Plainlyst privacy notice

1. Using Plainlyst without an account

You can read company reports, browse the companies we cover and use the public Data Center Map without an account.

What our code keeps in your browser. This is browser storage on your device, not cookies:

• companies you save while signed out, until you use "Clear this device" in Settings;
• your theme choice (light or dark);
• short-lived values that make sign-in and returning to a page work.

Our own code sets no cookies. Our service providers may set their own. For example, Cloudflare sets a cookie for the access gate that protects our test sites. The public site is not behind that gate.

What leaves your browser when you use the map. When you look up a ZIP code or move the map, your browser sends the ZIP code, or the edges of the area on screen, to our database so it can return nearby records. We do not save these lookups to an account, but like every request they can appear in our providers' request logs (section 8).

The background map images come from OpenFreeMap (tiles.openfreemap.org). To send them, OpenFreeMap receives your IP address, your browser's description of itself, and the map tiles you asked for, which shows roughly the area you were looking at.

Location. Plainlyst does not ask your device or browser for its location. A ZIP code and radius you choose still say something about an area you care about, and we treat them that way.

No advertising and no third-party analytics. The site loads scripts only from its own address. It contains no advertising code and no third-party analytics, and nothing about how you use the site is sent to an analytics service. The page keeps a simple count of some actions, for example which screens were opened, only in the open page's memory: it is never written to your browser's storage, never sent anywhere, and is gone when you reload or close the tab.

2. If you create an account

An account is free. To create one we need an email address and a password, or you can use Google (section 3).

Your password travels over an encrypted connection to our sign-in provider, Supabase, which stores it in hashed form.

• When you sign in, sign up, or confirm your password to delete your account, the password goes directly to Supabase.
• When you set a new password from a link we email you (after "Forgot your password?", or to add a first password to an account you created with Google), the new password passes through one of our own server functions on its way to Supabase, because that function checks that the link is genuinely yours. That function hands the password on; it does not save it or write it to its own logs. Like every request, the call itself appears in our providers' request logs (section 8).

While you have an account, we store:

• the companies you save ("My Companies"), so they follow you between devices;
• privacy settings you mark as done in Tune-Up, so you can pick up where you left off;
• a ZIP code and radius for Around You, if you choose to add them, to show data-center projects near that area;
• projects you watch, and the notices about them, so we can show you what changed;
• companies you ask us to research, and any reason you give, so we can research them and show you the status;
• feedback you send: the message, its type, an optional note of where a problem happened, and the day. It is linked to your account; it is not anonymous;
• a short record that you sent feedback on a given day (its type, the day and an identifier, never the words), to apply a daily limit. It stays if you withdraw the message, and is pruned after two days the next time you send feedback;
• whether you started, skipped or finished first-time setup, so we do not keep asking;
• when you last viewed your dashboard, to show what changed since your last visit.

Your browser also keeps a copy of your sign-in session and of your saved companies. Signing out removes them from that browser.

3. Signing in with Google

If you choose "Continue with Google", Google shares your email address and basic profile (name and picture) with our sign-in provider so you can sign in. We ask Google for no access to your contacts, files, calendar or mail.

If you sign in with Google using the same email address as an existing Plainlyst account, the Google sign-in is added to that account automatically, so both ways of signing in open the same account.

We use the information we receive from Google only to sign you in and keep your account. We do not sell it, use it for advertising, or let people read it except as needed for security, to comply with law, or with your permission. Plainlyst's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Emails

We send email only about your account: confirming your address, sign-in links or codes, password resets, codes to confirm an account deletion, and the notices about changes described in section 14. These are sent through Resend from noreply@mail.plainlysthq.com, with Resend's open and click tracking turned off. We do not send marketing email. If that ever changes, we will ask for your consent first and update this notice.

If you subscribe, we also email you the subscription notices the Terms describe (Terms, B2): a confirmation of your plan's renewal terms after you subscribe, a confirmation when you cancel that says when Premium ends, a yearly reminder of your plan and how to cancel, and any notice of a price change. Our system sends the confirmations and reminders automatically through Resend from noreply@mail.plainlysthq.com, with tracking turned off; replies go to james@plainlysthq.com. To send them, our server reads your billing email address, plan, price and dates from Stripe at the time of sending. We keep a copy of each notice we send: its text, the address it went to, and when it was sent (section 9 says for how long). If a notice cannot be sent on time, we do not send it late as if nothing had happened: we look at it ourselves and decide what to tell you. A price-change notice is written and sent by us, through the same service.

Stripe emails a receipt for each payment and each refund.

5. Payments

Premium is paid for on Stripe's own checkout page. We never receive or store your card number.

• On the checkout page Stripe collects your card details and your billing address. Your billing address is kept with your customer record at Stripe, where we can see it. We use it to confirm that a purchase comes from one of the 50 United States, where Premium is sold, and for our tax records.
• To set up a payment we give Stripe your email address and an internal account number. Stripe tells us what was bought, whether it was paid, refunded or disputed, and Stripe's reference numbers.
• When you buy, you confirm on Stripe's page that you agree to our Terms. When the purchase completes, we keep our own record of that confirmation: that you checked the box, the words shown beside it, which versions of the Terms, of this notice and of the checkout wording the page showed you, when you confirmed, and the purchase it belongs to. We keep that record so we can show what you agreed to (section 9 says for how long).

Stripe's privacy policy applies to what Stripe collects.

6. Partner referrals (program paused)

Our partner program is paused. While it is paused, Plainlyst does not record partner referral links, and the partner portal is closed.

• If your browser stored a referral code from a partner's link before the pause, our code no longer reads it or sends it anywhere. Nothing removes it while the program is paused: it stays in your browser's storage until you clear this site's data in your browser's settings.
• If a partner's referral was recorded for your account before the pause, we keep that record: which partner and when. If you pay, a commission may still be recorded against that payment. No partner is paid while the program is paused. If no referral was recorded for your account, there is nothing to keep.
• Partners never see your name or email address.

If the program reopens, we will update this notice before it does.

7. Who processes data for us

• Supabase hosts our database, sign-in system, server functions and their logs (section 13 says where).
• Cloudflare hosts the website and our domain's DNS, and runs the access gate on our test sites.
• Resend sends account emails and subscription notices.
• Google Workspace hosts our business mailbox, james@plainlysthq.com: the messages you send us, including replies to our emails, and our answers.
• OpenFreeMap provides the background map images (section 1).
• Google handles sign-in, only if you choose it.
• Stripe handles payments and payment emails (sections 4 and 5).

We do not sell personal information, and we do not share it for advertising. We may also disclose information:

• when the law requires it;
• to protect Plainlyst, our users or others from fraud, abuse or harm;
• to a buyer or successor if the business is transferred, who would then be bound by this notice for the information received.

8. Logs

Our providers' logs. Requests to our providers can be logged by them, typically with an IP address, your browser's description of itself and the time. Each provider decides what it logs and keeps those logs for the period set by its own policies and our plan with it; our code does not set those periods. People who run Plainlyst can see these logs.

Our sign-in audit log. Our sign-in provider's audit log is turned on, because our password protection relies on it. It records account events, such as password changes, with an IP address field, and it is stored in our own database. Its entries are not removed when an account is deleted. We keep them as long as we need them for security.

9. Deleting your account

You can ask to delete your account from your account page. A deletion either completes, or stops and tells you why and what to do. It stops, for example, for an unpaid invoice, a payment still going through, or a checkout still open, and what to do may be to write to james@plainlysthq.com. Once a deletion completes, it cannot be undone.

A completed deletion removes:

• your sign-in;
• saved companies, your ZIP code and radius, and Tune-Up progress;
• watched projects and their notices;
• company requests, and feedback with its daily record;
• refused referral claims;
• Premium access, including Lifetime (Terms, B3);
• any Google connection.

What is kept after a completed deletion:

• Payment records, if you paid: amounts, dates, refunds, disputes and Stripe's reference numbers. Even if you never paid, we keep any payment page you opened (plan, time, codes applied, prices quoted), payments that did not go through, and our billing record of you as a customer.
• The record of what you agreed to at checkout (section 5), for at least three years after you agreed, or until one year after your subscription or purchase ends, whichever is later.
• Copies of the subscription notices we sent you (section 4), for the same period.
• A short deletion record: an internal account number, the date of deletion, and the history of the deletion request.
• Partner referral records, if a partner's referral was recorded for your account before the pause, and any commission entries on your payments.
• Sign-in audit log entries (section 8).
• Your customer record at Stripe, with your email address and billing address, if one was created. It stays with Stripe under Stripe's policy.

These kept records are no longer linked to a login. They are not available to you or to other users through the site. People who run Plainlyst can access them. We keep them as long as we need them for accounting, tax, disputes and security.

Backups. Our database provider keeps backups of the database for the period its service provides. Deleted data remains in those backups until they expire. If we ever have to restore a backup, we keep the affected service closed until every deletion completed after that backup has been applied again.

Our providers' own logs (section 8) are not deleted when you delete your account.

10. Your choices and requests

• Saved companies: remove them with the star.
• Tune-Up: unmark a setting you marked as done.
• Area: change it, or tell Plainlyst to forget it.
• Watched projects: stop watching.
• Company requests: withdraw a request.
• Feedback: withdraw a message you sent. Messages cannot be edited, and the short daily record in section 2 stays until it is pruned or the account is deleted.
• This browser: sign out, or use "Clear this device" in Settings.
• Everything at once: delete your account (section 9).
• Questions, or a copy or correction of your information: write to james@plainlysthq.com. We aim to answer within 30 days. Depending on where you live, you may have other rights under your state's law. This notice does not limit them.

Do Not Track and Global Privacy Control. Our code does not track you across other websites, so these signals do not change what it does.

11. Children

Plainlyst is a general-audience service. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected it, we will delete it. If you believe a child under 13 has given us information, write to james@plainlysthq.com.

12. Security

Our database access rules let a signed-in person read only their own records through the site, and connections to the site and to our providers are encrypted. No system is perfectly secure. If a security incident affects your information, we will tell you as the law requires.

13. Where we operate and where data is processed

Plainlyst is operated from Ohio, in the United States, and is offered to people in the United States.

• Our database is hosted by Supabase in the United States, in the Amazon Web Services us-east-2 region (Ohio). Supabase runs our sign-in system for that database.
• Our server functions (for example, the ones that start a checkout or delete an account) run on Supabase's edge network. By default Supabase runs a function in the location nearest the request, which can be outside the United States. The information a function reads or saves is stored in the database above.
• Our other providers process data where they and their own service providers operate. Cloudflare serves the website from its global network, so a page may be delivered from a data center near the reader, which can be outside the United States. Stripe and Resend list United States hosting for their main service providers. Google may process sign-in information outside your country.

14. Changes to this notice

We post every change on this page and update the effective date above. If we make a material change, we will email account holders at least 30 days before it takes effect, unless the law requires it sooner. We will not use information we already hold in a materially different way without asking for your consent first.