Privacy Policy

This Privacy Policy explains how Pluff ("Pluff," "we," "us," or "our") collects, use, disclose, retain, and protect personal information when individuals use pluff.social, creator accounts, public storefronts, hosted products, buyer access areas, AI-assisted features, payment-related features, support channels, and related services that link to this Policy (collectively, the "Service").

This Policy applies to Creators, Buyers, visitors, trial users, and people who communicate with Pluff. It does not govern the independent privacy practices of Creators, Stripe, external websites, or other third parties. If you do not agree with this Policy, do not provide personal information or use the Service.

Pluff is offered to Creators in the United States and in the other countries where Creators can connect a payout account (listed when they connect their bank); Buyers may be located anywhere. If we materially change our geographic offering, products, data uses, or legal obligations, we will update this Policy and implement additional notices or consent mechanisms as required.

Pluff determines how personal information is processed for account administration, subscriptions, platform security, AI features, analytics, legal compliance, and operation of the Service. For information a Creator collects from Buyers through a storefront, the Creator and Pluff may each have separate responsibilities depending on context and applicable law.

Creators independently determine their product content, customer relationships, marketing practices, refund policies, and any additional Buyer information they request. Each Creator must provide any privacy notice legally required for the Creator's own activities and may use Buyer information only for lawful, disclosed purposes.

A Buyer should contact the applicable Creator about the Creator's independent use of Buyer information. A Buyer may contact Pluff about Pluff's platform-level processing, account access, security, or privacy rights.

The personal information Pluff collects depends on whether you are a Creator, Buyer, visitor, or applicant for a particular feature. The table summarizes the principal categories.

Creators can sign up and log in with email and password or with Google. When you use Google, Google shares your name, email address and profile photo with Pluff; we use them to create and sign in to your account, and your Google photo becomes your starting profile photo, which you can change. Pluff never receives your Google password and doesn't access your Google contacts, files or other data. Sign-in is handled through our hosting provider's authentication service. When you sign up we also ask, optionally, where you heard about Pluff (for example Instagram, TikTok, YouTube or the web); the answer is kept with your account and shared only with the Pluff team, so we learn where creators find us.

When a visitor taps a link, affiliate product pick or discount code on a Creator's page, or opens one of the Creator's keyword links (pluff.social/@name/word, or a word typed in the page's keyword box), Pluff records only which item or word it was, whether a code was copied, and when — no name, email, IP address, cookie or device identifier is stored with it. Creators see these counts to learn which links, codes and videos work. The visitor's IP address is used only for a moment, in memory, to limit abuse, and is not saved. If a visitor who arrived by a keyword buys or joins within 30 minutes in the same browser tab, Pluff notes that keyword with the order so the Creator can see how many sales and sign-ups each keyword brought. When someone opens a Creator's page or one of their product pages, Pluff also records the kind of place the visit came from (for example TikTok, Instagram, YouTube, search, email or a keyword link — worked out in the visitor's own browser from the page that sent them and the link's tags) and, when a checkout opens, which product it was for; nothing that identifies the visitor is stored with these counts, and no cookie is used. Creators see them as views, sources and conversion per product.

Pluff generally does not store complete payment-card numbers or online-banking credentials. Those details are collected directly by Stripe or another authorized Payment Processor. Pluff may receive a transaction identifier, card brand and last four digits, billing country, connected-account status, payout status, risk signals, and other information needed to operate payment features.

Some content may contain personal information about other people. You may submit such information only when you have a lawful basis and any required permission. Do not upload government identifiers, full payment credentials, passwords, protected health information, or highly sensitive information unless Pluff specifically requests it through a secure workflow.

Support and feedback. When you contact Pluff Support — from Help in your workspace or the Support page — we collect your name, email, your messages (including replies you send to our support emails, which our email provider receives and passes to us) and any screenshots you attach, what the request is about, and, to help faster, the page you came from, your browser and device, and (when you're signed in) your Pluff handle and plan. We use them only to answer you and fix problems; we email our replies to you and keep the conversation so you can follow it. When you answer one of Pluff's short questions (for example, how easy launching your page was, or why you're cancelling your plan), rate an AI reply or build, or share feedback, we keep your answer, any words you add, the page you were on, and your handle and plan. When you rate an AI reply or build, we also keep a short excerpt of what you asked and what the AI produced, so we can see what worked and improve it. Support conversations are kept while your account exists (or, if you wrote in without an account, until you ask us to delete them); feedback answers are kept for up to 12 months. Deleting your account deletes your support conversations, screenshots and feedback answers.

Private demo. If Pluff gives you a code to try the demo at pluff.social/demo, we keep the name you enter, which code you used, when you entered, your device and browser type, and your country (from your connection), and we email them to the Pluff team so we know who visited. We keep them for up to 12 months.

Partner Program. If you apply to Pluff's Partner Program, we collect your name, email, your Pluff handle, the social profile links and follower counts you share, and a screenshot showing your follower count, and we use them to review your application and run the program; the screenshot is stored privately and read only by the Pluff team. Approved partners set up payouts with Stripe, our payment processor, which collects their bank and identity details under its own privacy policy, and we may request tax information before a payout. When someone opens a partner's referral link, we count the visit per day and set a first-party cookie for 60 days so a Pluff account created from that browser can be credited to the partner; we store which partner referred an account and the plan payments that earn commissions.

We collect information directly from you when you register, connect Stripe, create products, submit prompts, upload files, configure a storefront, buy a product, request support, complete a survey, or communicate with us.

We collect information automatically from browsers, devices, cookies, logs, security systems, and interactions with the Service. We may receive information from Creators, Stripe, identity and fraud providers, authentication providers, referral or affiliate partners, publicly available sources, and services you intentionally connect.

If a Creator imports or submits information about Buyers, collaborators, leads, or testimonial participants, the Creator represents that the collection and disclosure are lawful and consistent with the Creator's notices and permissions.

We use personal information to provide, maintain, personalize, and improve the Service; create and secure accounts; authenticate users; enable product creation, hosting, publishing, purchase, access, and delivery; administer subscriptions and AI Credits; and provide support.

We also use information to process or facilitate payments, application fees, refunds, disputes, and payouts; verify identities and connected-account status; detect fraud, abuse, account sharing, scraping, infringement, and prohibited products; enforce agreements; comply with law; and protect Pluff, users, and the public.

We analyze product and feature usage, performance, errors, conversion events, and aggregated commercial activity to understand whether the Service works, improve user experience, evaluate AI quality, develop templates and features, and make plan or product recommendations.

We communicate about transactions, trials, renewals, changes, security, support, products, and---where permitted---marketing. We may use information for another compatible purpose disclosed at collection or with consent.

When you use an AI-assisted feature, Pluff processes the prompt, selected account context, Creator Content, requested settings, prior refinement messages, and resulting output. This information is sent to Pluff's AI provider, Anthropic (Claude) — or, as a backup, through Lovable's AI Gateway to its underlying artificial-intelligence providers — solely as needed to generate output, monitor performance, prevent abuse, and support the feature. To make follow-up requests faster and less costly, an AI provider may temporarily keep the beginning of a request (such as Pluff's standard instructions and earlier messages in the same conversation) for up to 24 hours and reuse it only for later requests from Pluff.

If you attach files to an AI request (for example notes, a PDF, a Word or PowerPoint file, an ebook, a text file, or an image), Pluff stores them privately in your account's storage, and sends their content to Pluff's AI provider (Anthropic, or Lovable's AI Gateway as a backup) only to generate that request's output. When you give the AI a link to move your existing page or products to Pluff (for example a Stan Store, Linktree or Beacons page, your website, or a public Google Doc), Pluff fetches that public page — and a document it links to, which is stored like an attachment — and sends its content to the AI the same way; if you ask it to, it copies your profile photo from that page into your account. When you ask the AI to put a photo you attached or linked on your page (as your profile photo, banner or a product photo), Pluff copies it into your account's public storage so it can be shown on your page. Attached and imported files are never shown to Buyers or published. When you ask Pluff to build a community for you, Pluff sends the titles, descriptions and outlines of your products, your bio, a few excerpts from your voice library and, if you have one, a PDF you sell on Pluff to the AI, and fetches any public links you add (for example your website, a YouTube channel or an old community page) the same way; the result is saved as a community that stays switched off until you switch it on, and nobody is charged or emailed by it. Voice typing in the AI composer uses your browser's built-in speech recognition, which may be processed by your browser or device maker under their own terms; Pluff receives only the resulting text.

To make AI Output sound like you, Pluff keeps a private voice library in your account: short excerpts of your own writing — what you paste in Settings or when you sign up, the text of a website, newsletter or public YouTube video's captions you link (Pluff fetches that public page or feed only when you ask), and, while AI memory is on, your bio and product descriptions from a page you move to Pluff, text files you attach to an AI build, and your own rewrites of text the AI wrote — plus the phrases you always or never use and a style profile derived from them, rebuilt automatically as the library grows. With AI memory on, Pluff also keeps up to 30 examples of how you changed text the AI wrote for your products and emails (the AI's words and yours), and a phrase you delete from its text three or more times joins your never-say list. A few excerpts and examples are sent with each AI request, only to tailor that request's output to how you write; they are never shown to Buyers or other Creators, and an AI app you connect receives them only when it asks for your profile. Settings → Your voice shows every source and learned phrase, each removable; turning off AI memory stops the automatic learning; the library is included in your data export and deleted with your account.

Your conversations with Pluff's AI (what you asked, which builds and page changes it made, and whether you kept or undid a change) are saved privately in your account so you can return to them on any device. Each answer runs on Pluff's servers and is saved as it happens, so it finishes (and the changes you asked for are made) even if you leave the page or close the app; the working copy used to produce it is cleared once the answer is done. We also record how much AI processing each request used (counts only, never the content) to manage costs. To tailor its output, the AI also receives a short summary of your own workspace with each request: your products, prices and which are live, how your link-in-bio currently looks, your page and product numbers (views, checkouts started and sales, and where each product loses buyers), how far members get in each of your challenges and courses and where they stop (counts only), the member wins you chose to feature, how your buyers rated each product (counts, plus the words and first names from a few of the newest reviews), and what you recently asked for, kept, or undid; when it builds a product or writes an email for you, it also gets your best sellers and the questions your members asked in your community in the last 60 days, so what it makes answers what they actually need. An AI app you connect receives the same summary when it asks for it. It also keeps a short list of lasting facts you've told it or chosen (for example your niche, your audience, the tone and looks you like or dislike), plus how you sound as inferred from your builds when you haven't saved a voice profile, your answers to a build's questions, a page look you undid, an AI answer you rated down together with the comment you wrote, and a few examples of how you reworded text the AI wrote for your products and emails (compared with its first draft as you save, and once a day), so it doesn't have to ask again; it doesn't save passwords, payment details or other people's personal information. Settings shows exactly what that summary and list contain, and you can remove any single fact, the reworded examples, or all of them. You can delete a single chat, or forget your whole chat history in Settings, at any time; chats and saved facts are also deleted with your account and included in your data export. This information is never shown to Buyers.

Connected AI apps. A Creator can connect an AI app of their choice (for example Claude, ChatGPT, Cursor or Codex) to their Pluff account through Pluff's MCP connector, by signing in from that app or with a personal token from Settings → Connected AI apps, and chooses what each connection may do: see the workspace, make changes, see and contact their people, and start Pluff Assistant builds. With the build permission, the app can also hand Pluff files to build from — a public link Pluff fetches, text, or a file it uploads through a one-time upload link — which are stored privately and used exactly like files attached to an AI request (never shown to Buyers or published). With the people permission, the app receives the personal information of the Creator's Buyers, members and applicants that it asks for — such as names, email addresses, orders, messages, application answers and bookings — and can reply to them for the Creator. Pluff sends this information at the Creator's direction; once received, it is processed by that AI provider under its own terms and privacy policy, not Pluff's, and the Creator is responsible for having a lawful basis to share it and for any notice their Buyers and members are owed. Pluff keeps each connection's name, permissions, dates and when it was last used, and a log of the actions it took (which action, which product or item ids, when, and whether it worked — never message text or personal details); Settings shows the last week of it, Export data includes every connection and the last 120 days of its log (never a token), and it is deleted with the account. Tokens and sign-in codes are stored only as one-way hashes. The Creator is emailed when a new app or token is connected, can revoke any connection at any time, and every connection ends when the password is reset, the account email changes or the account is deleted.

AI prompts and outputs may be reviewed by automated systems and authorized personnel for troubleshooting, safety, quality evaluation, billing, or abuse prevention. We seek to use available contractual and technical controls that restrict third-party providers from training public general-purpose models on private Creator Content. Pluff does not intentionally authorize such training without separate disclosure and, where required, consent.

Pluff may use de-identified and aggregated signals---such as common product structures, edit patterns, generation success rates, conversion ranges, safety classifications, and feature performance---to improve templates, evaluations, recommendations, security, and AI-assisted experiences. We do not attempt to re-identify information that has been properly de-identified.

Do not submit confidential third-party data, protected health information, payment-card data, government identifiers, or information you lack authority to process. Creators are responsible for reviewing and correcting AI Output before publication.

Stripe processes Creator onboarding, identity and business verification, payment credentials, charges, connected accounts, payouts, refunds, disputes, fraud signals, and tax-related information under Stripe's own terms and privacy policy. Stripe may require personal information directly from Creators and may share status, transaction, risk, and account information with Pluff.

When a Buyer purchases a Creator Product, Stripe processes the payment directly on the Creator's connected account (a Stripe Connect direct charge), and Pluff receives its Platform Fee as an application fee. The Creator's statement descriptor ordinarily appears on the Buyer's card or bank statement. Pluff receives information needed to confirm payment, calculate Platform Fees, provide access, issue receipts, support refunds and disputes, and maintain records. Pluff does not control Stripe's independent legal obligations or retention.

When a Creator offers an after-purchase offer, Stripe saves the Buyer's payment method on that Creator's connected account (not with Pluff) so the Buyer can accept the offer with one tap shortly after paying. Pluff never sees the full card details and only triggers a charge when the Buyer taps to accept. Memberships and payment plans are Stripe subscriptions on the Creator's connected account: Stripe keeps the payment method there to charge each renewal or installment, and Pluff receives the subscription's status and dates to show the Buyer and Creator and to end access when a membership ends. Discount codes a Creator creates, and how often each is used, are stored with the Creator's account.

We may disclose transaction information to the relevant Creator, Buyer, Stripe, banks, card networks, fraud providers, tax authorities, regulators, or law enforcement as necessary to complete the transaction, prevent harm, resolve a dispute, or comply with law.

We may disclose personal information to service providers that perform hosting, databases, storage, authentication, AI processing, email, customer support, analytics, security, fraud prevention, identity verification, payments, accounting, legal, and other operational services. They may process information only for authorized purposes and subject to applicable contractual restrictions.

Pluff sends transactional emails through Resend, our email delivery provider, from pluff.social: purchase receipts with a link to open what was bought, free sign-up confirmations, 1:1 call confirmations with a calendar invite, a notice if the Creator moves (with an updated calendar invite) or cancels a booked call, refund confirmations, membership and payment-plan notices (trial ending, upcoming yearly renewal, renewal receipts, failed payments and when a membership ends), and, to Creators, a welcome message, notices of new sales and bookings (and, at most once a day, a note that a member posted in their community), plan notices (trial ending, upcoming yearly renewal, failed payments, plan canceled, a switch to Basic, plan ended), dispute alerts with the response deadline, a notice when an AI app or personal token is connected to their account, their own link-in-bio address with how to add it to Instagram and TikTok when they ask Pluff to email it to them, a note when a buyer couldn't check out because payments aren't set up, page-review notices, and confirmation when an account is deleted. Emails about a purchase show the Creator's name, and replies go to the Creator. The link in a purchase email is signed so it can restore the Buyer's access on any device. Pluff does not use these emails for its own marketing and does not track opens or clicks. A Creator may also connect other services on the Integrations page (such as Zapier, Make, Slack, Discord, Google Sheets, Kit, Mailchimp, beehiiv or their own webhook). When they do, Pluff sends the events they choose — for example a sale, free sign-up, new subscriber, waitlist join, booked call or refund, with the person's name and email, the product and the amount — to that service on the Creator's behalf, and the service's own terms and privacy policy apply from there. The Creator chooses what to send and can disconnect at any time; API keys and webhook addresses are stored encrypted. Separately, Pluff sends Creators optional tips and reminders about their own account: nudges when something is left unfinished (a link in bio that isn't published, a product draft, a product with a price while no bank account is connected, a plan checkout left open), tips during the free trial, a note after it ends, a reminder after a period without visiting, a low-credit notice, a note the first time a visitor opens one of their products, a note the first time a visitor arrives from their Instagram or TikTok bio, first-sale and milestone notes, and a weekly summary on Monday mornings (their page visits, orders and sales for the week, with up to three suggested next steps Pluff Assistant can do with them). They are based on the state of the Creator's account (for example whether a page is published or a draft exists) and on its anonymous page counts and sales, are cancelled when the situation is resolved, go out at most about once every two days (apart from notes about something that just happened), and can be turned off with the link in any of them or in Settings → Data controls; account, billing and sale emails are not affected. When a Creator uses Pluff's email marketing tools or runs a challenge or course, Pluff sends that Creator's emails to their contacts and members through Resend or Amazon Web Services (Amazon SES), our email delivery providers, on the Creator's behalf, from pluff.social with the Creator's name, with replies going to the Creator; each marketing email carries an unsubscribe link, and Pluff keeps a per-Creator list of people who unsubscribed so they are not emailed again. Pluff does not track opens or clicks in these emails either.

We disclose information to Creators and Buyers as necessary to complete transactions, provide purchased access, communicate, deliver support, process refunds, and resolve disputes. We may disclose information to a person or organization at your direction, such as an integration or an AI app you connect.

We may disclose information when reasonably necessary to comply with law, legal process, sanctions, tax obligations, or governmental requests; enforce agreements; protect rights, property, safety, and security; investigate fraud or abuse; or establish, exercise, or defend legal claims.

We may disclose aggregated or de-identified information that does not reasonably identify an individual. We do not permit recipients to re-identify that information.

If you created your Pluff account through an affiliate partner's link, that partner can see the first two letters of your handle, when you joined, whether you're on a free trial, paying, or not subscribed, and the commissions your plan payments earned them. They don't see your name, email, page, products or buyers.

A Creator may receive a Buyer's name, email, purchase, product access status, communications, refund or dispute information, and other information necessary to fulfill the purchase and administer the customer relationship. The Creator may not receive the Buyer's complete payment-card number or banking credentials from Pluff.

Creators are independent recipients of Buyer information. Their use of that information is governed by their own privacy notices and applicable law. Pluff contractually restricts Creators from selling Buyer information, using it for unrelated purposes, sending unlawful marketing, or retaining it longer than necessary, but Pluff cannot guarantee every Creator's conduct.

Visitors who join a product waitlist, use a storefront's Subscribe button, or respond to a storefront email pop-up give their email address to that Creator. Pluff stores it on the Creator's behalf, shows it only to that Creator, and lets the Creator export it or email these people with Pluff's email tools; Pluff never uses these lists for its own marketing. Buyers and challenge participants may also receive a Creator's marketing emails, and anyone can unsubscribe from a Creator with the link in any of that Creator's emails. Some of a Creator's automations follow a Buyer's activity: progress saved in a challenge or course (which days or lessons are done) can trigger a reminder to keep going, a congratulations when it is finished, or a request for feedback, and they stop when the Buyer finishes, is refunded, or unsubscribes. If a Buyer starts paying for a product, leaves without finishing, and agreed at checkout (through Stripe's email-consent option, where offered) to receive emails, the Creator's “left checkout” email may remind them once; nothing is sent without that agreement. A visitor who wants to be removed may ask the Creator or contact privacy@pluff.social.

Applications. When you apply through a Creator's application, sign-up or waitlist form, your name, email address and answers go to that Creator. Pluff stores them on the Creator's behalf, shows them only to that Creator (who can export them), and sends you that Creator's emails about your application: that it arrived and whether you were approved or declined. If you are approved, Pluff records the approval with the Creator, much like a free order, so you can open what it gives (for example the Creator's community at pluff.social/me), and may email you a signed link for it. Your email is added to the Creator's contacts, so they may email you with Pluff's email tools; every such email has an unsubscribe link. If the Creator connected an integration (such as Zapier, Google Sheets, Slack or an email-list service), your name, email address and answers are sent to it. Deleting the form or the Creator's account deletes your answers.

Tips. When you send a Creator a tip, Stripe takes your payment and your email address, and the Creator sees the amount, your email and any name and note you add. Your name and note appear on the Creator's page only if you tick "Show my name and note on the page" — the Creator can hide them, and refunded tips come off. Pluff keeps your tip with the Creator's other orders, emails you a thank-you, and deletes the list of tips if the Creator deletes the tip jar or their account.

Reviews. If a Creator asks how something you got from them was, and you answer, your rating (Loved it, Good or Not for me), any words you add and your email address are stored with that Creator's account. In their workspace the Creator sees your rating, words and first name; your email is kept so you have one review per product that you can change or remove, and appears only in the Creator's own data export (the Creator already has it from your order or sign-up). Your words appear on the Creator's page, with your first name only, just when you tick that the Creator can show them and the Creator then picks them; changing your words, or unticking that box, takes them off the page. You can change or remove your review from the product's page while you still have access to it, or ask privacy@pluff.social to remove it. The Creator's Pluff Assistant, and any AI app they connect, can also read a few of the newest reviews' words and first names (never your email), whether or not you allowed them to be shown, to help the Creator see what buyers say; they are never shown to other buyers unless you allowed it and the Creator picked them. Reviews are deleted with the Creator's account.

When a Buyer works through an interactive guide, Pluff saves their progress to that purchase so it follows them to any device: answers typed into the guide's worksheets, trackers and checklists, quiz answers, and finished chapters. It is stored privately, linked to the purchase email, and only a browser that holds access to that purchase can read or change it; the Creator does not see worksheet or quiz answers. Deleting the Creator's account deletes this progress; a Buyer may ask privacy@pluff.social to delete theirs sooner.

Challenges and courses. When you join a Creator's challenge or course, Pluff records your place with that Creator — your email, the name you joined with, the round you're in, when and how you joined — and your progress: tasks ticked, days or lessons completed, quiz answers, your answer if you tell the host whether a day was useful, roughly how long you spent on each day or lesson (counted while it's open on your screen), the 1–10 confidence score if a lesson asks for one, and each check-in (a note, a photo or a link). The host sees the useful answers and times only as totals per day. The Creator (the host) and their moderators see each member's name, email, progress, last activity and check-ins; a check-in is private to them unless you tick “Share it with the group”, which shows your first name, words, photos and number to the others in your round under that day. The host may reply to or heart a check-in, and may feature one you shared on their public challenge page (your first name, words, one photo and number); untick sharing to take it off. Check-in photos are stored privately and shown only through short-lived links. The host's live-call links and replays are shown only to members.

Member profiles. In each Creator's groups you can set a profile: a display name, photo, short bio, up to two social links and a one-line goal. Only a name is needed; unless you type a fuller name, others see your first name and the initial of your last name. Your profile is shown to the host and to the members of the groups you're in, and you're identified to them by a private key — never by your email. Profiles are kept per Creator, so other Creators' members can't link them.

Groups, posts and messages. Each challenge round (and a course or General community when the Creator turns it on) has a private group. Posts, comments, reactions and photos there are seen by the host and everyone in that group; a win can show the day it's about, and the group may see a count of how many members finished a day. Messages follow the host's setting — questions to the host only (the default), open messages between members, or announcements only — and a message is seen by the people in that conversation. Photos are stored privately and shown through short-lived links. You can delete your own posts and comments one by one, or leave a challenge or course group and take down all of them there at once (Community → ⋯ → Leave the group). Leaving keeps your access to what you paid for, and you can rejoin any time. To remove messages or leave a Creator's General community, ask the host or privacy@pluff.social.

Reports. When you report a post, comment, profile or message, Pluff records the reason, any note you add and what was reported, and shows it to the host. Reports of scams, self-harm or illegal content are also sent to Pluff, which may review the reported content and the accounts involved, and may keep a record of the report to protect people and enforce our Terms.

Challenge emails. Pluff emails members of a challenge in the Creator's name (replies go to the Creator): that you're in (with your access link), when doors open (if you're on the waitlist), the day before a round starts, at most one email a day with that day's action, a reminder shortly before each live call, a note when a round ends, and a congratulations when you finish. Every daily email has a "Stop daily emails for this challenge" link; the "you're in" email and your access still work. Courses that open lessons over time also email you when your next lesson or module opens, with a "Stop emails for this course" link. The host gets a daily summary of new members, questions and reports.

Deleting and exporting. A Creator's Export data includes their challenges and courses, members, progress and check-ins, posts, comments, messages and reports. Deleting a challenge or course, or the Creator's account, deletes its members, progress, check-ins, profiles, posts, comments, reactions, messages, reports and uploaded photos. A member may ask the host or privacy@pluff.social to delete their profile, posts and messages sooner.

Anyone who joins or buys on Pluff has a free member account at pluff.social/me, identified by their email. Signing in uses a one-time link sent to that email or Google sign-in (Pluff receives the Google account's name, email and profile photo, and uses only the verified email to find what that person joined or bought). There is no password. The member account lists what that email joined or bought across Creators, progress, the groups they're in and upcoming live calls; signing out removes access from that browser.

Buyers should avoid submitting sensitive information directly to a Creator unless necessary and should review the Creator's disclosures. Suspected misuse may be reported to privacy@pluff.social.

Communities. A Creator's General community (reached from pluff.social/me) is open to people who joined or bought from that Creator. Posts, comments and reactions there are seen by the Creator and by everyone else in that community, with your profile name (your first name and the initial of your last name unless you set a fuller one — never your email). The Creator can remove posts and comments, pin an announcement, mute or remove a member. You can delete your own posts and comments at any time. Pluff stores the community with the Creator's account and deletes it if the Creator deletes their account (switching a community off only hides it).

Paid and free communities. When you join a Creator's community, Pluff records your place the same way as in a challenge — your email, the name you joined with, when and how you joined, and your order if you paid — and shows the host your name, profile, when you joined and when you were last active. Inside, other members see your profile, your posts, comments and reactions, when you joined (in the members directory), and, if the Creator uses points, your points and level: they're counted from the reactions others give your posts and shown on your profile and on the community's leaderboard. Poll votes are kept per poll under your private member key, not your email; members see only the totals, after they vote, and the host sees the totals. Search looks only through posts you can already see, and posts you save are kept on your device only. The host may greet you with a message inside the community. Pluff emails you in the Creator's name: a reminder shortly before events, at most one email a day when someone replies to you or the host answers you (none if you've been back in the community since), and a weekly summary; one switch in the community turns these off. Events link to the Creator's own video service, which has its own privacy practices. Leaving a community or its group works as for challenges, and deleting the community or the Creator's account deletes its members, posts, poll votes and settings.

Moving a community. When a Creator moves their community from another platform, the Creator decides who to bring and is responsible for having the right to do so; Pluff stores the list on the Creator's behalf, as their service provider. The file is read in the Creator's browser and only what the move needs is sent to Pluff: each person's email, name, original join date, tier or plan, status, the date they paid through and their old price, plus any bio or social links in the file, which are added to your profile only when you open the community. Pluff uses this to give you access, to email you an invite and at most three reminders in the Creator's name, and — if you were paying and keep your spot — to tell you the price and date before the first charge. Until you open the community you aren't shown to other members, aren't counted in its member numbers and get none of the Creator's marketing emails; if you had opted out of marketing on the old platform, that carries over. Pluff records whether each invite was delivered, bounced or marked as spam (from our email provider) so a move can pause. Choosing "Don't move me" in an invite removes you from that move and keeps only a one-way code of your email so you aren't imported again; a Creator can also undo a move, which removes everyone who hasn't arrived. If you never open the community, your personal data in the move is deleted 180 days after the last invite (or after a longer free period ends), leaving only that code. If you ask to be let in through a Creator's claim link, your name and email go to that Creator, who approves or declines. A Creator's Export data includes their moves, and deleting their account deletes them.

Substack. When a Creator connects their Substack, Pluff reads that publication's public feed — post titles, links, dates and cover images, never subscriber data — and stores the newest few with the Creator's page so the page can show them. A visitor's tap on a post opens it on Substack; the Subscribe form is Substack's own and loads from Substack only when a visitor taps Subscribe, so what you enter there goes to Substack under its privacy policy. When a Creator uploads their Substack subscriber list so paid subscribers get in free, the file is read in the Creator's browser and only paid subscribers are sent to Pluff: each person's email, name (when the file has one) and when they subscribed. Pluff keeps it on the Creator's behalf, only to give those people access, to let them claim their spot with their email, and to send the invites the Creator chooses to send — it works the same way as moving a community above (including "Don't move me" and the 180-day deletion for people who never come in). It is included in the Creator's Export data and deleted when they replace or remove the list (for people who haven't come in) or delete their account.

Pluff does not sell personal information for money. We may use analytics, attribution, referral, or advertising technologies to understand traffic and promote Pluff. Some state laws may define certain transfers for cross-context behavioral advertising as "sharing" or a "sale" even when no money changes hands.

Before Pluff activates non-essential advertising technologies that require a choice, we will provide an appropriate cookie or privacy control. Where legally required, Pluff will honor a valid opt-out preference signal such as Global Privacy Control for the browser or device that sends it.

A "Your Privacy Choices" link or comparable control will be made available if Pluff engages in processing that requires such a link. Disabling advertising cookies does not prevent essential, security, or transaction cookies and does not eliminate advertisements that are not based on cross-site activity.

Cookies and similar technologies help Pluff keep users signed in, remember settings, maintain carts or checkout state, prevent fraud, measure performance, diagnose errors, attribute referrals, and understand usage. These technologies may include cookies, local storage, pixels, software development kits, and server-side event records.

Interactive tools inside a Creator Product, such as worksheets, checklists, trackers and quizzes, save what a Buyer enters in their browser storage and, for a purchase or free sign-up they have access to, to that purchase on Pluff's servers so it opens on any device (see “Creator Access to Buyer Information”). Previews that aren't linked to a purchase stay on the device only.

Pluff uses technologies for authentication, security, remembering what a Buyer bought in their browser, the payment flow and preferences. We don't use advertising cookies, cross-site tracking or analytics. The full list, with each item's purpose and duration, is in our Cookie Policy at https://pluff.social/cookies. If we ever add analytics or advertising technologies, we'll update that page and ask for consent first where the law requires it.

You can adjust browser controls and any Pluff privacy settings. Blocking essential cookies may prevent the Service from working. Cookie duration ranges from a single session to the period reasonably necessary for the described purpose.

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, including account operation, Buyer access, transactions, disputes, safety, fraud prevention, backups, legal compliance, and enforcement.

Account and Creator Content are generally retained while the account is active and for a limited period after closure to permit recovery, resolve disputes, or satisfy legal obligations. Transaction, tax, payout, refund, and dispute records may be retained for seven years or another legally appropriate period. Security logs may be retained as needed to detect and investigate abuse. AI request logs and support records are retained for operational, quality, safety, and legal needs and may also be subject to provider retention schedules.

Deletion from active systems may not immediately remove information from encrypted backups. Backup information is isolated from ordinary use and deleted or overwritten according to backup cycles. We may retain information longer when litigation, investigation, legal hold, unpaid balance, abuse, or another lawful need exists.

De-identified information may be retained without the same time limits provided we maintain it in de-identified form and do not attempt to re-identify it.

Pluff uses administrative, technical, and organizational safeguards intended to protect personal information, including access controls, authentication, encrypted network transmission, provider security controls, logging, backups, and role-based access where appropriate.

No system, transmission, model provider, or storage method is completely secure. Pluff cannot guarantee absolute security. Users must protect credentials, enable available multifactor authentication, use unique passwords, restrict team access, and promptly report suspected incidents to support@pluff.social.

If a security incident affects personal information, Pluff will investigate and provide notices required by applicable law. We may require identity verification before discussing an account or releasing information.

You may update many profile, storefront, communication, and billing settings through your account. Changes to your link in bio are saved as a private draft that only you see until you publish it; your export includes it, and deleting your account deletes it. Creators have Data controls in Settings: turn off AI memory (the AI then uses none of your workspace, past chats or saved facts, and saves no new facts), delete all AI chats, turn off sale and booking alert emails, export everything Pluff holds for your account as a file (plus your contacts and orders as spreadsheets, a download link for each file you uploaded, valid for one day, and your guides' PDFs), clear preferences saved on a device, and delete your account. Deleting your account cancels any emails still scheduled in your name (email automations, scheduled broadcasts and live-call reminders) and removes the files and data stored for it — uploads and photos, email lists and settings, AI chats and what the AI learned (including your voice library), your page draft, integrations, discount codes, tip jars' tips, keyword results, link-tap and page counts, connected AI apps and their activity log, your community and your buyers' progress in your products. Pluff's own AI usage totals keep no link to a deleted account. You may unsubscribe from marketing emails using the link in the message. Transactional, security, billing, product-access, and legal messages may continue while necessary.

Creators may request export or deletion of eligible account data. Deletion may be limited when information is needed for Buyer access, transactions, legal obligations, disputes, fraud prevention, security, backups, or legal claims. Closing an account does not cancel obligations owed to Buyers or Pluff.

You may control non-essential cookies using available tools and may disconnect integrations through settings or the relevant third party. Disconnecting a service may not delete information already lawfully received.

Depending on your state and whether an applicable law covers Pluff, you may have rights to confirm processing; access, correct, or delete personal information; obtain a portable copy; opt out of sale, targeted advertising, sharing, or certain profiling; restrict or withdraw consent; and appeal a denied request.

Submit a request to privacy@pluff.social or through the privacy request method made available on pluff.social. State your name, account email, state of residence, requested right, and enough information for us to locate the relevant records. We will verify the request proportionately and may ask for additional information. We will not discriminate against you for exercising a privacy right.

An authorized agent may submit a request where permitted, but we may require proof of authorization and direct identity confirmation. If we deny a request, we will explain the basis where required and provide appeal instructions. Rights are subject to legal exceptions, including transaction completion, security, fraud prevention, legal compliance, free speech, and legal claims.

For California residents, the categories collected during the preceding 12 months may include identifiers; customer records; commercial information; internet or electronic-network activity; approximate geolocation; audio, visual, and other uploaded content; professional or employment-related information a Creator provides; inferences; and sensitive personal information such as account login credentials or identity information processed for verification.

We collect these categories from users, devices, Creators, Stripe, connected services, fraud and identity providers, and public sources. We use and disclose them for the business and commercial purposes described in this Policy. Recipient categories include Creators and Buyers involved in a transaction; infrastructure, AI, payment, security, analytics, communications, professional, and support providers; connected services; legal authorities; and parties to a business transaction.

Pluff does not sell personal information for money. If Pluff uses advertising or analytics practices that qualify as a sale or sharing under California law, California residents may opt out through the privacy controls described above. Pluff does not use sensitive personal information to infer characteristics or for purposes requiring a right to limit beyond what is reasonably necessary to provide and secure the Service.

California residents may request access to categories and specific pieces, deletion, correction, and information about disclosure, and may opt out of sale or sharing where applicable. Pluff does not knowingly sell or share the personal information of consumers under 16. Pluff does not offer financial incentives in exchange for personal information unless separately disclosed under applicable law.

Creator accounts are limited to adults. The Service is not directed to children under 13, and Pluff does not knowingly collect personal information directly from a child under 13 without legally required parental consent.

If we learn that a child under 13 provided personal information in violation of this Policy, we will take reasonable steps to delete it. A parent or guardian may contact privacy@pluff.social. Creators may not use Pluff to collect personal information from children in a manner that violates the Children's Online Privacy Protection Act or other child-privacy law.

A minor Buyer should use Pluff only with parent or guardian involvement. Products intended for minors may be restricted or require additional review and safeguards.

Pluff is not designed to receive protected health information on behalf of HIPAA-covered entities, biometric identifiers, precise geolocation, complete financial credentials, Social Security numbers, or other highly sensitive information except through an expressly designated secure and lawful workflow.

Do not place sensitive information in AI prompts, public storefronts, product testimonials, or ordinary support messages. Creators offering health, finance, legal, or similar educational content must avoid collecting unnecessary sensitive Buyer information and must establish their own lawful safeguards.

Where Pluff must process sensitive information for identity verification, account security, payments, or legal compliance, we limit the use to those purposes and to other purposes permitted by law.

Pluff uses automated systems to generate content, recommend structures, detect fraud or abuse, prioritize review, analyze product and feature performance, and protect accounts. AI-generated suggestions do not independently make decisions producing legal or similarly significant effects concerning employment, housing, credit, education, insurance, or health care.

Stripe and security providers may use automated tools for identity verification, payment authorization, fraud detection, risk assessment, and account eligibility under their own policies. A user may contact Pluff about an account restriction, although Pluff cannot override decisions controlled by an independent provider.

Pluff is based in the United States, and personal information may be processed and stored in the United States and other locations where service providers operate. Those locations may have privacy laws different from those in your jurisdiction.

If you are in the European Economic Area, the United Kingdom or Switzerland, data protection law gives you the right to access, correct, delete, restrict or object to the processing of your personal information and to receive a portable copy of it. You can use these rights through your account settings or by contacting privacy@pluff.social, and you can complain to your local data protection authority. Information about you is transferred to and processed in the United States.

Public storefronts and Creator Products may contain links, embeds, files, or integrations controlled by Creators or other third parties. Their privacy and security practices are governed by their own policies. Pluff is not responsible for information you provide directly to them.

Key provider categories include payment and identity services such as Stripe; application, hosting, database, and AI infrastructure such as Lovable and its underlying providers; AI providers such as Anthropic; network and file-storage providers such as Cloudflare (videos Studio Creators upload may be stored with Cloudflare R2); communications and email providers such as Resend and Amazon Web Services; analytics and error-monitoring tools; customer-support tools; and professional advisers. The specific provider set may change as the Service develops.

When you intentionally connect a third-party account, you direct us to exchange the information necessary for that integration. Review the third party's permissions and disconnect access when no longer needed.

If Pluff is involved in a financing, merger, acquisition, reorganization, bankruptcy, sale of assets, or transfer of the Service, personal information may be reviewed or transferred as part of that transaction, subject to appropriate confidentiality and applicable law. We will provide notice if required before information becomes subject to a materially different privacy policy.

We may preserve and disclose information in response to subpoenas, court orders, warrants, regulatory requests, tax obligations, sanctions, or other lawful process. Where legally permitted and appropriate, we may notify the affected person. We may reject requests that are facially invalid, overbroad, or unlawful.

We may update this Policy to reflect changes in products, providers, data practices, or law. The Effective date will identify the current version. For material changes, we will provide reasonable notice through email or the Service when required.

If a change requires consent, we will request it. Continued use after a non-consent-based update takes effect means the updated Policy applies to future use. Earlier processing remains governed by the law and disclosures applicable when it occurred.

Privacy questions and requests may be sent to privacy@pluff.social. Security reports may be sent to support@pluff.social. Legal notices may be sent to legal@pluff.social.

Pluff is based in Florida, United States.