Privacy Policy

1. Who we are

Plask ("we", "our", "us") is a service that builds a private profit and loss view across the apps and sites you run. It reads revenue from Stripe, RevenueCat, App Store Connect and Google Play, and in beta from Lemon Squeezy, Polar and Creem; traffic, and Google Ads cost and AdMob or AdSense earnings, from Google Analytics 4; ad spend from Apple Search Ads and Meta if you connect them; and the ad spend and costs you enter by hand. This policy explains what we collect, why, where it is stored and how to remove it.

2. What we collect

2.1 Your account

When you sign in with Google we store your name, email address and profile picture to identify your account. If you pay, we store your Stripe customer ID and subscription status. We never see or store your card details.

2.2 Connections you add

• Stripe. You paste a restricted key (rk_live_) that you create in your Stripe dashboard with read-only permissions. We use it to read balance transactions and their sources, charges, refunds, disputes, invoices, subscriptions and products. It cannot write to your Stripe account.
• RevenueCat. You paste a v2 secret API key. We use it to read revenue, MRR, trials and active subscriptions for your projects.
• Live updates (optional, Pro). If you turn on live updates, Stripe or RevenueCat sends us each payment event as it happens. An event can include details about your customer; we read only the amount, currency, time and which product it belongs to, and discard the rest immediately. To match a Stripe payment to a product, we look up its charge and invoice with your read-only key. We keep a running total per product for the day, deleted by the first sync after the day ends. Event IDs are kept for 7 days so nothing counts twice. Your Stripe signing secret is encrypted; the RevenueCat header value is stored only as a hash. We never publish live figures. Plask processes this only on your behalf, as your service provider.
• Google Analytics 4. You grant read-only OAuth access (the analytics.readonly scope). We read sessions, users, campaign names and users per app version, and, for a product with no other revenue source, the purchase revenue your site or app reports to GA4, shown as an estimate. If you pick events to track for a product, we read each of those events' daily count, by event name. To show you which events you can pick, we read the names and last-28-day counts of the events GA4 reports for that product; that list is kept in memory for a few minutes and never saved. We also read your daily ad earnings totals from GA4 (AdMob or AdSense, when linked), shown as an estimate. When Google Ads accounts are linked to the property, we read each campaign's name and daily cost, clicks and impressions from GA4 and use the cost as your Google Ads spend. We cannot change your GA4 configuration.
• Google Search Console. You grant read-only OAuth access (the webmasters.readonly scope) and pick the sites to connect. We read search performance per site: clicks, impressions, click-through rate and average position. We cannot change your Search Console settings, sitemaps or verification. This data is private to you and is never shown on the board or your public profile.
• App Store Connect. You create a Team API key with the Sales role and give us the private key file (.p8), its Key ID, your Issuer ID and your vendor number. Apple has no narrower key: a Team key covers all your apps. The Sales role can view sales and trends but can't edit apps, prices or promo codes. We use the key only to read your app list (name, bundle ID, SKU) and your daily sales and subscription summary reports, and we never change anything. We can't check a key's role, so don't reuse an Admin key. The .p8 file is encrypted at rest (AES-256-GCM) and used only to sign report requests. Revoke the key in App Store Connect and it stops working everywhere, including here.
• Google Play. You create a service account in your own Google Cloud project just for us, with no project roles, invite it in Play Console under Users and permissions with two account permissions, “View app information and download bulk reports (read-only)” and “View financial data, orders, and cancellation survey responses”, and upload its JSON key to us with your reports bucket ID. Play has no narrower permissions for reports; these also open app information, orders and cancellation survey responses. We read only the sales and earnings report files in your Play Console reports bucket, and never use Google's Play Developer APIs. If you grant only those permissions, the key cannot change your apps, prices, listings or users. The key is encrypted at rest (AES-256-GCM).
• Lemon Squeezy, Polar and Creem (beta). You give us an API key. Polar tokens need only read scopes; we check that the ones we use are there when you connect. Lemon Squeezy and Creem keys can't be limited to reading, so they could make changes in your account; we only read, and never change anything. Test and sandbox keys are refused. We read your stores or organization, products, orders or transactions, subscriptions, invoices and refunds to build daily totals per product, and never store customer names, emails or card details. Keys are encrypted at rest (AES-256-GCM).
• Apple Search Ads (Pro). We create a key pair and show you only the public key; you add it to an API user with a read-only role in Apple Ads and give us its three IDs. We read your ad accounts and their roles, your app campaigns (ID, name and the App Store app they promote) and daily spend per campaign, and store nothing else. The private key is encrypted at rest (AES-256-GCM) and never shown or logged.
• Meta Ads (Pro). You create a system user token in your own Meta app with only the ads_read permission; we refuse a token that can do more, or one we can't check. We read your ad account's name, currency, time zone and status, your campaigns (ID, name, status) and daily spend per campaign. We never read Pages, users, audiences, creatives or other metrics. The token is encrypted at rest (AES-256-GCM).

Keys and OAuth tokens are encrypted with AES-256-GCM before they are stored, and are only decrypted on the server to fetch your data.

2.3 Things you enter

Ad spend per product, channel and date range, whether you type it in or your AI agent syncs it via MCP (other channels may add daily impressions, clicks, installs and conversions; for Apple Ads we store only the spend amount); fixed costs per product per month; markers for releases, campaigns and price changes; your notes on Focus cards (Done, Not now, Wrong); the share of profit you set aside for tax, which is never published; and, if you opt in, your public profile settings.

Provider requests: when you open a provider marked Coming soon, tell us you want it, or ask for a provider we don't support, we store the provider name, any text you type and the time, linked to your account. Requests you type are emailed to our support inbox so we can reply.

2.4 What we store, and what we never store

2.5 Use of our own website

With your consent, we use Google Analytics 4 (loaded through Google Tag Manager with Consent Mode) to see which pages are visited and which features are used. If you decline in the cookie banner, analytics cookies are not set. Google may process your IP address, browser and approximate location under the Google Privacy Policy. We also use Vercel Analytics, which does not use cookies.

3. How we use your data

• To sync your sources daily and show your portfolio P&L, products table and product pages.
• To pick up to three Focus cards a week using fixed rules over your daily totals, and to score past cards against what happened next so the rules you can trust rank higher for you.
• To suggest markers from new GA4 campaign names, to add a release marker when a new app version shows up in GA4 or App Store Connect, and to compare the 14 days before and after a marker.
• To detect anomalies in your revenue and MRR and send the alerts you set up.
• To send your digest: daily, weekly or monthly on Pro (your choice), monthly on Free.
• To answer requests from AI clients you connect through our MCP server, using an API key you create, and, only with a key you create with write access, to store the ad spend and markers your agent syncs. For these syncs your agent uses your own access to the ad platforms, not ours, and you are responsible for those platforms' terms. With a key you create with “Allow adding and organising revenue sources”, your agent can also connect Stripe, RevenueCat, Google Play or App Store Connect for you, and on Pro Apple Search Ads or Meta Ads; the keys it passes are handled exactly like keys you paste in the app: checked, encrypted at rest, never returned or logged, and used only to read your data. A key you give an AI agent also passes through the AI provider and the agent's own logs, which we don't control, so use a dedicated, read-only key you can revoke. Synced spend, its metrics and any cost per install or return on ad spend are never published.
• To decide which sources to build next.
• To run billing and tell you about changes to the service.

We do not sell your data, use it for advertising, or benchmark you against other users.

4. AI explanations

Focus cards are chosen by rules, not by a language model. To write the one-line explanation on a card or in a digest, we send aggregated numbers (for example, "revenue down 18%, visitors up 2%") for the product in question to Anthropic's Claude Haiku. We never send keys, tokens, customer data or raw Google user data.

5. Public profiles and the board

Nothing about you is public until you choose to list a product: for each product you pick list, list anonymously or keep private, with nothing pre-selected. The numbers of a listed product are public and exact: revenue for the last 7 days, 30 days and all time from Stripe, RevenueCat, App Store Connect or Google Play, 30-day growth, MRR, months profitable in a row and verified source badges. Profit is only ever shown as a streak, never as an amount. Metrics derived from GA4, including GA4 revenue estimates, from Google Search Console, or from ad platforms are never shown publicly.

X, Bluesky and website links you add to your profile or a product are public, and so are a listed product's tagline, categories and platforms. App Store and Google Play links are published only if you turn on “Show store links on the board”, and only from your verified store connections. Listing a product anonymously hides its name, tagline, categories and links, showing only its platforms, and keeps it off your profile and out of your totals. Staying anonymous as a maker hides your name, handle and links, lists every product you list anonymously, and means there is no profile page. If your first listing is anonymous, no public profile page is created. After “Unlist all” or turning your profile off, listing anything again asks for your consent again. Anonymity hides names and links, not numbers: the numbers of products you list are still public, and if you publish the same figures elsewhere, someone may match them. The board publishes 7-day, 30-day and all-time totals that update daily, so day-to-day changes are visible.

The board and public profiles read only from a published snapshot, not from your live data, and are marked noindex until the board opens. Changing a setting rebuilds the snapshot straight away. Leaving the board or switching to anonymous takes effect right away. Cached copies of the board, the Markdown pages and share cards can take a few minutes to update. The snapshot also refreshes every night.

6. Who processes data for us

• Supabase hosts our PostgreSQL database in the EU (eu-west-1, Ireland).
• Vercel hosts the application and handles all web requests.
• Google provides sign-in, the GA4 Data and Admin APIs and the Search Console API, and analytics on our own site.
• Stripe processes our subscription payments. Separately, your own Stripe account is read with the restricted key you provide.
• RevenueCat is read with the key you provide.
• Apple (App Store Connect API) is read with the API key you provide.
• Google Play and Google Cloud Storage are read with the service account key you upload.
• Lemon Squeezy, Polar and Creem are read with the API key you provide, if you connect them.
• Anthropic writes the one-line explanations from aggregated numbers.
• Resend delivers alert and digest emails. It receives your email address and the email content, including provider requests you send us.
• Slack and Discord receive alert messages only if you connect a webhook.

Each provider receives only what it needs for its job and may not use your data for anything else. Some providers are based in the United States; where data leaves the EU, it does so under the provider's standard contractual clauses.

7. Google user data

Plask's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. GA4 data is used only to show you your own products, run your Focus rules and markers, and write your digest. Search Console data is used only to show you your own sites' search performance next to your products. Neither is ever transferred to anyone else except the processors listed above for those purposes.

8. Security

• Keys and OAuth tokens are encrypted with AES-256-GCM, with versioned payloads so keys can be rotated.
• All traffic uses HTTPS.
• The database is only reachable by the application. The board and public profiles read from a separate snapshot.
• MCP and glance API keys are shown once and stored hashed. You can revoke them at any time.

9. Retention and deletion

We keep your data while your account exists, so trends and comparisons keep working. You can remove a connection at any time; its key is deleted. You can also revoke access on the provider's side: roll or delete the Stripe restricted key, delete the RevenueCat key, revoke the API key under Users and Access, Integrations in App Store Connect, delete or disable the service account key in Google Cloud or remove the service account under Users and permissions in Play Console, delete the Lemon Squeezy API key, revoke the Polar token, delete the Creem API key (Developers in Creem), remove the API user or its key in Apple Ads, remove the system user's token or access in Meta Business Settings, disconnect Search Console in Sources, or remove access in your Google Account permissions. After that we cannot read anything more.

Deleting your account deletes your profile, connections, keys, daily totals, markers, costs, alerts, digests and any public profile, and cancels an active subscription. Stripe keeps its own billing records under its own policy. Copies may remain in database backups, which we keep for at most 30 days, until they expire.

10. Your rights

You can access, get a copy of, correct or delete your data, restrict or object to processing, and withdraw any consent you gave (for example, take a product off the board). You can delete your account and turn off emails yourself in Settings. To exercise any other right, email us at the address below. We'll reply within one month, and send a copy of your data in a common machine-readable format if you ask for one. If you are in the EU or EEA you can also complain to your local data protection authority.

11. Cookies

• Session cookie. Essential, keeps you signed in.
• Week start (week_start). Set only if you choose Monday or Sunday under Settings, so weeks start the way you asked. It holds nothing else and expires after a year.
• Google Analytics (_ga, _ga_*). Only with your consent; used to measure site usage. They expire after up to 2 years.

Your cookie choice is remembered in your browser's local storage, not in a cookie. We use no advertising cookies.

12. Plans and payments

Free covers 1 product. Pro costs $5 a month or $48 a year; Founding Pro is $36 a year for the first 50 makers, locked while subscribed. Payments are handled by Stripe. See our Terms of Service for billing details.

13. Children

Plask is not meant for anyone under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes

If we change this policy in a material way we will update the date at the top and, where appropriate, email you before the change takes effect.

15. Contact

Questions about privacy: privacy@plask.dev. Everything else: support@plask.dev.