Privacy Policy

1. Who is responsible

The data controller is Cankat Filiz, operating PlushCrew as a personal project in Sweden.

For questions about your personal data, contact hello@plushcrew.ai.

2. Data we process and why

• Accounts and sign-in: name, email, password hash (not your plaintext password), sessions and verification records. Google/GitHub sign-in can also provide a provider identifier and avatar URL. We use these to provide and secure your account.
• Messages and projects: prompts, conversation context sent with a request, generated results, code, tests, QA reports and uploaded audit files. We process these to answer you, run your requested task and provide previews/downloads. Signed-in mission results are saved to your history.
• Guest limits: we temporarily process the request IP and store a keyed hash, dispatch timestamps, mission status and hashed download capability. These records enforce five guest Chat messages and one guest Mission per rolling 24 hours. The hash is pseudonymous; it is not a claim that the records fall outside data-protection law.
• Usage and security: token counts, model choices, rate-limit records and operational diagnostics help enforce limits, investigate failures and protect the service. Hosting and security providers may process connection data, including IP addresses, in their own logs.
• Waitlist and support: email, requested plan, your submitted feedback and correspondence are used to respond or provide the update you requested.

The intended lawful bases are performance of the service you request for account/task processing, legitimate interests for proportionate security and abuse prevention, and legitimate interests in understanding aggregate website use for the basic cookieless counts described below. Where processing is required by law, the basis is legal obligation. These bases and the legitimate-interest assessment must be confirmed by the identified controller; visitor counts are not a condition of using PlushCrew.

3. AI processing and other recipients

Sending a message or starting an audit sends your prompt, relevant context and, where needed, project source and tests to AI providers. QA can make additional model requests using those files. AI processing happens on provider systems, not solely in your browser or on our server. Only submit material you are authorised to share. Remove passwords, API keys and sensitive personal information first.

• Google Gemini: Chat and Gemini-selected missions/QA use Google. Google’s applicable API terms determine its processing; free quota alone does not establish whether submitted content is used for model improvement.
• OpenAI / Anthropic: used for models you select, or for a selected hybrid workflow when its escalation is enabled and configured. Provider availability depends on server configuration.
• DigitalOcean, Vercel and Cloudflare: host, deliver and protect the service. These providers receive connection information needed to handle requests.
• Google / GitHub: handle the sign-in method you choose. Loading an account avatar also contacts its image host.
• Do It Launch: serves the launch badge image in the footer, receiving connection information when that image loads. We suppress the page referrer for that image and its outbound link.
• Resend or configured email delivery: handles verification and requested service/waitlist emails. Sentry: receives error/performance diagnostics when enabled. Serper: receives queries when web search is used.
• Vercel Web Analytics: basic cookieless page-view measurement on public website pages, enabled by default unless you have opted out or your browser signals Global Privacy Control. Existing refusals are respected. We send only the page-view event type and a page URL stripped of queries and fragments through our event filter; prompts, uploaded files, account details and custom events are not included.
• Lemon Squeezy: may process checkout and payment information if paid checkout is enabled. Current advertised paid plans are waitlist-only.

We do not sell your personal data. Providers may process data outside the EU/EEA. Applicable processor agreements and lawful transfer safeguards, such as an applicable adequacy decision or standard contractual clauses, must be verified for the actual accounts and services before this draft is published. Contact the controller for the applicable safeguards; this notice does not itself create them.

4. Retention and deletion

• Temporary generated files and audit uploads: these are temporary workspaces, not permanent storage. Cleanup is configured to target folders after seven days without directory modification, with checks at API startup and hourly while it is running. This is a cleanup target, not a guaranteed deletion deadline. Active work, outages and cleanup errors can delay removal. Download files you want to keep.
• Guest mission/download records: cleanup targets records older than seven days from dispatch, except while their worker is active. Guest chat reservations become eligible after 24 hours and are removed on a subsequent successful cleanup or request for that IP. These are configured targets, not guaranteed deletion deadlines. Failure or cancellation still consumes the daily slot.
• Accounts, saved mission text and token usage: retained while your account remains active. Expiry of workspace files does not erase the saved text history.
• Sessions: normally expire after 30 days and are revoked on sign-out. Expired database sessions are removed by scheduled cleanup.
• Account deletion: the Delete Account control removes the application’s account, sessions, mission history, token usage, matching waitlist entries and owned output/upload folders. An active worker must finish cancellation before deletion completes.

Deleting an account or clearing browser data does not erase files you downloaded, copies you shared, or independent provider records. Operational logs, backups and support correspondence require separate retention/deletion handling; their actual settings and lawful exceptions must be documented before publication. They are not covered by the temporary-workspace deletion job.

5. Your privacy controls and rights

Signed in: open your profile menu → Download my data for a JSON copy of your account profile, saved mission text, token usage, session dates and waitlist entries, or Delete Account to request permanent deletion of application account data. The export excludes passwords, session/verification tokens, output files and independent provider or operational-log records; contact us for additional access requests. Clearing browser data below only removes local data and signs out; it does not delete your account or reset a guest allowance.

For access, a portable copy where applicable, correction, erasure, restriction, or an objection to processing based on legitimate interests, email hello@plushcrew.ai. Explain which right you wish to exercise. Do not send a password, API key or identity document in your initial request. We may need proportionate information to verify that the request relates to you; we do not require you to create an account just to make a request.

Rights have legal conditions and exceptions. Requests are normally answered within one month; if a lawful extension is necessary, we will explain it within that period. You can turn off basic visitor counts below. You may also complain to Sweden’s IMY or your competent data-protection authority.

6. Browser storage and basic visitor counts

The necessary plushcrew_session cookie supports OAuth sign-in and normally lasts 30 days. Password sign-in stores a session token and basic profile in this site’s local storage until sign-out or clearing. The server still checks the token’s expiry. Tab storage can hold an unsent prompt across sign-in, guest mission/download handles, task/reasoning choices and motion preferences. Tab storage normally ends when the tab session ends; browser session restoration may restore it.

Basic cookieless page views are enabled by default to estimate visits and page views, unless you previously refused analytics or turn them off below. They do not identify exact individual people. Turning counts off has no effect on free runs or account access. Vercel processes limited usage/device and connection information for its aggregated statistics; this site does not send it prompts, project files, account details or custom events. Your preference remains in this browser until you change it or clear site storage. A separate local flag remembers that you dismissed the informational notice; dismissing it is not consent. Counts are not sent from localhost development pages. Vercel analytics privacy details.

Basic visitor counts: on unless you opted out or your browser requests privacy.

The controls affect this site/origin in this browser. Other browsers, devices, the www and non-www domains, and localhost can have separate storage. Clearing removes saved drafts and guest download links; download anything you need first. The opt-out preference remains stored so visitor counts stay off.

7. Security and age restrictions

Passwords are hashed with PBKDF2-SHA256. Account access checks and isolated execution reduce risk but do not guarantee that AI-generated code or any service is secure. Review generated files before using them.

The current sign-up screen and provider age/access requirements are not yet aligned. That issue is unresolved; this draft does not change or override any AI provider’s restrictions.