expiration, to let a device that lost the deletion response confirm completion and finish local cleanup. It is not used for marketing or advertising tracking. Ordinary users cannot browse the receipt table. A confirmation request must supply both the account identifier and recovery code and returns only whether a matching completed deletion exists. Privileged backend administration can access the stored receipt; the app’s confirmation check does not make it public. You may contact us about this retained information and exercise applicable privacy rights.

Account deletion does not automatically retrieve independent recipient copies, delete external messages or calendar entries, erase every offline device or external backup, or identify every unsigned RSVP. These limits do not remove our obligation to respond to a valid request under applicable law. Where limited records must be preserved for a legal obligation or claim, retention is restricted to that purpose.

Other retained records. Removing a guide can leave account-linked publication-operation records and deletion markers used for reliable retries; these are removed with the owning account under the backend relationships. Attribution associated with another user’s copy can survive deletion of the source author’s account. Reports made by a deleted account are removed under the reporting-account relationship; reports about a deleted account can remain with that account reference cleared, and their text may still identify someone. These records remain subject to applicable privacy rights and retention limits.

Provider backups and logs have separate retention and deletion processes. Active-record deletion is not a guarantee of immediate physical erasure from every backup or cache. A legal preservation requirement applies only to the records and period it actually covers; indefinite deletion-receipt retention is an operational recovery policy, not a claim that law requires indefinite retention.

12. Your choices and rights

You can use supported controls to edit or remove content and profile information, manage device permissions, choose whether to make a library backup, and request account deletion.

Email [email protected] to request access, correction, deletion, or an available copy of information we hold. Information stored only on your device may not be accessible to us remotely. We may request proportionate verification to protect your information and other people's information.

Depending on applicable law, you may also have rights to object to or restrict processing, withdraw consent, request portability, use an authorized agent, appeal a decision, or complain to a privacy regulator. We will respond within applicable legal time limits and explain any applicable exception. We will not unlawfully discriminate against you for exercising privacy rights. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

You do not need an account to contact us about personal information in a public guide, profile, or RSVP. Include the relevant link and enough information to locate the record. If your request concerns information someone else saved, we will assess our own obligations rather than assuming a recipient-copy exception defeats your rights. We may need to involve a processor or another responsible service to address records under its control.

13. Age, security, and international use

Plumly is intended for people aged 13 or older, subject to higher local minimum ages and parental-permission requirements. If you believe a child below the applicable minimum has provided personal information, contact us so we can investigate and take appropriate action.

Plumly is operated from the United States and is available internationally. Service-provider processing can occur outside your location. Local mandatory privacy and consumer rights continue to apply; worldwide availability does not waive them. Contact us for information about processing relevant to your request.

No electronic service can guarantee absolute security. Protect access to your device and account, and avoid publishing information you wish to keep private.

14. Changes and contact

We will post revised policies and identify their version. Material changes will be accompanied by appropriate notice and any consent required by law. A revised policy does not retroactively authorize uses inconsistent with commitments made when information was collected.

Contact: [email protected].

Cedarline Technologies LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702, United States.