Legal
PLYNX - PRIVACY POLICY
Last updated: September 4, 2026
This Privacy Policy (“Policy”) describes how Plynx (“Plynx”, “we”, “us”, or “our”) collects, uses, discloses, and protects your information when you use the Plynx mobile application (“App”) and related services (collectively, the “Services”).
We are committed to protecting your privacy and handling your data with transparency. Please read this Policy carefully.
SUMMARY
In brief:
- We collect minimal personal data: your email address and a hash of your password
- We collect technical data: IP addresses, board tokens, push notification tokens, and your project and widget configuration
- We store what your boards send us: sensor readings and history, the firmware you upload, and the sketches you write in the web editor
- We ask for your approximate location only if you create a sunrise/sunset automation, and we never track you continuously
- We do NOT collect your name, phone number, physical address, or payment information
- We do NOT sell your data, and we do NOT show advertising
- We do NOT use third-party analytics inside the App; our website uses privacy-friendly page analytics
- The App sends us an anonymous usage summary, at most once a day — including the two answers you give in the welcome screens — with no identifier of any kind attached. You can switch it off in Settings (§2.7)
- Push notifications travel through Google Firebase, and the web editor passes through Vercel: both are named in §5.2 rather than hidden
- The App includes an optional assistant (Archimedes). If you write to it, your questions and the project data it reads in order to answer are processed by external model operators, named in §5.2; the conversations are saved on our server and you can delete them at any time (§2.8)
- You can delete your account and everything attached to it, from the App, at any time
TABLE OF CONTENTS
- Who We Are
- What Information We Collect
- How We Use Your Information
- How We Store Your Information
- How We Share Your Information
- Data Retention
- Your Rights and Choices
- Data Security
- International Data Transfers
- Children’s Privacy
- Third-Party Links and Services
- California Privacy Rights (CCPA)
- European Privacy Rights (GDPR)
- Changes to This Policy
- Contact Us
Appendix: Data Processing Summary
1. WHO WE ARE
Plynx is developed and operated by:
Niccolo Pagano (NickP005)
Email: plynx.cc@gmail.com
Website: https://www.plynx.cc
For GDPR purposes, Niccolo Pagano is the Data Controller for personal data collected through the Plynx Cloud Server (plynx.cc).
If you use a self-hosted server, the operator of that server is the Data Controller.
2. WHAT INFORMATION WE COLLECT
2.1 Information You Provide
When you create an account or use the Services, we collect:
| Data Type | Purpose | Required |
|---|---|---|
| Email Address | Account identification, login, password recovery, service communications | Yes |
| Password | Authentication (stored as cryptographic hash, not plaintext) | Yes |
We do NOT require or collect:
- Full name
- Phone number
- Physical address
- Date of birth
- Payment information (the app is free)
- Government ID numbers
2.2 Information Collected Automatically
| Data | Purpose | Stored on Server |
|---|---|---|
| IP Address | Security, abuse prevention, rate limiting. The IP address of your last login is stored in your profile; the IP address that registered the account is also kept | Yes |
| Connection Timestamps | Show you when your boards were last online, and diagnose connection problems | Yes |
| Device/Board Metadata | Board name, hardware type, firmware version and the last IP address the board connected from | Yes |
| Push Notification Token (Google FCM) | Deliver push notifications to your device. The token is issued by Google Firebase Cloud Messaging, which we use to deliver notifications and which passes them to Apple’s APNs for delivery to iOS devices | Yes |
| Device Identifier | A per-device identifier provided by iOS (identifier for vendor), sent together with your push token so notifications reach the right device and so an old token can be replaced. It is not an advertising identifier and is not used for tracking | Yes, if you enable push notifications |
| Approximate Location | Only if you create a sunrise/sunset automation. The App asks iOS for your approximate location once (reduced accuracy) and sends the resulting coordinates and your time zone to the server, which stores them inside that automation rule and uses them only to compute its daily trigger time. If you create an arrival/departure automation instead, the coordinates you pick stay on your device and are never sent to us. We do not track your location continuously | Only for sunrise/sunset automations |
| Time Zone | Your device’s time zone identifier is sent with every scheduled automation so the server can fire it at the right local time | Yes |
| Web Editor Session Data | When you pair a browser with a project in the web editor, we record that browser’s IP address and user agent for the life of the session, so you can see which browsers are connected and disconnect them. We also count pairing requests per IP address to limit abuse | In memory, for up to 12 hours |
2.3 IoT Device Data
| Data | Description | Stored on Server |
|---|---|---|
| Sensor Readings | Values your boards send to virtual and physical pins | Yes |
| Control Commands | Commands you send to your boards from the App, a widget, a Shortcut or the Apple Watch | Yes |
| Historical Data | Time series used to draw charts and produce reports | Yes |
| Board Authentication Tokens | The credential each board uses to authenticate with the server | Yes |
| Firmware Files | Firmware binaries you upload for over-the-air updates, with their metadata: file size, checksum, version number and upload date | Yes |
| Sketches (your source code) | The sketch you write in the web editor, saved on the server so you can reopen it later. One file per project, up to 256 KB | Yes |
About your source code. When you press Compile, the sketch is sent to our compilation service, running on infrastructure we operate, which builds it and returns the binary. Your board’s authentication token is inserted into the code only at that moment, in transit; the copy saved on the server keeps a placeholder instead. We do not read your sketches. We may use them, in a form that does not identify you, to improve the Services and the assistant, including by training or tuning the models behind it.
2.4 Information Stored Locally on Your Device
Your email address, your password and your access tokens are kept in the device’s secure storage (Keychain on iOS).
To let the Home Screen and Lock Screen widgets, the Live Activities, the Apple Watch app and the Shortcuts actions work while the App is closed, the App also stores in a shared container reserved to Plynx and its own extensions: your project and board names, your widget labels and settings, the most recent pin values, the address and port of your server, and the authentication tokens of your boards. That container is sandboxed to Plynx and its extensions and cannot be read by other apps, but it is not the Keychain, and we tell you so plainly.
When you use a Home Screen or Lock Screen control, the widget contacts your server directly using the board’s token. If your server does not serve HTTPS, that request travels unencrypted and the token appears in the request address.
When you start a control or a timer from outside the App, a Live Activity may appear on your Lock Screen and in the Dynamic Island. It shows the name of the board and the label of the control as you named them, their colour, and the time the command was sent or the time remaining. Anyone who can see your Lock Screen can read those names and, for controls, switch them off from there. No tokens and no sensor readings are shown.
If you use Shortcuts or Siri, the labels of your boards and pins are made available to the system so they can appear as actions you can pick. Running one uses the same locally stored board tokens described above. We do not receive your Shortcuts, and we do not receive anything you say to Siri.
A profile photo you choose is stored on your device only and is never uploaded.
2.5 Information We Do NOT Collect
We want to be clear about what we do not collect:
- Microphone access
- Photos, videos or audio. The App asks for camera access only to read QR codes — for project sharing and for pairing the web editor — and reads only the code itself; no image ever leaves your device
- Contacts, calendars, reminders or health data
- Advertising identifiers, and no advertising of any kind
- Third-party analytics inside the App: there is no Firebase Analytics, no Google Analytics and no advertising SDK in the App. (Our website does use privacy-friendly page analytics — see §2.6, and the App sends an anonymous usage summary of our own — see §2.7.)
- Data about other Bluetooth devices near you. The App uses Bluetooth only to talk to boards you have paired yourself, and values exchanged over Bluetooth never pass through a Plynx server
- We do not sell your data, ever, and we do not build a profile of you: the usage summary described in §2.7 carries no identifier, so there is nothing in it to attach to you
2.6 Website Analytics
Our website (www.plynx.cc), including the pages that host this Policy and the Terms, uses Vercel Web Analytics and Vercel Speed Insights to count page views and measure loading performance. These are aggregate measurements provided by Vercel Inc., our website host; they do not use advertising cookies and do not follow you across other websites. The App does not use them.
2.7 Anonymous Usage Statistics
The App can send us a small, anonymous summary of how it is used, at most once a day, so we can tell which parts of Plynx people actually use and where new users get stuck.
You can switch it off, at any time, in Settings → Share usage stats. When it is off nothing is sent, and nothing is recorded on your device either.
What the summary contains: how often features are opened or used; which widget types you add and use; which kinds of board you connect; which steps of the first setup you reached, including whether a first command left your phone and whether a first value came back from the board; which route you took to get the board online (the guided Wi-Fi setup or the sketch you copy yourself) and, when it did not come online, which step it stopped at; whether a Bluetooth link was established; whether a Home Screen or Lock Screen widget displayed data in the last day; categories of error; the App version; the major version of iOS; whether your account is on the Plynx cloud or on a server you host yourself; your language (one of the five the App speaks, or “other”); whether you are on an iPhone or an iPad; how many times you opened the App since the last summary; how long ago the App was installed, as a range; and the two answers you give in the welcome screens — the kind of experience you are coming from, and what you want to build first.
Those two answers are chosen from a fixed list: there is no free-text field and nothing you type is ever sent. If you skip both questions, nothing is sent for either. If you answer one and skip the other, the one you answered is sent and the other is marked as skipped.
They are sent once per installation: the App keeps them until our server confirms it has received them, and then never sends them again. If a connection drops at the wrong moment the App may send them a second time, so these counts are approximate by design.
What the summary does not contain: no identifier of any kind — no account, no email address, no device or installation identifier; no project, board or widget names; no pin numbers and no sensor values; no server address. Nothing inside the summary itself says who sent it, and we set no cookies to find out.
One thing that is not inside the summary, and that you should know anyway: like every request your device makes to us, the one carrying the summary appears in our operational server log, which records the sending IP address. Those logs are kept for at most 90 days (§6.3), we do not use them to attach a summary to anyone, and once they expire nothing is left that could. We would rather write this down than claim an anonymity the plumbing does not give us.
The summaries themselves are kept without a fixed limit, because they carry no identifier.
2.8 Conversations with the Assistant (Archimedes)
The App includes an assistant, called Archimedes, that answers questions about your boards, wiring and code. It is optional: nothing described in this section happens until you write to it.
What we store. Your conversations with Archimedes are saved on the Plynx Cloud Server, so you can pick them up again from the archive. We keep at most your 50 most recent conversations, and the oldest are dropped as new ones arrive. You can delete any conversation from the archive at any time, and deleting your account deletes them all with it.
What “delete” means here, exactly. A conversation you delete disappears from your archive immediately and for good: from that moment nothing on our side reads it back to you. The stored copy is erased later, and not before 60 days. We write “not before” rather than “after”: the erasure happens the next time that account’s archive is touched, and there is no periodic job that forces it, so an account nobody opens for a year keeps its deleted files for a year. We would rather say this than promise a deadline nothing enforces. Backups follow their own line in §6.3.
What leaves our server, and when. To produce an answer, we send to an external model operator: your message, the conversation so far, and the project data the assistant reads in order to answer. That project data can include your dashboard layout and widget names, board type and status, pin values, firmware versions, and the sketch saved in the web editor, if there is one. The sketch is sent with its secrets removed: authentication tokens and similar values are replaced by a placeholder before the text leaves our server. All of this happens only when you send a message to Archimedes, never in the background.
Who receives it. Requests go to OpenRouter, Inc. (United States), a gateway that forwards them to the operator of the model in use. The model can change: we route between models for cost and availability, including a free tier when a daily spending limit is reached, and the operators behind the gateway change with it. If the gateway is unavailable, requests can go directly to DeepSeek (China) as a fallback. These operators process your conversation content under their own privacy policies; §5.2 lists them, and §9.1 says what this means for transfers outside the EEA.
What we may do with them. We may use your conversations, in a form that does not identify you, to improve the Services and the assistant, including by training or tuning the models behind it.
What you control. In the conversation settings you can restrict, per conversation, which of your projects the assistant is allowed to read. The short title of each conversation is generated the same way, from your first exchange, and travels the same path.
3. HOW WE USE YOUR INFORMATION
We use the information we collect for the following purposes:
3.1 To Provide the Services
- Create and manage your account
- Authenticate your login
- Connect your hardware devices
- Display your dashboards and widget data
- Store historical data for charts
3.2 To Maintain and Improve the Services
- Monitor service performance
- Debug technical issues
- Improve user experience
3.3 To Communicate with You
- Send password reset emails
- Notify you of important service updates
- Respond to your support requests
3.4 To Ensure Security
- Detect and prevent fraud
- Identify unauthorized access
- Protect against abuse
3.5 To Comply with Legal Obligations
- Respond to lawful requests from authorities
- Comply with applicable laws and regulations
We do NOT use your information for:
- Advertising or marketing
- Selling to third parties
- Profiling for commercial purposes
- Automated decision-making that affects your rights
4. HOW WE STORE YOUR INFORMATION
4.1 Storage Location
The Plynx Cloud Server (plynx.cc) runs on hardware we operate in Europe, and your account data, projects and history are stored there.
Two things leave that machine, and we name them here rather than in a footnote:
- Push notifications go through Google Firebase Cloud Messaging (Google LLC), which then hands them to Apple for delivery. What travels is your push token, your device identifier and the text of the notification you configured.
- Compilation: when you press Compile in the web editor, your sketch is sent to our compilation service, which runs on a server we rent and operate. It compiles and returns the binary.
We cannot promise you that Google’s infrastructure keeps your notification data inside the European Economic Area, so we do not make that promise. Where a transfer outside the EEA happens, it relies on the safeguards described in §9.
If you self-host, your data lives on your own server and none of the above applies to it, except that push notifications still travel through Google if you enable them.
4.2 Data Security Measures
- Passwords are hashed; we never store them in readable form
- The connection between the App and the Plynx Cloud Server is encrypted (TLS)
- The web editor is reached over HTTPS
- Board authentication tokens are generated with a cryptographic random source
Where encryption is NOT used, and you should know it:
- Boards connect over the plain hardware port unless your board and server are configured for TLS. Most microcontroller setups are not.
- Over-the-air firmware download: the address the server hands to the board is an ordinary
http://URL. The binary — which contains your board’s token — travels unencrypted on your network. - Home Screen widget controls contact your server over
http://and carry the board token inside the request address.
These are properties of the legacy hardware protocol Plynx speaks, not oversights we are hiding. If this matters for your deployment, keep your server on a network you trust, or put it behind a VPN.
5. HOW WE SHARE YOUR INFORMATION
5.1 We Do NOT Sell Your Data
We do NOT sell, rent, or trade your personal information to third parties for marketing or any other purpose.
5.2 Limited Sharing
We share your information only in these circumstances:
| Recipient | Purpose | Data Shared |
|---|---|---|
| Google LLC (Firebase Cloud Messaging) | Delivering push notifications to your device | Push notification token, device identifier, and the content of the notification you configured |
| Apple Inc. (APNs) | Final delivery of push notifications to iOS devices, downstream of Google | Notification content and delivery token |
| Vercel Inc. | Hosting our website and the web editor. Every web-editor request passes through Vercel on its way to the server, including your sketch and the firmware binaries you upload or download | Whatever that request carries, plus the usual connection metadata |
| Our compilation service | Building the sketch you wrote in the web editor. It runs on infrastructure we rent and operate, not on a third party’s platform | Your sketch, and your board’s authentication token inserted at compile time |
| OpenRouter, Inc. | Producing the assistant’s answers (§2.8). A gateway that forwards each request to the operator of the model in use, which can change | Your message to the assistant, the conversation so far, and the project data the assistant reads in order to answer: dashboard layout and widget names, board type and status, pin values, firmware versions, and the saved sketch with its secrets replaced by a placeholder |
| DeepSeek | Fallback operator for the assistant, used when the gateway is unavailable (§2.8) | The same conversation content as the row above |
| Infrastructure providers | Hosting and running our servers | Technical data necessary to operate them |
| Legal Authorities | When required by law, or to protect rights and safety | Whatever the law requires |
| A successor | If Plynx is ever transferred to someone else, your data may pass with it, and you will be told before it does | Account data |
We do not sell your data and we do not share it with advertisers or data brokers.
5.3 Aggregated Data
We may share aggregated, anonymized data that cannot identify you (e.g., total number of users, general usage statistics).
6. DATA RETENTION
6.1 Active Accounts
While your account exists, we keep your data so the Services can work: your profile, your projects, your boards, your history, the firmware you uploaded and the sketches you saved.
6.2 Account Deletion
You can delete your account and all associated data from the App: Settings → Account → Delete Account. It asks for your password.
What is deleted immediately:
- Your user profile and email address
- All projects, boards and widget configurations
- All board authentication tokens and sharing tokens
- All historical data used for charts and reports
- Push notification tokens
- All firmware binaries you uploaded, and their registry
- All sketches you saved in the web editor
- All web editor sessions, so a browser paired before the deletion cannot keep reading or writing your project afterwards
Your account file is moved to a quarantine area for 5 days, so an accidental deletion can be recovered, and is then permanently removed by an automatic job. During those 5 days the account cannot be used and is not reachable by anyone.
6.3 Retention Periods
| Data | Retention |
|---|---|
| Account data | Until you delete your account, then 5 days in quarantine |
| Sensor history | Until you delete your account, or according to the limits of your own server |
| Firmware binaries and sketches | Until you delete them, or until you delete your account |
| Web editor sessions | Up to 12 hours, or until you disconnect the browser, or immediately on account deletion |
| Assistant conversations (§2.8) | Until you delete them, and at most your 50 most recent; deleting your account removes them all. A deleted conversation leaves your archive immediately and its stored copy is erased not before 60 days — see §2.8 for what “not before” means |
| Server logs | Up to 90 days |
| Anonymous usage summaries (§2.7) | No fixed limit for the summaries themselves, which carry no identifier. The operational log that records the sending IP of the request follows the 90-day line above |
| Backups | Up to 30 days |
Note on logs. Server logs record operational events and can contain your email address and IP address. They are kept for at most 90 days by automatic rotation. We do not use them for any purpose other than operating and securing the Services.
7. YOUR RIGHTS AND CHOICES
You have the following rights regarding your personal data:
7.1 Access
You can request a copy of your personal data.
7.2 Correction
You can update or correct inaccurate data.
7.3 Deletion
You can delete your account and everything attached to it, directly from the App:
- Open the App and go to Settings → Account
- Tap Delete Account
- Enter your password to confirm
What gets deleted:
- Your user profile and email address
- All projects, boards and widget configurations
- All board authentication tokens and sharing tokens
- All historical data used for charts and reports
- Push notification tokens
- All firmware binaries you uploaded, and their registry
- All sketches you saved in the web editor
- All web editor sessions, immediately
Your account file is held in a quarantine area for 5 days, so an accidental deletion can be undone, and is then permanently removed automatically. During those days the account cannot be used.
Important: residual copies may persist in disaster-recovery backups until those backups are overwritten (see §6.3).
You can also request deletion by writing to plynx.cc@gmail.com.
7.4 Data Portability
You can request your data in a portable format (JSON export).
7.5 Restriction
You can request that we limit how we use your data.
7.6 Objection
You can object to certain processing of your data.
7.7 Withdraw Consent
Where processing is based on consent, you can withdraw it at any time. Withdrawing it does not make anything you did before unlawful, and it costs you nothing.
To exercise any of these rights, contact us at: plynx.cc@gmail.com
We will respond to your request within 30 days (or as required by applicable law).
8. DATA SECURITY
We implement reasonable administrative, technical and physical measures to protect your information:
- Passwords are stored only as cryptographic hashes
- The App’s connection to the Plynx Cloud Server is encrypted (TLS), and the web editor is served over HTTPS
- Board authentication tokens are generated from a cryptographic random source
- Server logs rotate automatically and are not kept beyond 90 days
What is not encrypted is listed in §4.2, and we would rather you read it there than discover it: boards usually connect over a plain port, over-the-air firmware downloads travel over http://, and Home Screen widget controls carry the board token in the request address. That is the legacy hardware protocol Plynx speaks.
No system is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential, securing your devices and tokens, and telling us about any security incident you notice.
9. INTERNATIONAL DATA TRANSFERS
9.1 For EU Users
The Plynx Cloud Server (plynx.cc) and our compilation service run on hardware we operate in Europe, and your account data, projects, history, firmware and sketches are stored there.
Push notifications are the exception. They are delivered through Google Firebase Cloud Messaging (Google LLC) and then Apple’s APNs. We cannot verify where Google processes them, so we do not claim that all of your data stays inside the European Economic Area. That transfer relies on the safeguards Google publishes for Firebase, which include the European Commission’s Standard Contractual Clauses. If you never enable push notifications, nothing of yours goes through that path.
The assistant is the other exception. If you write to Archimedes (§2.8), your conversation content is transferred to OpenRouter, Inc. in the United States and to the operator of the model in use, and it can be processed by DeepSeek in China. For China there is no adequacy decision of the European Commission, and we provide no additional safeguards for these transfers. They take place only when you send a message to the assistant. If you do not accept them, do not use the assistant.
Where any other transfer outside the EEA becomes necessary, we rely on one of:
- Standard Contractual Clauses (SCCs)
- an adequacy decision of the European Commission
- your explicit consent
9.2 For Non-EU Users
If you use the Plynx Cloud Server from outside the European Union, your data is transferred to and stored on our servers in Europe.
9.3 If You Self-Host
If you run your own server, your data stays where you put it, and you decide what leaves. The only exception is push notifications, which still travel through Google if you enable them.
10. CHILDREN’S PRIVACY
Consistent with our Terms of Service, an account may be created only by persons who are at least 18 years of age. The Services are not directed to minors: minors may use dashboards and Devices connected to the Services only under the supervision and responsibility of the adult account holder.
We do not knowingly collect personal information directly from minors. If we discover that we have collected personal data directly from a minor, we will delete it promptly.
If you believe we have inadvertently collected data from a minor, please contact us immediately at plynx.cc@gmail.com.
11. THIRD-PARTY LINKS AND SERVICES
The Services may contain links to third-party websites or services. This Privacy Policy does not apply to those third parties.
We recommend reviewing the privacy policies of any third-party services you use.
12. CALIFORNIA PRIVACY RIGHTS (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
12.1 Right to Know
You can request information about:
- Categories of personal information collected
- Purposes for collecting the information
- Categories of third parties with whom we share information
12.2 Right to Delete
You can request deletion of your personal information.
12.3 Right to Opt-Out
You can opt out of the “sale” of personal information. However, we do NOT sell your personal information.
12.4 Right to Non-Discrimination
We will not discriminate against you for exercising your CCPA rights.
12.5 Categories of Personal Information Collected
| Category | Collected | Sold | Business Purpose |
|---|---|---|---|
| Identifiers (email) | Yes | No | Account management |
| Internet activity (IP, tokens) | Yes | No | Service provision, security |
| Geolocation | Yes: IP-based for security, and approximate coordinates if you create a sunrise/sunset automation | No | Security; running the automation you asked for |
| Inferences | No | No | N/A |
To exercise your CCPA rights:
Email: plynx.cc@gmail.com
Subject: “CCPA Request”
We will verify your identity before processing your request.
13. EUROPEAN PRIVACY RIGHTS (GDPR)
If you are a resident of the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR):
13.1 Legal Bases for Processing
We process your data based on:
| Legal Basis | Processing Activity |
|---|---|
| Contract | Account creation, service provision |
| Legitimate Interest | Security, fraud prevention, service improvement |
| Legal Obligation | Compliance with laws |
| Consent | Where specifically requested |
13.2 Your GDPR Rights
- Access (Art. 15) - Request a copy of your data
- Rectification (Art. 16) - Correct inaccurate data
- Erasure (Art. 17) - Request deletion (“right to be forgotten”)
- Restriction (Art. 18) - Limit processing
- Portability (Art. 20) - Receive data in portable format
- Object (Art. 21) - Object to processing based on legitimate interest
- Withdraw Consent (Art. 7) - Withdraw consent at any time
13.3 Data Controller
Data Controller:
Niccolo Pagano
Email: plynx.cc@gmail.com
13.4 Supervisory Authority
You have the right to lodge a complaint with your local data protection authority.
For Italy: Garante per la protezione dei dati personali
Website: https://www.garanteprivacy.it
13.5 Data Protection Impact Assessment
Given the limited nature of data we collect and the absence of high-risk processing activities, a formal DPIA is not required. We keep our data practices under review.
14. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. When we do:
- We will update the “Last updated” date at the top
- For material changes, we will notify you via:
- Email to your registered address
- Notice in the App
For material changes we may also ask you to confirm, explicitly and separately from the Terms of Service, that you have read the updated Policy the next time you sign in to the App. Confirming that you have read this Policy is not a consent to processing: the processing described here rests on the legal bases listed in the Data Processing Summary, and confirming or not confirming does not change them. If you prefer not to confirm, you can request the deletion of your account by writing to plynx.cc@gmail.com from your registered address.
Your continued use of the Services after changes become effective constitutes acceptance of the updated Policy.
Language. This Policy is made available in English and Italian. In the event of any inconsistency between the two versions, the English version shall prevail, it being understood that you retain all rights and protections granted by mandatory provisions of applicable data protection and consumer law, including any rules on language more favorable to you.
15. CONTACT US
If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:
Niccolo Pagano (NickP005)
Email: plynx.cc@gmail.com
Website: https://www.plynx.cc
Response Time:
We aim to respond to all privacy-related inquiries within 30 days.
APPENDIX: DATA PROCESSING SUMMARY
Data We Collect
| Data | Source | Purpose | Legal Basis | Retention |
|---|---|---|---|---|
| You provide | Account ID, login | Contract | Until deletion | |
| Password hash | You provide | Authentication | Contract | Until deletion |
| IP address | Automatic | Security, abuse prevention | Legitimate interest | 90 days in logs; last login IP until deletion |
| Board tokens | Automatic | Hardware authentication | Contract | Until deletion |
| Widget and project configuration | Your devices | Running the Services | Contract | Until deletion |
| Sensor readings and history | Your devices | Charts and reports | Contract | Until deletion |
| Firmware binaries | You upload | Over-the-air updates | Contract | Until you delete them, or until account deletion |
| Sketches (source code) | You write | Saving and compiling your code | Contract | Until account deletion |
| Push notification token and device identifier | Automatic (issued by Google Firebase) | Delivering push notifications | Contract | Until deletion or token invalidation |
| Approximate coordinates and time zone | Your device, only for sunrise/sunset automations | Computing the daily trigger time | Contract | Inside that automation, until you delete it |
| Web editor session IP and user agent | Automatic | Showing you which browsers are paired | Legitimate interest | Up to 12 hours |
| Anonymous usage summary, including the two welcome answers (§2.7) | Your device, unless you switch it off in Settings | Understanding which parts of Plynx are used and where new users get stuck | Legitimate interest, with an opt-out in Settings; the summary carries no identifier | As long as it is useful; it contains no personal data |
Data We Do NOT Collect
- Name, phone number, physical address
- Payment data
- Continuous or precise location tracking
- Contacts, calendars, photos, microphone
- Advertising identifiers, and no advertising
- Third-party analytics inside the App
(Our website measures page views — see §2.6, and the App sends an anonymous usage summary with no identifier — see §2.7. If you create a sunrise/sunset automation, approximate coordinates are collected for that rule — see §2.2.)
BY USING PLYNX, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY.
This Policy is published in English. An Italian translation is available inside the App and at /it/privacy. If the two ever differ, the English text is the one that governs.
CHANGELOG
| Date | Changes |
|---|---|
| November 26, 2025 | Initial version |
| July 6, 2026 | Clarified storage location (Europe); added push notification tokens (APNs) to collected data and recipients; aligned minors section with the Terms of Service (18+ account holders); replaced fixed backup/recovery timeframes with retention criteria; updated contact email; added prevailing-language clause |
| August 6, 2026 | Substantial rewrite after a full review of the code against this Policy. Corrected: push notifications go through Google Firebase, not Apple alone; approximate location is collected for sunrise/sunset automations (it was listed as never collected); the shared container used by widgets, Shortcuts and the Watch holds board tokens and is not the Keychain; over-the-air firmware downloads and widget controls travel unencrypted; the claim that all data stays inside the EEA was withdrawn. Added, having never been described before: over-the-air firmware storage, the web editor and where your sketches go to be compiled, web editor sessions, website analytics, time zone data, and Vercel as a recipient. Log retention of 90 days is now enforced by the server, and account deletion now really removes firmware, sketches and editor sessions — both were changed in the software on the same day. |
| August 7, 2026 | Added to §14: for material changes we may ask you to confirm, separately from the Terms, that you have read the updated Policy at your next sign-in — stating explicitly that this confirmation is not a consent to processing and does not alter the legal bases in the Data Processing Summary, and that you can ask for your account to be deleted instead. |
| August 11, 2026 | §2.7 rewritten in full and, for the first time, announced here: the App sends an anonymous usage summary, and from this version it also carries the two answers you give in the welcome screens (which kind of experience you come from, what you want to build first), both chosen from a fixed list. §2.7 now says what the summary does and does not contain, that it carries no identifier of any kind, that our server does not store the sending IP address, and where to switch it off. Three places that read as though the App sent nothing at all — the summary at the top, §2.5, and the appendix — now point to §2.7; §2.7 itself had been added on August 7 without ever being announced. Added to the Data Processing Summary and to the retention table, which had never listed it. §2.7 also states plainly that the request carrying a summary appears in our operational log with its sending IP, like every other request: claiming otherwise would have been more flattering and less true. |
| September 1, 2026 | Added §2.8 for the in-app assistant (Archimedes), announced here for the first time: conversations are stored on the Plynx Cloud Server (at most your 50 most recent, deletable one by one or with the account), and to produce an answer your message, the conversation so far and the project data the assistant reads are sent to OpenRouter, Inc. (United States) and to the operator of the model in use, with DeepSeek (China) as a fallback; sketch secrets are replaced by a placeholder before anything leaves our server. Both operators were added to the Data Processing Summary and the conversations to the retention table. §9.1 now states the transfer plainly: no adequacy decision for China, no additional safeguards from us, nothing is sent unless you write to the assistant, and whoever does not accept that should not use it. |
| September 2, 2026 | The Terms and this Policy no longer say that your sketches are never used to train anything. Both now say that what you store with the Services and what you write to the assistant may be used, in a form that does not identify you, to improve the Services and the assistant, including by training or tuning the models behind it (source code paragraph in §2, and §2.8). Nothing changes about who receives your data or how long it is kept. Same day, a correction on retention rather than a change to it: §2.8 and the retention table now say what deleting a conversation really does. It leaves your archive immediately and for good; the stored copy is erased not before 60 days, and “not before” is meant literally — the erasure happens the next time that account’s archive is touched, and no periodic job forces it. The Policy had said only “until you delete them”, which understated it. |
Copyright 2025 Plynx / Niccolo Pagano.