Plynno Privacy Policy
Effective from 27 September 2026. Updated on 29 September 2026.
This Policy explains the processing of personal data when you visit https://plynno.app, use the Plynno web application or contact support.
The rules for using Plynno are set out in our Public Agreement. If a processing activity requires your consent, we will ask for it separately.
1. Scope
Sole proprietor Vasyl Ihorovych Prytiupa is responsible for processing data in Plynno. Contact details are in section 10. This Policy covers your account, tasks and notes, shared Spaces and support enquiries.
We comply with the Law of Ukraine “On Personal Data Protection” and the GDPR where it applies.
Organisational use of Plynno may require a separate data processing agreement. Contact support@plynno.app to arrange one.
2. Data, sources and purposes of processing
We receive data from you, from your chosen sign-in provider and automatically through technical interactions with the Service.
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, user identifier, profile name, registration dates and technical account status information; a password hash when signing in with a password | Registration, sign-in, account management and access recovery | Entering into and performing the contract |
| Sign-in data from Google or Microsoft: email address, name, identifier and available basic profile metadata within the permissions actually granted | Sign-in through your chosen provider | Performance of the contract |
| Tasks and their attributes, comments, day notes, scratchpad, display order, language, time zone, theme and other settings | Storing and displaying materials and settings you create | Performance of the contract |
| IP address, browser information, request times and technical parameters, errors and authentication events to the extent processed by the infrastructure | Delivering pages, maintaining operation, security and diagnostics | Performance of the contract for necessary delivery of the Service; legitimate interests in security and diagnostics for the relevant logs |
| Recipient address, service email content, delivery time and outcome | Address verification, access recovery and Service notices | Performance of the contract; compliance with a legal obligation for mandatory notices |
| Contact details and the content of support requests | Responding and resolving the issue | Performance of the contract or steps taken at your request before entering into it; legitimate interests in responding to other enquiries |
| Information necessary to comply with a lawful requirement or defend a specific legal claim | Compliance with legal obligations, handling claims and disputes | Legal obligation or legitimate interests in defending rights |
| Agreement acceptance record: user identifier, agreement and policy versions, server date and time, language and confirmation method | Record acceptance of the terms and the version of the data processing notice | Entering into and performing the contract; legitimate interests in evidencing its terms |
For security and handling enquiries, we may rely on legitimate interests while taking your rights into account. You may object to processing on this basis.
An email address and necessary authentication data are required for an account. You add Content yourself. If data required for a particular feature is unavailable, we cannot provide that feature.
Sign-in through Google or Microsoft. We do not receive the password for the relevant third-party account. The sign-in feature is not intended to read your email, files or calendar. Before confirming sign-in, you see the permissions requested by the provider. You can revoke access in the provider’s settings; doing so does not itself delete your Plynno account.
Sensitive data. Do not add health information, political or religious beliefs or other special categories of personal data. If you have already added such data and need help deleting it, contact us.
Shared Spaces. Members can see a Space’s tasks, assignees, messages and member names. Personal notes, the scratchpad and your quadrants remain private. Moving a task into a Space or sending a message makes it available to members of that Space.
Analytics and advertising. We do not use behavioural web analytics or advertising profiling systems. Technical logs may nevertheless be processed to operate and secure the Service. We do not sell personal data or use Content to train artificial intelligence models.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
3. Browser storage and external resources
The Service uses local and session browser storage for authentication and to save selected preferences, including the theme and workspace sizes. Retention depends on the purpose: session entries usually disappear when the tab session ends, while local entries may remain until sign-out, replacement or browser storage clearing. Authentication settings determine how long sign-in tokens remain valid.
This storage is necessary for sign-in and the features you choose. If we introduce optional technologies requiring consent, we will ask before using them.
You can clear or restrict browser storage. This may end your sign-in session or reset preferences.
4. Recipients and international transfers
We use the services listed below to operate Plynno. They receive the data needed for their role and process it under the relevant agreements. Google and Microsoft also operate under their own privacy policies.
| Recipient | Data and purpose | Processing location |
|---|---|---|
| Supabase | Accounts, authentication, Content and technical data; database and server infrastructure | Primary database: Stockholm, Sweden. Supporting processing and support may take place in other countries where Supabase and its subprocessors operate |
| Resend (Plus Five Five, Inc.) | Email address, service emails and delivery information | United States; the email sending region does not change the data storage location |
| Google and Microsoft | Authentication data exchange if you choose that sign-in method; independent processing under the providers’ policies | Countries specified in the relevant provider’s policies |
| Vercel Inc. | Hosting and page delivery, IP addresses, technical requests and infrastructure logs | United States and other countries where Vercel’s global infrastructure and subprocessors operate; processing is not limited to the EU |
The primary database is in Sweden. Support, page and email delivery and other provider operations may take place in other countries.
International transfers are subject to safeguards required by law. The agreements of Supabase, Vercel and Resend provide for EU Standard Contractual Clauses where required. Contact support@plynno.app for information about safeguards or copies of them.
We may disclose necessary data to public authorities on a lawful basis or to handle and defend legal claims.
If the Service provider changes, data will be transferred only on a lawful basis, with notice of the new controller and without arbitrarily changing the purposes of processing.
5. Retention and deletion
You can delete your account in Settings or contact support@plynno.app. Save any data you need first. Space owners must transfer ownership or delete their Spaces before deleting their account.
| Data | Retention period |
|---|---|
| Account, personal tasks, notes and settings | Until you delete them or your account |
| Tasks and messages in Spaces | Until the material or Space is deleted. Deleting your account does not itself delete shared materials; contact support about personal data in them |
| Agreement acceptance records | Until account deletion |
| Database backups | Daily backups in Supabase Pro are retained for 7 days |
| Supabase API, database and sign-in logs | Available to us for the last 7 days under standard Pro terms. Separate audit records in the database, if enabled, have their own retention period |
| Vercel runtime logs | Available to us for 1 hour |
| Resend service emails and delivery logs | 30 days; Resend backups – 7 days |
| Support correspondence | Up to 12 months after the enquiry is closed |
| Data required by law or for a specific dispute | Only as necessary until the relevant period or claim has ended |
Deleted data may remain temporarily in backups until they are rotated. It is not used for normal operations. If a backup is restored, completed deletion requests are reapplied.
Dashboard log availability does not cover every internal provider record. Technical records for security and legal compliance are retained under the provider’s agreements and procedures. We forward deletion requests to providers where necessary.
Inactivity alone does not cause account deletion. We will give advance notice if this changes.
6. Security and access
We use secure connections, access restrictions and mechanisms to separate data between accounts. When you sign in with a password, the authentication system stores its hash rather than the password in plain text. Administrative access is granted only to authorised persons to the extent necessary.
Normal operation of the Service does not involve manually reviewing your tasks or notes. Necessary access may occur to assist with your request, investigate an incident or substantiated complaint, or comply with a lawful requirement.
We take steps to protect your data, but cannot eliminate every risk of a failure or unauthorised access.
If a data breach occurs, we assess the risk and take steps to limit its effects. Where the GDPR applies, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of it, unless a risk to rights and freedoms is unlikely. Where there is a high risk, we also notify affected individuals without undue delay, subject to statutory exceptions. Other mandatory notifications are made under applicable law.
7. Your rights and requests
You have the right to know the sources, purposes and recipients of data, access your data, request correction of inaccuracies and deletion on statutory grounds, object to processing, withdraw consent for processing based on consent, and challenge unlawful processing.
Where the GDPR applies, you also have rights to restrict processing and to data portability under the conditions set out in that Regulation. Withdrawing consent does not affect the lawfulness of earlier processing.
Task export to CSV and account deletion are available in settings. For other data or to exercise your rights, write to support@plynno.app. A task export is not a complete response to a request for all your personal data.
Under Ukrainian law, we notify you of the outcome of our review of an access request within 10 working days and fulfil it within 30 calendar days, unless the law provides otherwise. Access to your own personal data may not be deferred.
GDPR requests are subject to a one-month period. An extension of up to two additional months permitted by the GDPR is possible where there are lawful grounds, with notice within the first month. It does not override shorter mandatory periods under other applicable law.
We may request only the additional information necessary to verify your identity appropriately. If we refuse a request, we explain the grounds and how you can challenge the refusal.
You may contact the Ukrainian Parliament Commissioner for Human Rights or a court. Where the GDPR applies, you may complain to a competent supervisory authority, including in the relevant state of your habitual residence, place of work or the alleged infringement.
8. Users’ age
The Service is intended for people aged 16 or over. People under 16 may not create an account. If we become aware of such an account, we will restrict access and take steps to delete the data lawfully. Users aged 16–17 are also subject to the legal capacity and legal representative consent requirements in the Terms of Use.
9. Updates to this Policy
The current version is published at https://plynno.app/privacy. We notify you of planned material changes by email or in the Service at least 14 calendar days in advance. If the law requires an immediate change or earlier notice, we act within the required periods.
Before processing data for a new purpose, we inform you and determine an appropriate legal basis. Where consent is required, we obtain it separately before that processing begins. Continuing to use the Service does not itself constitute consent to all new uses of data.
Send enquiries to support@plynno.app.
10. Data controller and contact details
Data controller: Sole proprietor Vasyl Ihorovych Prytiupa (ФОП Притюпа Василь Ігорович).
Ukrainian taxpayer registration number (РНОКПП): 3028720674.
Entry in the Unified State Register: No. 2010350000000194646 dated 29 August 2022.
Sole proprietor’s address recorded in the register: Apartment 99, building 61, Zarify Aliievoi Street, Irpin, Bucha District, Kyiv Region, 08205, Ukraine.
For all personal data enquiries: support@plynno.app.